[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE335P4ENK3SR1KJ4FKDDG":3,"skill-same:01M6AE335P4ENK3SR1KJ4FKDDG":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AE335P4ENK3SR1KJ4FKDDG","conducting-internal-reconnaissance-with-bloodhound-ce",null,"Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"conducting internal reconnaissance with bloodhound ce","reconnaissance","red-team","graph-analysis","bloodhound","escalation","hardening","attack-paths","privilege-escalation","active-directory","directory","graph","admin","database","authentication","entra id","validate","sessions","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: conducting-internal-reconnaissance-with-bloodhound-ce\ndescription: Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- reconnaissance\n- bloodhound\n- active-directory\n- attack-paths\n- privilege-escalation\n- graph-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Restore Access\n- Password Authentication\n- Biometric Authentication\n- Strong Password Policy\n- Restore User Account Access\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1087.002\n- T1069.002\n- T1482\n- T1018\n---\n# Conducting Internal Reconnaissance with BloodHound CE\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nBloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD \u002F Entra ID environments.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting internal reconnaissance with bloodhound ce\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Deploy BloodHound CE server using Docker Compose\n- Collect AD data using SharpHound v2 or BloodHound.py\n- Import collected data into BloodHound CE for graph analysis\n- Identify shortest attack paths from owned principals to Domain Admins\n- Discover ACL-based attack paths, Kerberoastable accounts, and delegation abuse\n- Execute custom Cypher queries for advanced attack path analysis\n- Generate attack path reports for engagement documentation\n\n## MITRE ATT&CK Mapping\n\n- **T1087.002** - Account Discovery: Domain Account\n- **T1069.002** - Permission Groups Discovery: Domain Groups\n- **T1482** - Domain Trust Discovery\n- **T1615** - Group Policy Discovery\n- **T1018** - Remote System Discovery\n- **T1033** - System Owner\u002FUser Discovery\n- **T1016** - System Network Configuration Discovery\n\n## Workflow\n\n### Phase 1: BloodHound CE Deployment\n1. Deploy BloodHound CE using Docker Compose:\n   ```bash\n   curl -L https:\u002F\u002Fghst.ly\u002Fgetbhce -o docker-compose.yml\n   docker compose pull\n   docker compose up -d\n   ```\n2. Access the web interface at https:\u002F\u002Flocalhost:8080\n3. Log in with the default admin credentials (displayed in Docker logs):\n   ```bash\n   docker compose logs | grep \"Initial Password\"\n   ```\n4. Change the default admin password immediately\n\n### Phase 2: Data Collection with SharpHound v2\n1. Transfer SharpHound v2 to the compromised Windows host:\n   ```powershell\n   # Execute full collection\n   .\\SharpHound.exe -c All --outputdirectory C:\\Temp\n\n   # DCOnly collection (LDAP only, stealthier)\n   .\\SharpHound.exe -c DCOnly\n\n   # Session collection for logged-on user mapping\n   .\\SharpHound.exe -c Session --loop --loopduration 02:00:00\n\n   # Collect from specific domain\n   .\\SharpHound.exe -c All -d child.domain.local\n   ```\n2. Alternative: Use BloodHound.py from Linux:\n   ```bash\n   bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All\n   ```\n3. Exfiltrate the generated ZIP file to the analysis workstation\n\n### Phase 3: Data Import and Initial Analysis\n1. Upload collected data via the BloodHound CE web interface (File Ingest)\n2. Mark compromised accounts as \"Owned\" in the interface\n3. Run built-in analysis queries:\n   - Shortest Path to Domain Admin\n   - Kerberoastable Users with Path to DA\n   - AS-REP Roastable Users\n   - Users with DCSync Rights\n   - Computers with Unconstrained Delegation\n\n### Phase 4: Custom Cypher Queries\n1. Execute custom Cypher queries in the BloodHound CE search bar:\n   ```cypher\n   \u002F\u002F Find shortest path from owned principals to Domain Admins\n   MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:\"DOMAIN ADMINS@DOMAIN.LOCAL\"}))\n   RETURN p\n\n   \u002F\u002F Find Kerberoastable users with path to DA\n   MATCH (u:User {hasspn:true})\n   MATCH p=shortestPath((u)-[*1..]->(g:Group {name:\"DOMAIN ADMINS@DOMAIN.LOCAL\"}))\n   RETURN p\n\n   \u002F\u002F Find computers with sessions of DA members\n   MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:\"DOMAIN ADMINS@DOMAIN.LOCAL\"})\n   RETURN c.name, u.name\n\n   \u002F\u002F Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)\n   MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)\n   WHERE u.owned = true\n   RETURN p\n\n   \u002F\u002F Find users who can DCSync\n   MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)\n   RETURN u.name, d.name\n\n   \u002F\u002F Find computers with LAPS but readable by non-admins\n   MATCH (c:Computer {haslaps:true})\n   MATCH p=(u:User)-[:ReadLAPSPassword]->(c)\n   RETURN p\n   ```\n\n### Phase 5: Attack Path Prioritization\n1. Score identified attack paths by:\n   - Number of hops (shorter = higher priority)\n   - Stealth requirements (avoid noisy techniques)\n   - Tool availability for each hop\n   - Likelihood of detection at each step\n2. Create an execution plan for the highest-priority paths\n3. Identify required tools for each step in the chain\n4. Plan OPSEC considerations for each technique\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| BloodHound CE | Web-based graph analysis platform | Docker |\n| SharpHound v2 | AD data collection (.NET, for CE) | Windows |\n| BloodHound.py | AD data collection (Python) | Linux |\n| AzureHound | Azure AD \u002F Entra ID data collection | Cross-platform |\n| PlumHound | Automated BloodHound reporting | Python |\n| BloodHound Query Library | Community Cypher query repository | Web |\n\n## Key Attack Path Types\n\n| Path Type | Description | Example |\n|-----------|-------------|---------|\n| ACL Abuse | Exploit misconfigured ACLs | GenericAll on DA group |\n| Kerberoasting | Crack service account passwords | SPN account → DA |\n| AS-REP Roasting | Attack accounts without pre-auth | No-preauth user → password crack |\n| Delegation Abuse | Exploit unconstrained\u002Fconstrained delegation | Computer → impersonate DA |\n| GPO Abuse | Modify GPOs applied to privileged OUs | GPO write → code execution on DA |\n| Session Hijack | Leverage DA sessions on compromised hosts | Admin session → token theft |\n\n## Validation Criteria\n\n- [ ] BloodHound CE deployed and accessible\n- [ ] SharpHound v2 data collected from all domains in scope\n- [ ] Data successfully imported into BloodHound CE\n- [ ] Owned principals marked in the interface\n- [ ] Shortest paths to Domain Admin identified\n- [ ] ACL-based attack paths documented\n- [ ] Kerberoastable and AS-REP roastable accounts listed\n- [ ] Custom Cypher queries executed for advanced analysis\n- [ ] Attack paths prioritized by feasibility and stealth\n- [ ] Report generated with all identified paths and evidence\n","# Conducting Internal Reconnaissance with BloodHound CE\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nBloodHound Community Edition (CE) is a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory to reveal hidden relationships and attack paths within AD environments. Unlike the legacy BloodHound application, BloodHound CE uses a PostgreSQL backend with a dedicated graph database, providing improved performance, a modern web UI, and enhanced API capabilities. Red teams use BloodHound CE to collect AD objects, ACLs, sessions, group memberships, and trust relationships, then visualize attack paths from compromised low-privileged accounts to high-value targets like Domain Admins. The SharpHound collector (v2 for CE) gathers data from Active Directory, while AzureHound collects from Azure AD \u002F Entra ID environments.\n\n\n## When to Use\n\n- When conducting security assessments that involve conducting internal reconnaissance with bloodhound ce\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Deploy BloodHound CE server using Docker Compose\n- Collect AD data using SharpHound v2 or BloodHound.py\n- Import collected data into BloodHound CE for graph analysis\n- Identify shortest attack paths from owned principals to Domain Admins\n- Discover ACL-based attack paths, Kerberoastable accounts, and delegation abuse\n- Execute custom Cypher queries for advanced attack path analysis\n- Generate attack path reports for engagement documentation\n\n## MITRE ATT&CK Mapping\n\n- **T1087.002** - Account Discovery: Domain Account\n- **T1069.002** - Permission Groups Discovery: Domain Groups\n- **T1482** - Domain Trust Discovery\n- **T1615** - Group Policy Discovery\n- **T1018** - Remote System Discovery\n- **T1033** - System Owner\u002FUser Discovery\n- **T1016** - System Network Configuration Discovery\n\n## Workflow\n\n### Phase 1: BloodHound CE Deployment\n1. Deploy BloodHound CE using Docker Compose:\n   ```bash\n   curl -L https:\u002F\u002Fghst.ly\u002Fgetbhce -o docker-compose.yml\n   docker compose pull\n   docker compose up -d\n   ```\n2. Access the web interface at https:\u002F\u002Flocalhost:8080\n3. Log in with the default admin credentials (displayed in Docker logs):\n   ```bash\n   docker compose logs | grep \"Initial Password\"\n   ```\n4. Change the default admin password immediately\n\n### Phase 2: Data Collection with SharpHound v2\n1. Transfer SharpHound v2 to the compromised Windows host:\n   ```powershell\n   # Execute full collection\n   .\\SharpHound.exe -c All --outputdirectory C:\\Temp\n\n   # DCOnly collection (LDAP only, stealthier)\n   .\\SharpHound.exe -c DCOnly\n\n   # Session collection for logged-on user mapping\n   .\\SharpHound.exe -c Session --loop --loopduration 02:00:00\n\n   # Collect from specific domain\n   .\\SharpHound.exe -c All -d child.domain.local\n   ```\n2. Alternative: Use BloodHound.py from Linux:\n   ```bash\n   bloodhound-python -u user -p 'Password123' -d domain.local -ns 10.10.10.1 -c All\n   ```\n3. Exfiltrate the generated ZIP file to the analysis workstation\n\n### Phase 3: Data Import and Initial Analysis\n1. Upload collected data via the BloodHound CE web interface (File Ingest)\n2. Mark compromised accounts as \"Owned\" in the interface\n3. Run built-in analysis queries:\n   - Shortest Path to Domain Admin\n   - Kerberoastable Users with Path to DA\n   - AS-REP Roastable Users\n   - Users with DCSync Rights\n   - Computers with Unconstrained Delegation\n\n### Phase 4: Custom Cypher Queries\n1. Execute custom Cypher queries in the BloodHound CE search bar:\n   ```cypher\n   \u002F\u002F Find shortest path from owned principals to Domain Admins\n   MATCH p=shortestPath((n {owned:true})-[*1..]->(m:Group {name:\"DOMAIN ADMINS@DOMAIN.LOCAL\"}))\n   RETURN p\n\n   \u002F\u002F Find Kerberoastable users with path to DA\n   MATCH (u:User {hasspn:true})\n   MATCH p=shortestPath((u)-[*1..]->(g:Group {name:\"DOMAIN ADMINS@DOMAIN.LOCAL\"}))\n   RETURN p\n\n   \u002F\u002F Find computers with sessions of DA members\n   MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:\"DOMAIN ADMINS@DOMAIN.LOCAL\"})\n   RETURN c.name, u.name\n\n   \u002F\u002F Find ACL-based attack paths (GenericAll, WriteDACL, GenericWrite)\n   MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword*1..]->(t)\n   WHERE u.owned = true\n   RETURN p\n\n   \u002F\u002F Find users who can DCSync\n   MATCH (u)-[:MemberOf*0..]->()-[:DCSync|GetChanges|GetChangesAll*1..]->(d:Domain)\n   RETURN u.name, d.name\n\n   \u002F\u002F Find computers with LAPS but readable by non-admins\n   MATCH (c:Computer {haslaps:true})\n   MATCH p=(u:User)-[:ReadLAPSPassword]->(c)\n   RETURN p\n   ```\n\n### Phase 5: Attack Path Prioritization\n1. Score identified attack paths by:\n   - Number of hops (shorter = higher priority)\n   - Stealth requirements (avoid noisy techniques)\n   - Tool availability for each hop\n   - Likelihood of detection at each step\n2. Create an execution plan for the highest-priority paths\n3. Identify required tools for each step in the chain\n4. Plan OPSEC considerations for each technique\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| BloodHound CE | Web-based graph analysis platform | Docker |\n| SharpHound v2 | AD data collection (.NET, for CE) | Windows |\n| BloodHound.py | AD data collection (Python) | Linux |\n| AzureHound | Azure AD \u002F Entra ID data collection | Cross-platform |\n| PlumHound | Automated BloodHound reporting | Python |\n| BloodHound Query Library | Community Cypher query repository | Web |\n\n## Key Attack Path Types\n\n| Path Type | Description | Example |\n|-----------|-------------|---------|\n| ACL Abuse | Exploit misconfigured ACLs | GenericAll on DA group |\n| Kerberoasting | Crack service account passwords | SPN account → DA |\n| AS-REP Roasting | Attack accounts without pre-auth | No-preauth user → password crack |\n| Delegation Abuse | Exploit unconstrained\u002Fconstrained delegation | Computer → impersonate DA |\n| GPO Abuse | Modify GPOs applied to privileged OUs | GPO write → code execution on DA |\n| Session Hijack | Leverage DA sessions on compromised hosts | Admin session → token theft |\n\n## Validation Criteria\n\n- [ ] BloodHound CE deployed and accessible\n- [ ] SharpHound v2 data collected from all domains in scope\n- [ ] Data successfully imported into BloodHound CE\n- [ ] Owned principals marked in the interface\n- [ ] Shortest paths to Domain Admin identified\n- [ ] ACL-based attack paths documented\n- [ ] Kerberoastable and AS-REP roastable accounts listed\n- [ ] Custom Cypher queries executed for advanced analysis\n- [ ] Attack paths prioritized by feasibility and stealth\n- [ ] Report generated with all identified paths and evidence\n",{"name":5,"tags":49,"author":50,"domain":42,"license":15,"version":51,"nist_csf":52,"subdomain":56,"description":7,"mitre_attack":57,"d3fend_techniques":62},[26,25,28,33,31,32,27],"mahipal","1.0",[53,54,55],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[58,59,60,61],"T1087.002","T1069.002","T1482","T1018",[63,64,65,66,67],"Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-internal-reconnaissance-with-bloodhound-ce",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-internal-reconnaissance-with-bloodhound-ce",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-internal-reconnaissance-with-bloodhound-ce","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1006,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1817,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",1083,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",1937,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",5444,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",7444,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-internal-reconnaissance-with-bloodhound-ce\u002Fscripts\u002Fprocess.py",[128,155,178,206,232,259],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,140,42,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,140,43,42,143,166,167,168,169,170,171,172,173,174,175,176,177],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[184,187],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[172,189,190,191,192,42,193,194,166,195,196,197,198,199,200,201,202,203,204,205],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,42,217,218,219,220,221,222,223,224,225,226,227,228,169,229,230,231],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,42,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[265],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,267,42,268,269,270,271,272,273,274,275,201,276,202,277,278,279,280,281,282],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]