[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADSBKZQ0K2K48WK1RA9QRY":3,"skill-same:01M6ADSBKZQ0K2K48WK1RA9QRY":134},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":81,"commitSha":82,"skillDirectory":83,"forksCount":84,"repositoryHtmlUrl":85,"repositoryHomepageUrl":86,"ownerHtmlUrl":87,"ownerBlogUrl":88,"ownerDescription":89,"updatedAt":90,"install":91,"resources":104},"01M6ADSBKZQ0K2K48WK1RA9QRY","analyzing-ransomware-payment-wallets",null,"Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-ransomware-payment-wallets\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"analyzing ransomware payment wallets","ransomware","analyzing","threat-intelligence","bitcoin","cryptocurrency","extortion","blockchain","attribution","cybersecurity","forensics","payments","transfer","tracing","pr","support","threat intelligence","2026-11-10 10:12:30",false,"---\nname: analyzing-ransomware-payment-wallets\ndescription: 'Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.\n\n  '\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- blockchain\n- cryptocurrency\n- forensics\n- threat-intelligence\n- bitcoin\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1657\n- T1486\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - monetization\n  - stealth\n  techniques:\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1017\n    name: Conversion to Physical Monetary Instruments\n    tactic: monetization\n    source: f3\n  - id: F1017.001\n    name: 'Conversion to Physical Monetary Instruments: Cash'\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n  - id: F1045\n    name: Structuring\n    tactic: stealth\n    source: f3\n---\n\n# Analyzing Ransomware Payment Wallets\n\n## When to Use\n\n- An organization has been hit by ransomware and the ransom note contains a Bitcoin or cryptocurrency wallet address that needs investigation\n- Law enforcement or incident responders need to trace where ransom payments flowed after the victim paid\n- Threat intelligence analysts are attributing ransomware campaigns by clustering payment infrastructure across incidents\n- Investigators need to determine if a ransomware group is reusing wallet infrastructure across multiple victims\n- Compliance or legal teams need evidence of fund flows for prosecution, sanctions enforcement, or insurance claims\n\n**Do not use** this skill for live payment interception or to interact directly with ransomware operators. All analysis should be passive and read-only against public blockchain data.\n\n## Prerequisites\n\n- Python 3.8+ with `requests`, `json`, and `hashlib` libraries\n- Access to blockchain explorer APIs (blockchain.com, WalletExplorer.com, Blockstream.info)\n- Familiarity with Bitcoin transaction model (UTXOs, inputs, outputs, change addresses)\n- Understanding of common obfuscation techniques (mixers, tumblers, peel chains, cross-chain swaps)\n- Optional: Chainalysis Reactor license for enterprise-grade cluster analysis\n- Optional: OXT.me for advanced transaction graph visualization\n\n## Workflow\n\n### Step 1: Extract Wallet Address from Ransom Note\n\nParse the ransom note to identify the payment address(es):\n\n```\nCommon address formats:\n  Bitcoin (P2PKH):   1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa  (starts with 1)\n  Bitcoin (P2SH):    3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy  (starts with 3)\n  Bitcoin (Bech32):  bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq (starts with bc1)\n  Monero:            4... (95 characters, much harder to trace)\n  Ethereum:          0x... (40 hex chars)\n```\n\n### Step 2: Query Blockchain Explorer for Transaction History\n\nRetrieve all transactions associated with the wallet:\n\n```python\nimport requests\n\ndef get_wallet_transactions(address):\n    \"\"\"Query blockchain.com API for address transactions.\"\"\"\n    url = f\"https:\u002F\u002Fblockchain.info\u002Frawaddr\u002F{address}\"\n    resp = requests.get(url, timeout=30)\n    resp.raise_for_status()\n    data = resp.json()\n    return {\n        \"address\": address,\n        \"n_tx\": data.get(\"n_tx\", 0),\n        \"total_received_satoshi\": data.get(\"total_received\", 0),\n        \"total_sent_satoshi\": data.get(\"total_sent\", 0),\n        \"final_balance_satoshi\": data.get(\"final_balance\", 0),\n        \"transactions\": data.get(\"txs\", []),\n    }\n```\n\n### Step 3: Map Fund Flow and Identify Clusters\n\nTrace outputs from the ransom wallet to downstream addresses:\n\n```\nFund Flow Analysis:\n━━━━━━━━━━━━━━━━━━\nVictim Payment ──► Ransom Wallet ──► Consolidation Wallet\n                                  ├─► Mixer\u002FTumbler Service\n                                  ├─► Exchange Deposit Address\n                                  └─► Peel Chain (sequential small outputs)\n\nKey indicators:\n  - Consolidation: Multiple ransom payments aggregated into one wallet\n  - Peel chains: Sequential transactions with diminishing outputs\n  - Mixer usage: Funds sent to known mixer addresses (Wasabi, Samourai, ChipMixer)\n  - Exchange cashout: Deposits to known exchange wallets (Binance, Kraken hot wallets)\n```\n\n### Step 4: Cross-Reference with Known Wallet Databases\n\nCheck addresses against known ransomware infrastructure:\n\n```python\n# Check WalletExplorer for entity identification\ndef check_wallet_explorer(address):\n    url = f\"https:\u002F\u002Fwww.walletexplorer.com\u002Fapi\u002F1\u002Faddress?address={address}&caller=research\"\n    resp = requests.get(url, timeout=30)\n    data = resp.json()\n    return {\n        \"wallet_id\": data.get(\"wallet_id\"),\n        \"label\": data.get(\"label\", \"Unknown\"),\n        \"is_exchange\": data.get(\"is_exchange\", False),\n    }\n```\n\n### Step 5: Generate Attribution Report\n\nCompile findings into a structured intelligence report:\n\n```\nRANSOMWARE WALLET ANALYSIS REPORT\n====================================\nRansom Address:      bc1q...xyz\nFamily Attribution:  LockBit 3.0 (based on ransom note format)\nTotal Received:      4.25 BTC ($178,500 at time of payment)\nTotal Sent:          4.25 BTC (wallet fully drained)\nNumber of Payments:  3 (likely 3 separate victims)\n\nFUND FLOW:\n  Payment 1: 1.5 BTC → Consolidation wallet → Binance deposit\n  Payment 2: 1.0 BTC → Wasabi Mixer → Unknown\n  Payment 3: 1.75 BTC → Peel chain (12 hops) → OKX deposit\n\nCLUSTER ANALYSIS:\n  Related wallets: 47 addresses identified in same cluster\n  Total cluster volume: 156.3 BTC ($6.5M USD)\n  First activity: 2024-01-15\n  Last activity: 2024-09-22\n```\n\n## Verification\n\n- Confirm wallet address format is valid before querying APIs\n- Cross-reference transaction timestamps with known incident timelines\n- Validate cluster associations by checking common-input-ownership heuristic\n- Compare findings against OFAC SDN list for sanctioned addresses\n- Verify exchange attribution against multiple sources (WalletExplorer, OXT, Chainalysis)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **UTXO** | Unspent Transaction Output; the fundamental unit of Bitcoin that tracks ownership through a chain of transactions |\n| **Cluster Analysis** | Grouping multiple Bitcoin addresses believed to be controlled by the same entity using common-input-ownership and change-address heuristics |\n| **Peel Chain** | A laundering pattern where funds are sent through many sequential transactions, each peeling off a small amount to a new address |\n| **CoinJoin\u002FMixer** | Privacy techniques that combine multiple users' transactions to obscure the link between sender and receiver |\n| **Common Input Ownership** | Heuristic that assumes all inputs to a single transaction are controlled by the same entity |\n\n## Tools & Systems\n\n- **Chainalysis Reactor**: Enterprise blockchain investigation platform with entity attribution and cross-chain tracing\n- **WalletExplorer**: Free tool that clusters Bitcoin addresses and labels known services (exchanges, mixers, markets)\n- **OXT.me**: Advanced Bitcoin transaction visualization with UTXO graph analysis\n- **Blockstream.info**: Open-source Bitcoin block explorer with full API access\n- **blockchain.com API**: Free API for querying Bitcoin address balances and transaction histories\n- **OFAC SDN List**: U.S. Treasury sanctioned address list for compliance checking\n","# Analyzing Ransomware Payment Wallets\n\n## When to Use\n\n- An organization has been hit by ransomware and the ransom note contains a Bitcoin or cryptocurrency wallet address that needs investigation\n- Law enforcement or incident responders need to trace where ransom payments flowed after the victim paid\n- Threat intelligence analysts are attributing ransomware campaigns by clustering payment infrastructure across incidents\n- Investigators need to determine if a ransomware group is reusing wallet infrastructure across multiple victims\n- Compliance or legal teams need evidence of fund flows for prosecution, sanctions enforcement, or insurance claims\n\n**Do not use** this skill for live payment interception or to interact directly with ransomware operators. All analysis should be passive and read-only against public blockchain data.\n\n## Prerequisites\n\n- Python 3.8+ with `requests`, `json`, and `hashlib` libraries\n- Access to blockchain explorer APIs (blockchain.com, WalletExplorer.com, Blockstream.info)\n- Familiarity with Bitcoin transaction model (UTXOs, inputs, outputs, change addresses)\n- Understanding of common obfuscation techniques (mixers, tumblers, peel chains, cross-chain swaps)\n- Optional: Chainalysis Reactor license for enterprise-grade cluster analysis\n- Optional: OXT.me for advanced transaction graph visualization\n\n## Workflow\n\n### Step 1: Extract Wallet Address from Ransom Note\n\nParse the ransom note to identify the payment address(es):\n\n```\nCommon address formats:\n  Bitcoin (P2PKH):   1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa  (starts with 1)\n  Bitcoin (P2SH):    3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy  (starts with 3)\n  Bitcoin (Bech32):  bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq (starts with bc1)\n  Monero:            4... (95 characters, much harder to trace)\n  Ethereum:          0x... (40 hex chars)\n```\n\n### Step 2: Query Blockchain Explorer for Transaction History\n\nRetrieve all transactions associated with the wallet:\n\n```python\nimport requests\n\ndef get_wallet_transactions(address):\n    \"\"\"Query blockchain.com API for address transactions.\"\"\"\n    url = f\"https:\u002F\u002Fblockchain.info\u002Frawaddr\u002F{address}\"\n    resp = requests.get(url, timeout=30)\n    resp.raise_for_status()\n    data = resp.json()\n    return {\n        \"address\": address,\n        \"n_tx\": data.get(\"n_tx\", 0),\n        \"total_received_satoshi\": data.get(\"total_received\", 0),\n        \"total_sent_satoshi\": data.get(\"total_sent\", 0),\n        \"final_balance_satoshi\": data.get(\"final_balance\", 0),\n        \"transactions\": data.get(\"txs\", []),\n    }\n```\n\n### Step 3: Map Fund Flow and Identify Clusters\n\nTrace outputs from the ransom wallet to downstream addresses:\n\n```\nFund Flow Analysis:\n━━━━━━━━━━━━━━━━━━\nVictim Payment ──► Ransom Wallet ──► Consolidation Wallet\n                                  ├─► Mixer\u002FTumbler Service\n                                  ├─► Exchange Deposit Address\n                                  └─► Peel Chain (sequential small outputs)\n\nKey indicators:\n  - Consolidation: Multiple ransom payments aggregated into one wallet\n  - Peel chains: Sequential transactions with diminishing outputs\n  - Mixer usage: Funds sent to known mixer addresses (Wasabi, Samourai, ChipMixer)\n  - Exchange cashout: Deposits to known exchange wallets (Binance, Kraken hot wallets)\n```\n\n### Step 4: Cross-Reference with Known Wallet Databases\n\nCheck addresses against known ransomware infrastructure:\n\n```python\n# Check WalletExplorer for entity identification\ndef check_wallet_explorer(address):\n    url = f\"https:\u002F\u002Fwww.walletexplorer.com\u002Fapi\u002F1\u002Faddress?address={address}&caller=research\"\n    resp = requests.get(url, timeout=30)\n    data = resp.json()\n    return {\n        \"wallet_id\": data.get(\"wallet_id\"),\n        \"label\": data.get(\"label\", \"Unknown\"),\n        \"is_exchange\": data.get(\"is_exchange\", False),\n    }\n```\n\n### Step 5: Generate Attribution Report\n\nCompile findings into a structured intelligence report:\n\n```\nRANSOMWARE WALLET ANALYSIS REPORT\n====================================\nRansom Address:      bc1q...xyz\nFamily Attribution:  LockBit 3.0 (based on ransom note format)\nTotal Received:      4.25 BTC ($178,500 at time of payment)\nTotal Sent:          4.25 BTC (wallet fully drained)\nNumber of Payments:  3 (likely 3 separate victims)\n\nFUND FLOW:\n  Payment 1: 1.5 BTC → Consolidation wallet → Binance deposit\n  Payment 2: 1.0 BTC → Wasabi Mixer → Unknown\n  Payment 3: 1.75 BTC → Peel chain (12 hops) → OKX deposit\n\nCLUSTER ANALYSIS:\n  Related wallets: 47 addresses identified in same cluster\n  Total cluster volume: 156.3 BTC ($6.5M USD)\n  First activity: 2024-01-15\n  Last activity: 2024-09-22\n```\n\n## Verification\n\n- Confirm wallet address format is valid before querying APIs\n- Cross-reference transaction timestamps with known incident timelines\n- Validate cluster associations by checking common-input-ownership heuristic\n- Compare findings against OFAC SDN list for sanctioned addresses\n- Verify exchange attribution against multiple sources (WalletExplorer, OXT, Chainalysis)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **UTXO** | Unspent Transaction Output; the fundamental unit of Bitcoin that tracks ownership through a chain of transactions |\n| **Cluster Analysis** | Grouping multiple Bitcoin addresses believed to be controlled by the same entity using common-input-ownership and change-address heuristics |\n| **Peel Chain** | A laundering pattern where funds are sent through many sequential transactions, each peeling off a small amount to a new address |\n| **CoinJoin\u002FMixer** | Privacy techniques that combine multiple users' transactions to obscure the link between sender and receiver |\n| **Common Input Ownership** | Heuristic that assumes all inputs to a single transaction are controlled by the same entity |\n\n## Tools & Systems\n\n- **Chainalysis Reactor**: Enterprise blockchain investigation platform with entity attribution and cross-chain tracing\n- **WalletExplorer**: Free tool that clusters Bitcoin addresses and labels known services (exchanges, mixers, markets)\n- **OXT.me**: Advanced Bitcoin transaction visualization with UTXO graph analysis\n- **Blockstream.info**: Open-source Bitcoin block explorer with full API access\n- **blockchain.com API**: Free API for querying Bitcoin address balances and transaction histories\n- **OFAC SDN List**: U.S. Treasury sanctioned address list for compliance checking\n",{"name":5,"tags":46,"author":47,"domain":33,"license":15,"version":48,"mitre_f3":49,"nist_csf":71,"subdomain":76,"description":77,"mitre_attack":78},[25,31,29,34,27,28],"mahipal","1.0.0",{"tactics":50,"version":53,"techniques":54},[51,52],"monetization","stealth","1.1",[55,59,62,65,68],{"id":56,"name":57,"source":58,"tactic":51},"F1018","Convert to Cryptocurrency","f3",{"id":60,"name":61,"source":58,"tactic":51},"F1017","Conversion to Physical Monetary Instruments",{"id":63,"name":64,"source":58,"tactic":51},"F1017.001","Conversion to Physical Monetary Instruments: Cash",{"id":66,"name":67,"source":58,"tactic":51},"F1047","Transfer of funds",{"id":69,"name":70,"source":58,"tactic":52},"F1045","Structuring",[72,73,74,75],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense","Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.\n",[79,80],"T1657","T1486","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-ransomware-payment-wallets",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":92,"prompt":102,"zipAvailable":103},[93,96,99],{"tool":94,"command":95},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-ransomware-payment-wallets",{"tool":97,"command":98},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-ransomware-payment-wallets",{"tool":100,"command":101},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-ransomware-payment-wallets","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-ransomware-payment-wallets\u002FSKILL.md",true,[105,110,114,120,124,128],{"path":106,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-ransomware-payment-wallets\u002FLICENSE",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"LICENSE.txt",1092,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fzapier-workflows\u002FLICENSE.txt",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fapi-reference.md","REFERENCE","参考文档",3058,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-ransomware-payment-wallets\u002Freferences\u002Fapi-reference.md",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fmcp-patterns.md",2174,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fzapier-workflows\u002Freferences\u002Fmcp-patterns.md",{"path":125,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":126,"sourceHtmlUrl":127},"references\u002Fzaps.md",1660,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fzapier-workflows\u002Freferences\u002Fzaps.md",{"path":129,"resourceType":130,"resourceTypeDesc":131,"sizeBytes":132,"sourceHtmlUrl":133},"scripts\u002Fagent.py","SCRIPT","脚本",7968,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-ransomware-payment-wallets\u002Fscripts\u002Fagent.py",[135,161,185,211,237,264],{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,144,145,146,147,33,148,149,38,150,151,152,153,154,155,156,157,158,159,160],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[167],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[169,157,170,171,147,172,33,38,173,174,175,176,177,178,179,180,181,182,183,184],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":195,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[191,194],{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[179,196,197,198,199,33,200,201,173,202,203,204,25,29,205,206,207,208,209,210],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,33,222,223,224,225,226,227,228,229,230,231,232,233,176,234,235,236],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[243],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[245,246,247,33,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":265,"name":266,"nameZh":6,"description":267,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":268,"categories":269,"keywords":271,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[270],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,272,33,273,274,275,276,277,278,279,280,206,281,207,282,283,284,285,286,287],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]