[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE865GY8MV6ES1P72FKX1S":3,"skill-same:01M6AE865GY8MV6ES1P72FKX1S":122},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":81,"commitSha":82,"skillDirectory":83,"forksCount":84,"repositoryHtmlUrl":85,"repositoryHomepageUrl":86,"ownerHtmlUrl":87,"ownerBlogUrl":88,"ownerDescription":89,"updatedAt":90,"install":91,"resources":104},"01M6AE865GY8MV6ES1P72FKX1S","deploying-ransomware-canary-files",null,"Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read\u002Fmodify\u002Frename\u002Fdelete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36140,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-ransomware-canary-files\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"ransomware","deploying ransomware canary files","cryptocurrency","python","defense","early-warning","watchdog","edr","canary-files","detection","deception","cybersecurity","slack","email","alerting","file","library","database","delete","pr","2026-11-10 10:12:30",false,"---\nname: deploying-ransomware-canary-files\ndescription: Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read\u002Fmodify\u002Frename\u002Fdelete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed.\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- canary-files\n- watchdog\n- detection\n- early-warning\n- deception\n- defense\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1486\n- T1083\n- T1490\n- T1485\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - monetization\n  techniques:\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1017\n    name: Conversion to Physical Monetary Instruments\n    tactic: monetization\n    source: f3\n  - id: F1025.003\n    name: 'Electronic Funds Transfer: Wire Transfer'\n    tactic: monetization\n    source: f3\n---\n# Deploying Ransomware Canary Files\n\n## When to Use\n\n- Deploying proactive ransomware detection on file servers, NAS devices, or endpoint systems\n- Building an early-warning system that detects ransomware before it encrypts business-critical data\n- Supplementing EDR solutions with lightweight canary file monitoring on systems where agents cannot be deployed\n- Testing ransomware incident response procedures by simulating canary file triggers\n- Monitoring shared drives, home directories, and backup volumes for unauthorized file operations\n\n**Do not use** as a replacement for endpoint protection, backup strategy, or network segmentation. Canary files are a detection layer, not a prevention mechanism.\n\n## Prerequisites\n\n- Python 3.8+ with pip\n- watchdog library (pip install watchdog)\n- Write access to directories where canary files will be placed\n- SMTP server credentials or Slack webhook URL for alerting\n- Administrative access for placing canaries in system directories\n\n## Workflow\n\n### Step 1: Generate Canary Files\n\nCreate decoy files with realistic names and content that attract ransomware scanners. Files should have names like `Passwords.xlsx`, `Financial_Report_2026.docx`, `backup_credentials.csv` and contain plausible-looking but fake data. Place them in directories ransomware typically targets first: user desktops, Documents folders, network share roots, and backup paths.\n\n### Step 2: Deploy Filesystem Monitor\n\nUse Python's watchdog library with a custom `FileSystemEventHandler` that watches canary file paths. The handler triggers on `on_modified`, `on_deleted`, `on_moved`, and `on_created` events for canary files. Any legitimate user or process should never touch these files, so any interaction is a high-confidence indicator of ransomware or unauthorized access.\n\n### Step 3: Configure Alert Pipeline\n\nWire the filesystem monitor to multiple alert channels: email via SMTP, Slack webhook POST, syslog forwarding to SIEM, and local log file. Include the triggering event type, file path, timestamp, and process information (when available) in alert payloads.\n\n### Step 4: Validate and Test\n\nSimulate ransomware behavior by programmatically modifying, renaming, and deleting canary files to verify the detection pipeline fires correctly. Measure time-to-alert and validate alert delivery across all configured channels.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Canary File** | A decoy file placed in a monitored directory that triggers an alert when accessed, modified, or deleted |\n| **Watchdog** | Python library that monitors filesystem events using OS-native APIs (inotify on Linux, FSEvents on macOS, ReadDirectoryChangesW on Windows) |\n| **Honey File** | Synonym for canary file; a fake document designed to attract and detect malicious activity |\n| **Entropy Check** | Measuring randomness in file content to detect encryption (ransomware produces high-entropy output) |\n\n## Tools & Systems\n\n- **watchdog**: Python filesystem monitoring library using OS-native event APIs\n- **smtplib**: Python standard library for SMTP email alerting\n- **requests**: HTTP library for Slack webhook integration\n- **hashlib**: SHA-256 hashing for canary file integrity verification\n- **psutil**: Process information gathering when canary file access is detected\n\n## Output Format\n\n```\nRANSOMWARE CANARY ALERT\n========================\nTimestamp: 2026-03-11T14:23:07Z\nEvent: FILE_MODIFIED\nCanary File: \u002Fsrv\u002Fshares\u002Ffinance\u002FPasswords.xlsx\nDirectory: \u002Fsrv\u002Fshares\u002Ffinance\nSHA-256 Before: a3f2...8b4c\nSHA-256 After: 7e91...2d3f\nAlert Channels: [email, slack, syslog]\nAction: Investigate immediately - potential ransomware activity\n```\n","# Deploying Ransomware Canary Files\n\n## When to Use\n\n- Deploying proactive ransomware detection on file servers, NAS devices, or endpoint systems\n- Building an early-warning system that detects ransomware before it encrypts business-critical data\n- Supplementing EDR solutions with lightweight canary file monitoring on systems where agents cannot be deployed\n- Testing ransomware incident response procedures by simulating canary file triggers\n- Monitoring shared drives, home directories, and backup volumes for unauthorized file operations\n\n**Do not use** as a replacement for endpoint protection, backup strategy, or network segmentation. Canary files are a detection layer, not a prevention mechanism.\n\n## Prerequisites\n\n- Python 3.8+ with pip\n- watchdog library (pip install watchdog)\n- Write access to directories where canary files will be placed\n- SMTP server credentials or Slack webhook URL for alerting\n- Administrative access for placing canaries in system directories\n\n## Workflow\n\n### Step 1: Generate Canary Files\n\nCreate decoy files with realistic names and content that attract ransomware scanners. Files should have names like `Passwords.xlsx`, `Financial_Report_2026.docx`, `backup_credentials.csv` and contain plausible-looking but fake data. Place them in directories ransomware typically targets first: user desktops, Documents folders, network share roots, and backup paths.\n\n### Step 2: Deploy Filesystem Monitor\n\nUse Python's watchdog library with a custom `FileSystemEventHandler` that watches canary file paths. The handler triggers on `on_modified`, `on_deleted`, `on_moved`, and `on_created` events for canary files. Any legitimate user or process should never touch these files, so any interaction is a high-confidence indicator of ransomware or unauthorized access.\n\n### Step 3: Configure Alert Pipeline\n\nWire the filesystem monitor to multiple alert channels: email via SMTP, Slack webhook POST, syslog forwarding to SIEM, and local log file. Include the triggering event type, file path, timestamp, and process information (when available) in alert payloads.\n\n### Step 4: Validate and Test\n\nSimulate ransomware behavior by programmatically modifying, renaming, and deleting canary files to verify the detection pipeline fires correctly. Measure time-to-alert and validate alert delivery across all configured channels.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Canary File** | A decoy file placed in a monitored directory that triggers an alert when accessed, modified, or deleted |\n| **Watchdog** | Python library that monitors filesystem events using OS-native APIs (inotify on Linux, FSEvents on macOS, ReadDirectoryChangesW on Windows) |\n| **Honey File** | Synonym for canary file; a fake document designed to attract and detect malicious activity |\n| **Entropy Check** | Measuring randomness in file content to detect encryption (ransomware produces high-entropy output) |\n\n## Tools & Systems\n\n- **watchdog**: Python filesystem monitoring library using OS-native event APIs\n- **smtplib**: Python standard library for SMTP email alerting\n- **requests**: HTTP library for Slack webhook integration\n- **hashlib**: SHA-256 hashing for canary file integrity verification\n- **psutil**: Process information gathering when canary file access is detected\n\n## Output Format\n\n```\nRANSOMWARE CANARY ALERT\n========================\nTimestamp: 2026-03-11T14:23:07Z\nEvent: FILE_MODIFIED\nCanary File: \u002Fsrv\u002Fshares\u002Ffinance\u002FPasswords.xlsx\nDirectory: \u002Fsrv\u002Fshares\u002Ffinance\nSHA-256 Before: a3f2...8b4c\nSHA-256 After: 7e91...2d3f\nAlert Channels: [email, slack, syslog]\nAction: Investigate immediately - potential ransomware activity\n```\n",{"name":5,"tags":52,"author":53,"domain":38,"license":15,"version":54,"mitre_f3":55,"nist_csf":70,"subdomain":75,"description":7,"mitre_attack":76},[27,35,33,36,32,37,31],"mahipal","1.0.0",{"tactics":56,"version":58,"techniques":59},[57],"monetization","1.1",[60,64,67],{"id":61,"name":62,"source":63,"tactic":57},"F1018","Convert to Cryptocurrency","f3",{"id":65,"name":66,"source":63,"tactic":57},"F1017","Conversion to Physical Monetary Instruments",{"id":68,"name":69,"source":63,"tactic":57},"F1025.003","Electronic Funds Transfer: Wire Transfer",[71,72,73,74],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense",[77,78,79,80],"T1486","T1083","T1490","T1485","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdeploying-ransomware-canary-files",4423,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":92,"prompt":102,"zipAvailable":103},[93,96,99],{"tool":94,"command":95},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-ransomware-canary-files",{"tool":97,"command":98},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-ransomware-canary-files",{"tool":100,"command":101},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-ransomware-canary-files","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-ransomware-canary-files\u002FSKILL.md",true,[105,110,116],{"path":106,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-ransomware-canary-files\u002FLICENSE",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fapi-reference.md","REFERENCE","参考文档",2992,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-ransomware-canary-files\u002Freferences\u002Fapi-reference.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",21337,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-ransomware-canary-files\u002Fscripts\u002Fagent.py",[123,149,173,198,224,251],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":130,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[129],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[131,132,133,134,135,38,136,137,46,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,135,160,38,46,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,38,188,189,161,190,191,192,27,29,36,193,194,195,196,197],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[204],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[206,207,208,38,209,210,211,212,213,214,215,216,217,218,219,220,164,221,222,223],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[230],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[232,233,234,38,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[135,259,38,260,42,261,262,263,264,265,34,193,266,194,267,268,269,270,271,272],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]