[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE970GESQ1A5R3H1TEHSTT":3,"skill-same:01M6AE970GESQ1A5R3H1TEHSTT":115},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AE970GESQ1A5R3H1TEHSTT","detecting-attacks-on-historian-servers",null,"Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement indicators as historians pivot between IT and OT networks. Use when monitoring historians bridging IT\u002FOT zones for compromise, investigating historian-specific CVE exploitation, or validating historian data integrity after a suspected OT incident.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"detecting attacks on historian servers","exploitation","data-integrity","pivot-point","ignition","osisoft-pi","historian","ics","ot-security","python","lateral-movement","data","monitoring","cve","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: detecting-attacks-on-historian-servers\ndescription: 'Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE\n  Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries,\n  data manipulation, and lateral-movement indicators as historians pivot between IT\n  and OT networks. Use when monitoring historians bridging IT\u002FOT zones for compromise,\n  investigating historian-specific CVE exploitation, or validating historian data integrity\n  after a suspected OT incident.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- historian\n- osisoft-pi\n- ignition\n- pivot-point\n- data-integrity\n- lateral-movement\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T0811\n- T0882\n- T0888\n- T0846\n- T0859\n---\n\n# Detecting Attacks on Historian Servers\n\n## When to Use\n\n- When monitoring historian servers that bridge IT and OT networks for compromise indicators\n- When detecting unauthorized queries or data manipulation in process historian databases\n- When investigating lateral movement through historian servers between IT and OT zones\n- When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)\n- When validating historian data integrity after a suspected OT security incident\n\n**Do not use** for general database security monitoring (see database security skills), for historian deployment and configuration, or for IT-only data warehouse security.\n\n## Prerequisites\n\n- Historian server inventory (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL)\n- Network monitoring on historian network segments (both IT-facing and OT-facing interfaces)\n- Historian API access for data integrity validation\n- Baseline of normal historian query patterns (which applications query which tags)\n- Understanding of historian architecture (data sources, interfaces, client connections)\n\n## Workflow\n\n### Step 1: Monitor Historian for Attack Indicators\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Historian Attack Detector.\n\nMonitors historian servers for unauthorized access, data manipulation,\nlateral movement indicators, and exploitation of historian-specific\nvulnerabilities. Supports OSIsoft PI and Ignition platforms.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HistorianAttackDetector:\n    \"\"\"Detects attacks targeting OT historian servers.\"\"\"\n\n    def __init__(self, historian_type: str, historian_url: str,\n                 api_credentials: dict, verify_ssl: bool = False):\n        self.historian_type = historian_type\n        self.historian_url = historian_url.rstrip(\"\u002F\")\n        self.credentials = api_credentials\n        self.verify_ssl = verify_ssl\n        self.alerts = []\n        self.authorized_clients = set()\n        self.authorized_queries = {}\n\n    def set_baseline(self, authorized_clients: List[str],\n                     authorized_query_patterns: Dict[str, List[str]]):\n        \"\"\"Set baseline of authorized historian clients and query patterns.\"\"\"\n        self.authorized_clients = set(authorized_clients)\n        self.authorized_queries = authorized_query_patterns\n\n    def check_active_connections(self) -> List[dict]:\n        \"\"\"Check for unauthorized connections to historian.\"\"\"\n        connections = []\n\n        if self.historian_type == \"osisoft_pi\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fpiwebapi\u002Fsystem\u002Fstatus\",\n                    auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    data = resp.json()\n                    connections = data.get(\"ConnectedClients\", [])\n            except requests.RequestException as e:\n                print(f\"[!] PI Web API error: {e}\")\n\n        elif self.historian_type == \"ignition\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fdata\u002Fstatus\u002Fconnections\",\n                    headers={\"Authorization\": f\"Bearer {self.credentials.get('token')}\"},\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    connections = resp.json().get(\"connections\", [])\n            except requests.RequestException as e:\n                print(f\"[!] Ignition API error: {e}\")\n\n        # Check for unauthorized clients\n        for conn in connections:\n            client_ip = conn.get(\"client_ip\", conn.get(\"address\", \"\"))\n            if self.authorized_clients and client_ip not in self.authorized_clients:\n                self.alerts.append({\n                    \"severity\": \"HIGH\",\n                    \"type\": \"UNAUTHORIZED_HISTORIAN_CLIENT\",\n                    \"timestamp\": datetime.now().isoformat(),\n                    \"source_ip\": client_ip,\n                    \"details\": f\"Unauthorized client {client_ip} connected to {self.historian_type} historian\",\n                    \"mitre\": \"T0802 - Automated Collection\",\n                })\n\n        return connections\n\n    def check_data_integrity(self, tags: List[str], hours_back: int = 24):\n        \"\"\"Check historian data for manipulation indicators.\"\"\"\n        print(f\"[*] Checking data integrity for {len(tags)} tags over last {hours_back}h\")\n\n        integrity_issues = []\n        for tag in tags:\n            try:\n                if self.historian_type == \"osisoft_pi\":\n                    resp = requests.get(\n                        f\"{self.historian_url}\u002Fpiwebapi\u002Fstreams\u002F{tag}\u002Frecorded\",\n                        params={\"startTime\": f\"*-{hours_back}h\", \"endTime\": \"*\"},\n                        auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                        verify=self.verify_ssl,\n                        timeout=15,\n                    )\n                    if resp.status_code == 200:\n                        items = resp.json().get(\"Items\", [])\n                        # Check for suspicious patterns\n                        if len(items) == 0:\n                            integrity_issues.append({\n                                \"tag\": tag, \"issue\": \"NO_DATA\",\n                                \"detail\": \"No data points in expected timeframe - possible deletion\",\n                            })\n                        else:\n                            values = [i.get(\"Value\", 0) for i in items if isinstance(i.get(\"Value\"), (int, float))]\n                            if values and len(set(values)) == 1 and len(values) > 100:\n                                integrity_issues.append({\n                                    \"tag\": tag, \"issue\": \"FLATLINE\",\n                                    \"detail\": f\"Constant value {values[0]} for {len(values)} points - possible replay\u002Fspoofing\",\n                                })\n            except requests.RequestException:\n                pass\n\n        for issue in integrity_issues:\n            self.alerts.append({\n                \"severity\": \"HIGH\",\n                \"type\": f\"DATA_INTEGRITY_{issue['issue']}\",\n                \"timestamp\": datetime.now().isoformat(),\n                \"tag\": issue[\"tag\"],\n                \"details\": issue[\"detail\"],\n                \"mitre\": \"T0809 - Data Destruction\" if issue[\"issue\"] == \"NO_DATA\" else \"T0832 - Manipulation of View\",\n            })\n\n        return integrity_issues\n\n    def check_lateral_movement_indicators(self):\n        \"\"\"Check for indicators of historian being used as pivot point.\"\"\"\n        indicators = []\n\n        # Check 1: Historian making outbound connections to Level 1 devices\n        # (Historian should receive data, not initiate connections to PLCs)\n        indicators.append({\n            \"check\": \"Outbound connections to PLC subnets\",\n            \"description\": \"Historian initiating connections to Level 1 devices may indicate compromise\",\n            \"detection\": \"Monitor firewall logs for historian IP connecting to PLC ports (502, 102, 44818)\",\n        })\n\n        # Check 2: New processes or services on historian\n        indicators.append({\n            \"check\": \"Unauthorized processes on historian server\",\n            \"description\": \"Attackers may install tools on historian for lateral movement\",\n            \"detection\": \"Monitor process creation events (Sysmon EventID 1) on historian\",\n        })\n\n        # Check 3: Unusual authentication to historian\n        indicators.append({\n            \"check\": \"Authentication from unexpected sources\",\n            \"description\": \"Compromised IT systems authenticating to historian for pivoting\",\n            \"detection\": \"Monitor Windows Security Event 4624 for logons from non-baseline sources\",\n        })\n\n        return indicators\n\n    def generate_report(self):\n        \"\"\"Generate historian attack detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"HISTORIAN ATTACK DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Historian Type: {self.historian_type}\")\n        print(f\"Historian URL: {self.historian_url}\")\n        print(f\"Report Time: {datetime.now().isoformat()}\")\n        print(f\"Total Alerts: {len(self.alerts)}\")\n\n        if self.alerts:\n            print(f\"\\n--- ALERTS ---\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert['severity']}] {alert['type']}\")\n                print(f\"    Time: {alert['timestamp']}\")\n                print(f\"    Detail: {alert['details']}\")\n                print(f\"    MITRE ICS: {alert.get('mitre', 'N\u002FA')}\")\n\n        print(f\"\\n--- LATERAL MOVEMENT CHECKS ---\")\n        for indicator in self.check_lateral_movement_indicators():\n            print(f\"\\n  Check: {indicator['check']}\")\n            print(f\"    Risk: {indicator['description']}\")\n            print(f\"    Detection: {indicator['detection']}\")\n\n\nif __name__ == \"__main__\":\n    detector = HistorianAttackDetector(\n        historian_type=\"osisoft_pi\",\n        historian_url=\"https:\u002F\u002Fpi-server.plant.local\",\n        api_credentials={\"username\": \"pi_reader\", \"password\": \"api_key_here\"},\n    )\n\n    detector.set_baseline(\n        authorized_clients=[\"10.10.2.10\", \"10.10.2.20\", \"10.10.3.50\", \"10.10.150.10\"],\n        authorized_query_patterns={},\n    )\n\n    detector.check_active_connections()\n    detector.check_data_integrity(tags=[\"REACTOR_01.TEMP\", \"PUMP_03.FLOW\"], hours_back=24)\n    detector.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OT Historian | Database server (OSIsoft PI, Ignition, Wonderware) storing time-series process data from SCADA\u002FDCS systems |\n| Pivot Point | Historian's position between IT and OT networks makes it a prime target for attackers to move between zones |\n| Data Replay Attack | Feeding historical data to an HMI to mask real-time process manipulation (Stuxnet technique) |\n| OSIsoft PI | Most widely deployed OT historian, used by 65% of Global 500 process companies |\n| Ignition | Inductive Automation SCADA platform with historian module, increasingly targeted due to Python scripting capabilities |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability allowing escalation through malicious project files |\n\n## Output Format\n\n```\nHISTORIAN ATTACK DETECTION REPORT\n====================================\nHistorian: [type and hostname]\nDate: YYYY-MM-DD\n\nCONNECTION ANALYSIS:\n  Authorized Clients: [count]\n  Unauthorized Clients Detected: [count with IPs]\n\nDATA INTEGRITY:\n  Tags Checked: [count]\n  Integrity Issues: [count]\n  Flatline Detections: [count]\n  Data Gaps: [count]\n\nLATERAL MOVEMENT INDICATORS:\n  Outbound PLC Connections: [found\u002Fnot found]\n  Unauthorized Processes: [found\u002Fnot found]\n  Anomalous Authentication: [found\u002Fnot found]\n```\n","# Detecting Attacks on Historian Servers\n\n## When to Use\n\n- When monitoring historian servers that bridge IT and OT networks for compromise indicators\n- When detecting unauthorized queries or data manipulation in process historian databases\n- When investigating lateral movement through historian servers between IT and OT zones\n- When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)\n- When validating historian data integrity after a suspected OT security incident\n\n**Do not use** for general database security monitoring (see database security skills), for historian deployment and configuration, or for IT-only data warehouse security.\n\n## Prerequisites\n\n- Historian server inventory (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL)\n- Network monitoring on historian network segments (both IT-facing and OT-facing interfaces)\n- Historian API access for data integrity validation\n- Baseline of normal historian query patterns (which applications query which tags)\n- Understanding of historian architecture (data sources, interfaces, client connections)\n\n## Workflow\n\n### Step 1: Monitor Historian for Attack Indicators\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Historian Attack Detector.\n\nMonitors historian servers for unauthorized access, data manipulation,\nlateral movement indicators, and exploitation of historian-specific\nvulnerabilities. Supports OSIsoft PI and Ignition platforms.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HistorianAttackDetector:\n    \"\"\"Detects attacks targeting OT historian servers.\"\"\"\n\n    def __init__(self, historian_type: str, historian_url: str,\n                 api_credentials: dict, verify_ssl: bool = False):\n        self.historian_type = historian_type\n        self.historian_url = historian_url.rstrip(\"\u002F\")\n        self.credentials = api_credentials\n        self.verify_ssl = verify_ssl\n        self.alerts = []\n        self.authorized_clients = set()\n        self.authorized_queries = {}\n\n    def set_baseline(self, authorized_clients: List[str],\n                     authorized_query_patterns: Dict[str, List[str]]):\n        \"\"\"Set baseline of authorized historian clients and query patterns.\"\"\"\n        self.authorized_clients = set(authorized_clients)\n        self.authorized_queries = authorized_query_patterns\n\n    def check_active_connections(self) -> List[dict]:\n        \"\"\"Check for unauthorized connections to historian.\"\"\"\n        connections = []\n\n        if self.historian_type == \"osisoft_pi\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fpiwebapi\u002Fsystem\u002Fstatus\",\n                    auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    data = resp.json()\n                    connections = data.get(\"ConnectedClients\", [])\n            except requests.RequestException as e:\n                print(f\"[!] PI Web API error: {e}\")\n\n        elif self.historian_type == \"ignition\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fdata\u002Fstatus\u002Fconnections\",\n                    headers={\"Authorization\": f\"Bearer {self.credentials.get('token')}\"},\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    connections = resp.json().get(\"connections\", [])\n            except requests.RequestException as e:\n                print(f\"[!] Ignition API error: {e}\")\n\n        # Check for unauthorized clients\n        for conn in connections:\n            client_ip = conn.get(\"client_ip\", conn.get(\"address\", \"\"))\n            if self.authorized_clients and client_ip not in self.authorized_clients:\n                self.alerts.append({\n                    \"severity\": \"HIGH\",\n                    \"type\": \"UNAUTHORIZED_HISTORIAN_CLIENT\",\n                    \"timestamp\": datetime.now().isoformat(),\n                    \"source_ip\": client_ip,\n                    \"details\": f\"Unauthorized client {client_ip} connected to {self.historian_type} historian\",\n                    \"mitre\": \"T0802 - Automated Collection\",\n                })\n\n        return connections\n\n    def check_data_integrity(self, tags: List[str], hours_back: int = 24):\n        \"\"\"Check historian data for manipulation indicators.\"\"\"\n        print(f\"[*] Checking data integrity for {len(tags)} tags over last {hours_back}h\")\n\n        integrity_issues = []\n        for tag in tags:\n            try:\n                if self.historian_type == \"osisoft_pi\":\n                    resp = requests.get(\n                        f\"{self.historian_url}\u002Fpiwebapi\u002Fstreams\u002F{tag}\u002Frecorded\",\n                        params={\"startTime\": f\"*-{hours_back}h\", \"endTime\": \"*\"},\n                        auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                        verify=self.verify_ssl,\n                        timeout=15,\n                    )\n                    if resp.status_code == 200:\n                        items = resp.json().get(\"Items\", [])\n                        # Check for suspicious patterns\n                        if len(items) == 0:\n                            integrity_issues.append({\n                                \"tag\": tag, \"issue\": \"NO_DATA\",\n                                \"detail\": \"No data points in expected timeframe - possible deletion\",\n                            })\n                        else:\n                            values = [i.get(\"Value\", 0) for i in items if isinstance(i.get(\"Value\"), (int, float))]\n                            if values and len(set(values)) == 1 and len(values) > 100:\n                                integrity_issues.append({\n                                    \"tag\": tag, \"issue\": \"FLATLINE\",\n                                    \"detail\": f\"Constant value {values[0]} for {len(values)} points - possible replay\u002Fspoofing\",\n                                })\n            except requests.RequestException:\n                pass\n\n        for issue in integrity_issues:\n            self.alerts.append({\n                \"severity\": \"HIGH\",\n                \"type\": f\"DATA_INTEGRITY_{issue['issue']}\",\n                \"timestamp\": datetime.now().isoformat(),\n                \"tag\": issue[\"tag\"],\n                \"details\": issue[\"detail\"],\n                \"mitre\": \"T0809 - Data Destruction\" if issue[\"issue\"] == \"NO_DATA\" else \"T0832 - Manipulation of View\",\n            })\n\n        return integrity_issues\n\n    def check_lateral_movement_indicators(self):\n        \"\"\"Check for indicators of historian being used as pivot point.\"\"\"\n        indicators = []\n\n        # Check 1: Historian making outbound connections to Level 1 devices\n        # (Historian should receive data, not initiate connections to PLCs)\n        indicators.append({\n            \"check\": \"Outbound connections to PLC subnets\",\n            \"description\": \"Historian initiating connections to Level 1 devices may indicate compromise\",\n            \"detection\": \"Monitor firewall logs for historian IP connecting to PLC ports (502, 102, 44818)\",\n        })\n\n        # Check 2: New processes or services on historian\n        indicators.append({\n            \"check\": \"Unauthorized processes on historian server\",\n            \"description\": \"Attackers may install tools on historian for lateral movement\",\n            \"detection\": \"Monitor process creation events (Sysmon EventID 1) on historian\",\n        })\n\n        # Check 3: Unusual authentication to historian\n        indicators.append({\n            \"check\": \"Authentication from unexpected sources\",\n            \"description\": \"Compromised IT systems authenticating to historian for pivoting\",\n            \"detection\": \"Monitor Windows Security Event 4624 for logons from non-baseline sources\",\n        })\n\n        return indicators\n\n    def generate_report(self):\n        \"\"\"Generate historian attack detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"HISTORIAN ATTACK DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Historian Type: {self.historian_type}\")\n        print(f\"Historian URL: {self.historian_url}\")\n        print(f\"Report Time: {datetime.now().isoformat()}\")\n        print(f\"Total Alerts: {len(self.alerts)}\")\n\n        if self.alerts:\n            print(f\"\\n--- ALERTS ---\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert['severity']}] {alert['type']}\")\n                print(f\"    Time: {alert['timestamp']}\")\n                print(f\"    Detail: {alert['details']}\")\n                print(f\"    MITRE ICS: {alert.get('mitre', 'N\u002FA')}\")\n\n        print(f\"\\n--- LATERAL MOVEMENT CHECKS ---\")\n        for indicator in self.check_lateral_movement_indicators():\n            print(f\"\\n  Check: {indicator['check']}\")\n            print(f\"    Risk: {indicator['description']}\")\n            print(f\"    Detection: {indicator['detection']}\")\n\n\nif __name__ == \"__main__\":\n    detector = HistorianAttackDetector(\n        historian_type=\"osisoft_pi\",\n        historian_url=\"https:\u002F\u002Fpi-server.plant.local\",\n        api_credentials={\"username\": \"pi_reader\", \"password\": \"api_key_here\"},\n    )\n\n    detector.set_baseline(\n        authorized_clients=[\"10.10.2.10\", \"10.10.2.20\", \"10.10.3.50\", \"10.10.150.10\"],\n        authorized_query_patterns={},\n    )\n\n    detector.check_active_connections()\n    detector.check_data_integrity(tags=[\"REACTOR_01.TEMP\", \"PUMP_03.FLOW\"], hours_back=24)\n    detector.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OT Historian | Database server (OSIsoft PI, Ignition, Wonderware) storing time-series process data from SCADA\u002FDCS systems |\n| Pivot Point | Historian's position between IT and OT networks makes it a prime target for attackers to move between zones |\n| Data Replay Attack | Feeding historical data to an HMI to mask real-time process manipulation (Stuxnet technique) |\n| OSIsoft PI | Most widely deployed OT historian, used by 65% of Global 500 process companies |\n| Ignition | Inductive Automation SCADA platform with historian module, increasingly targeted due to Python scripting capabilities |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability allowing escalation through malicious project files |\n\n## Output Format\n\n```\nHISTORIAN ATTACK DETECTION REPORT\n====================================\nHistorian: [type and hostname]\nDate: YYYY-MM-DD\n\nCONNECTION ANALYSIS:\n  Authorized Clients: [count]\n  Unauthorized Clients Detected: [count with IPs]\n\nDATA INTEGRITY:\n  Tags Checked: [count]\n  Integrity Issues: [count]\n  Flatline Detections: [count]\n  Data Gaps: [count]\n\nLATERAL MOVEMENT INDICATORS:\n  Outbound PLC Connections: [found\u002Fnot found]\n  Unauthorized Processes: [found\u002Fnot found]\n  Anomalous Authentication: [found\u002Fnot found]\n```\n",{"name":5,"tags":46,"author":47,"domain":39,"license":15,"version":48,"nist_csf":49,"subdomain":54,"description":55,"mitre_attack":56},[32,31,30,29,28,27,26,34],"mahipal","1.0",[50,51,52,53],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement indicators as historians pivot between IT and OT networks. Use when monitoring historians bridging IT\u002FOT zones for compromise, investigating historian-specific CVE exploitation, or validating historian data integrity after a suspected OT incident.\n",[57,58,59,60,61],"T0811","T0882","T0888","T0846","T0859","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-attacks-on-historian-servers",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-attacks-on-historian-servers",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-attacks-on-historian-servers",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-attacks-on-historian-servers","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002FSKILL.md",true,[86,92,97,101,105,111],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"agents\u002Fopenai.yaml","REFERENCE","参考文档",87,"https:\u002F\u002Fgithub.com\u002Fhareki\u002Fdotfiles\u002Fblob\u002Fmain\u002Fagents\u002F.agents\u002Fskills\u002Ftdd\u002Fagents\u002Fopenai.yaml",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002FLICENSE",{"path":98,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":99,"sourceHtmlUrl":100},"mocking.md",1481,"https:\u002F\u002Fgithub.com\u002Fhareki\u002Fdotfiles\u002Fblob\u002Fmain\u002Fagents\u002F.agents\u002Fskills\u002Ftdd\u002Fmocking.md",{"path":102,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md",1954,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",7180,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002Fscripts\u002Fagent.py",{"path":112,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":113,"sourceHtmlUrl":114},"tests.md",2214,"https:\u002F\u002Fgithub.com\u002Fhareki\u002Fdotfiles\u002Fblob\u002Fmain\u002Fagents\u002F.agents\u002Fskills\u002Ftdd\u002Ftests.md",[116,141,165,193,218,245],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,40,39,128,129,38,130,131,132,133,134,135,136,137,138,139,140],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,137,150,151,40,152,39,38,153,154,155,156,157,158,159,160,161,162,163,164],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,176,177,178,179,39,180,181,153,182,183,184,185,186,187,188,189,190,191,192],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[199],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,202,203,39,204,205,206,207,208,209,210,35,211,212,213,214,156,215,216,217],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":222,"categories":223,"keywords":225,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[224],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[226,227,228,39,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":252,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[251],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,253,39,254,255,256,257,258,259,260,261,188,262,189,263,264,265,266,267,268],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]