[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE1QHSKPRGFNWAHPP7FZRP":3,"skill-same:01M6AE1QHSKPRGFNWAHPP7FZRP":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AE1QHSKPRGFNWAHPP7FZRP","collecting-open-source-intelligence",null,"Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcollecting-open-source-intelligence\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"collecting open source intelligence","open source","NIST-CSF","ATT&CK-T1591","Recon-ng","Shodan","reconnaissance","spiderfoot","maltego","NIST","data","malicious","cti","threat-intelligence","red team","osint","monitoring","infrastructure","web","cybersecurity","2026-11-10 10:12:30",false,"---\nname: collecting-open-source-intelligence\ndescription: 'Collects and synthesizes open-source intelligence (OSINT) about threat\n  actors, malicious infrastructure, and attack campaigns using publicly available\n  data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating\n  external threat actor infrastructure, performing pre-engagement reconnaissance for\n  authorized red team assessments, or enriching CTI reports with publicly available\n  adversary context. Activates for requests involving Maltego, Shodan, OSINT framework,\n  SpiderFoot, or infrastructure reconnaissance.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- OSINT\n- Maltego\n- Shodan\n- Recon-ng\n- SpiderFoot\n- threat-intelligence\n- ATT&CK-T1591\n- NIST-CSF\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1593.001\n- T1589.002\n- T1596.002\n- T1590\n- T1596.001\n---\n# Collecting Open-Source Intelligence\n\n## When to Use\n\nUse this skill when:\n- Investigating external infrastructure associated with a phishing campaign targeting your organization\n- Enriching threat actor profiles with publicly observable indicators (WHOIS, ASN data, SSL certificates)\n- Conducting authorized attack surface discovery to understand your organization's external exposure\n\n**Do not use** this skill for active scanning against targets without explicit written authorization — OSINT collection must remain passive (no packets sent to target systems) unless scope permits active recon.\n\n## Prerequisites\n\n- Maltego CE or commercial license for graph-based link analysis\n- Shodan API key (https:\u002F\u002Fshodan.io) for internet-wide device\u002Fservice discovery\n- OSINT Framework familiarity (https:\u002F\u002Fosintframework.com) for tool selection\n- SpiderFoot HX or open-source SpiderFoot for automated OSINT correlation\n\n## Workflow\n\n### Step 1: Define Collection Requirements\n\nEstablish the intelligence requirement (IR) before collecting. Document:\n- Target: threat actor group, malicious domain, IP range, or organization\n- Priority Intelligence Requirements (PIRs): What specific questions need answering?\n- Legal authority: Passive OSINT is legal; active probing requires authorization\n- Data handling: TLP classification for collected intelligence\n\n### Step 2: Passive DNS and WHOIS Investigation\n\n```bash\n# Passive DNS via SecurityTrails API\ncurl \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomain\u002Fevil-domain.com\u002Fdns\u002Fa\" \\\n  -H \"apikey: YOUR_KEY\"\n\n# WHOIS history via ARIN \u002F RIPE\nwhois -h whois.arin.net evil-domain.com\n\n# Certificate transparency logs (no API key required)\ncurl \"https:\u002F\u002Fcrt.sh\u002F?q=%.evil-domain.com&output=json\" | jq '.[].name_value'\n```\n\nCertificate transparency logs reveal all subdomains for a target domain, often exposing staging, VPN, or internal infrastructure inadvertently made public.\n\n### Step 3: Shodan Infrastructure Mapping\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\n# Search for specific C2 framework signatures (Cobalt Strike beacon)\nresults = api.search('product:\"Cobalt Strike\" port:443')\nfor r in results['matches']:\n    print(r['ip_str'], r['port'], r['org'], r.get('ssl', {}).get('cert', {}).get('subject', ''))\n\n# Find infrastructure associated with a known threat actor's ASN\nresults = api.search('asn:AS12345 http.title:\"Redirector\"')\n```\n\nCorrelate Shodan results with passive DNS to build infrastructure clusters.\n\n### Step 4: Maltego Graph Analysis\n\nIn Maltego, use these built-in transforms for threat actor infrastructure mapping:\n1. Start with a known malicious domain (Entity: Domain)\n2. Run \"To IP Address [DNS]\" → identifies hosting IPs\n3. Run \"To Shared Hosting\" → identifies co-hosted domains (potentially same threat actor)\n4. Run \"To DNS Name [Reverse DNS]\" → identifies PTR records\n5. Run \"To Whois\" → identifies registrant email\u002Forganization\n6. Pivot on registrant email → \"To Domains [Registrant Email]\" → expands to all domains registered with same email\n\nMaltego Maltego Cyber threat intelligence transforms (VirusTotal, Shodan, PassiveTotal, URLScan) extend graph coverage.\n\n### Step 5: Dark Web and Paste Site Monitoring\n\nUse SpiderFoot HX or manual searches for:\n- Paste sites (Pastebin, Ghostbin): search for leaked credentials, IOCs, malware configs\n- Dark web forums: via Tor browser with appropriate operational security\n- GitHub\u002FGitLab: search for exposed credentials or organization-specific strings\n\n```bash\n# SpiderFoot CLI for automated OSINT\npython sf.py -s evil-domain.com -m sfp_shodan,sfp_virustotal,sfp_passivetotal \\\n  -o TF -R result.json\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Passive OSINT** | Intelligence collection that does not send any packets to target systems — uses public databases, search engines, cached data |\n| **PIR** | Priority Intelligence Requirement — specific question the intelligence collection must answer, preventing unfocused data gathering |\n| **Certificate Transparency** | Public log of all SSL\u002FTLS certificates issued by CAs, enabling discovery of subdomains via crt.sh |\n| **Pivoting** | Using one data point (IP, email, registrant name) to discover related infrastructure or accounts |\n| **ASN** | Autonomous System Number — block of IP addresses under a single routing policy; useful for clustering threat actor infrastructure |\n| **Co-hosted Domains** | Multiple domains resolving to the same IP, potentially indicating shared attacker infrastructure |\n\n## Tools & Systems\n\n- **Maltego**: Graph-based link analysis platform with 50+ data source transforms for IP, domain, email, and social media analysis\n- **Shodan**: Internet-wide scanner database with 1B+ indexed devices; supports banner, port, SSL certificate, and vulnerability searches\n- **SpiderFoot**: Automated OSINT tool with 200+ modules covering DNS, WHOIS, dark web, breach data, and social media\n- **Recon-ng**: Python-based OSINT framework with modular design for domain, email, and social media reconnaissance\n- **crt.sh**: Free certificate transparency search engine for subdomain and certificate discovery\n- **OSINT Framework (osintframework.com)**: Curated directory of OSINT tools organized by intelligence category\n\n## Common Pitfalls\n\n- **Leaving digital footprints**: Visiting a threat actor's website or Shodan-queried IP can alert the adversary. Use Tor or VPN with a dedicated OSINT VM.\n- **Confirmation bias in graph analysis**: Maltego graphs can create false connections. Verify each pivot independently before treating as confirmed.\n- **Outdated data**: WHOIS privacy services and bulletproof hosting rotate frequently. Always check data timestamps — 6-month-old passive DNS may no longer be valid.\n- **Attribution overconfidence**: Infrastructure overlap does not guarantee same threat actor. False flag operations deliberately share indicators across groups.\n- **Legal boundaries**: Some OSINT tools perform active scans (port scanning, banner grabbing). Confirm tool behavior before use against external targets without authorization.\n","# Collecting Open-Source Intelligence\n\n## When to Use\n\nUse this skill when:\n- Investigating external infrastructure associated with a phishing campaign targeting your organization\n- Enriching threat actor profiles with publicly observable indicators (WHOIS, ASN data, SSL certificates)\n- Conducting authorized attack surface discovery to understand your organization's external exposure\n\n**Do not use** this skill for active scanning against targets without explicit written authorization — OSINT collection must remain passive (no packets sent to target systems) unless scope permits active recon.\n\n## Prerequisites\n\n- Maltego CE or commercial license for graph-based link analysis\n- Shodan API key (https:\u002F\u002Fshodan.io) for internet-wide device\u002Fservice discovery\n- OSINT Framework familiarity (https:\u002F\u002Fosintframework.com) for tool selection\n- SpiderFoot HX or open-source SpiderFoot for automated OSINT correlation\n\n## Workflow\n\n### Step 1: Define Collection Requirements\n\nEstablish the intelligence requirement (IR) before collecting. Document:\n- Target: threat actor group, malicious domain, IP range, or organization\n- Priority Intelligence Requirements (PIRs): What specific questions need answering?\n- Legal authority: Passive OSINT is legal; active probing requires authorization\n- Data handling: TLP classification for collected intelligence\n\n### Step 2: Passive DNS and WHOIS Investigation\n\n```bash\n# Passive DNS via SecurityTrails API\ncurl \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\u002Fdomain\u002Fevil-domain.com\u002Fdns\u002Fa\" \\\n  -H \"apikey: YOUR_KEY\"\n\n# WHOIS history via ARIN \u002F RIPE\nwhois -h whois.arin.net evil-domain.com\n\n# Certificate transparency logs (no API key required)\ncurl \"https:\u002F\u002Fcrt.sh\u002F?q=%.evil-domain.com&output=json\" | jq '.[].name_value'\n```\n\nCertificate transparency logs reveal all subdomains for a target domain, often exposing staging, VPN, or internal infrastructure inadvertently made public.\n\n### Step 3: Shodan Infrastructure Mapping\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\n# Search for specific C2 framework signatures (Cobalt Strike beacon)\nresults = api.search('product:\"Cobalt Strike\" port:443')\nfor r in results['matches']:\n    print(r['ip_str'], r['port'], r['org'], r.get('ssl', {}).get('cert', {}).get('subject', ''))\n\n# Find infrastructure associated with a known threat actor's ASN\nresults = api.search('asn:AS12345 http.title:\"Redirector\"')\n```\n\nCorrelate Shodan results with passive DNS to build infrastructure clusters.\n\n### Step 4: Maltego Graph Analysis\n\nIn Maltego, use these built-in transforms for threat actor infrastructure mapping:\n1. Start with a known malicious domain (Entity: Domain)\n2. Run \"To IP Address [DNS]\" → identifies hosting IPs\n3. Run \"To Shared Hosting\" → identifies co-hosted domains (potentially same threat actor)\n4. Run \"To DNS Name [Reverse DNS]\" → identifies PTR records\n5. Run \"To Whois\" → identifies registrant email\u002Forganization\n6. Pivot on registrant email → \"To Domains [Registrant Email]\" → expands to all domains registered with same email\n\nMaltego Maltego Cyber threat intelligence transforms (VirusTotal, Shodan, PassiveTotal, URLScan) extend graph coverage.\n\n### Step 5: Dark Web and Paste Site Monitoring\n\nUse SpiderFoot HX or manual searches for:\n- Paste sites (Pastebin, Ghostbin): search for leaked credentials, IOCs, malware configs\n- Dark web forums: via Tor browser with appropriate operational security\n- GitHub\u002FGitLab: search for exposed credentials or organization-specific strings\n\n```bash\n# SpiderFoot CLI for automated OSINT\npython sf.py -s evil-domain.com -m sfp_shodan,sfp_virustotal,sfp_passivetotal \\\n  -o TF -R result.json\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Passive OSINT** | Intelligence collection that does not send any packets to target systems — uses public databases, search engines, cached data |\n| **PIR** | Priority Intelligence Requirement — specific question the intelligence collection must answer, preventing unfocused data gathering |\n| **Certificate Transparency** | Public log of all SSL\u002FTLS certificates issued by CAs, enabling discovery of subdomains via crt.sh |\n| **Pivoting** | Using one data point (IP, email, registrant name) to discover related infrastructure or accounts |\n| **ASN** | Autonomous System Number — block of IP addresses under a single routing policy; useful for clustering threat actor infrastructure |\n| **Co-hosted Domains** | Multiple domains resolving to the same IP, potentially indicating shared attacker infrastructure |\n\n## Tools & Systems\n\n- **Maltego**: Graph-based link analysis platform with 50+ data source transforms for IP, domain, email, and social media analysis\n- **Shodan**: Internet-wide scanner database with 1B+ indexed devices; supports banner, port, SSL certificate, and vulnerability searches\n- **SpiderFoot**: Automated OSINT tool with 200+ modules covering DNS, WHOIS, dark web, breach data, and social media\n- **Recon-ng**: Python-based OSINT framework with modular design for domain, email, and social media reconnaissance\n- **crt.sh**: Free certificate transparency search engine for subdomain and certificate discovery\n- **OSINT Framework (osintframework.com)**: Curated directory of OSINT tools organized by intelligence category\n\n## Common Pitfalls\n\n- **Leaving digital footprints**: Visiting a threat actor's website or Shodan-queried IP can alert the adversary. Use Tor or VPN with a dedicated OSINT VM.\n- **Confirmation bias in graph analysis**: Maltego graphs can create false connections. Verify each pivot independently before treating as confirmed.\n- **Outdated data**: WHOIS privacy services and bulletproof hosting rotate frequently. Always check data timestamps — 6-month-old passive DNS may no longer be valid.\n- **Attribution overconfidence**: Infrastructure overlap does not guarantee same threat actor. False flag operations deliberately share indicators across groups.\n- **Legal boundaries**: Some OSINT tools perform active scans (port scanning, banner grabbing). Confirm tool behavior before use against external targets without authorization.\n",{"name":5,"tags":49,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":37,"description":60,"mitre_attack":61},[50,51,29,28,52,37,27,26],"OSINT","Maltego","SpiderFoot","mahipal","1.0.0",[56,57,58,59],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.\n",[62,63,64,65,66],"T1593.001","T1589.002","T1596.002","T1590","T1596.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fcollecting-open-source-intelligence",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcollecting-open-source-intelligence\u002FSKILL.md",true,[91,97,102,106],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"agents\u002Fopenai.yaml","REFERENCE","参考文档",166,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fto-questionnaire\u002Fagents\u002Fopenai.yaml",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcollecting-open-source-intelligence\u002FLICENSE",{"path":103,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md",2050,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcollecting-open-source-intelligence\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",6542,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fcollecting-open-source-intelligence\u002Fscripts\u002Fagent.py",[113,140,164,191,216,243],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,125,43,126,127,128,129,130,131,132,133,134,135,136,137,138,139],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[146],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,136,149,150,125,151,43,128,152,153,154,155,156,157,158,159,160,161,162,163],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[170,173],{"categoryNo":171,"categoryName":172,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,175,176,177,178,43,41,179,152,180,181,182,183,184,185,186,187,188,189,190],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,43,202,203,204,205,206,207,208,34,209,210,211,212,155,213,214,215],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,43,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[125,251,43,252,253,254,255,256,33,257,258,186,259,187,260,261,262,263,264,265],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]