[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEAXTZVTVJNWERRMJ9B8YD":3,"skill-same:01M6AEAXTZVTVJNWERRMJ9B8YD":139},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":98,"commitSha":99,"skillDirectory":100,"forksCount":101,"repositoryHtmlUrl":102,"repositoryHomepageUrl":103,"ownerHtmlUrl":104,"ownerBlogUrl":105,"ownerDescription":106,"updatedAt":107,"install":108,"resources":121},"01M6AEAXTZVTVJNWERRMJ9B8YD","detecting-compromised-cloud-credentials",null,"Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection. Use when investigating alerts about cloud API activity from unfamiliar locations, responding to an exposed-credential notification, or scoping a credential compromise.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-compromised-cloud-credentials\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"detecting compromised cloud credentials","cloud","analyzing","guardduty","credential-stuffing","impossible-travel","anomaly-detection","defense","detection","credential-compromise","gcp","google","threat-detection","cloud-security","development","pr","azure","defender","microsoft","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-compromised-cloud-credentials\ndescription: 'Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing\n  anomalous API activity, impossible-travel patterns, and credential-stuffing indicators\n  using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection.\n  Use when investigating alerts about cloud API activity from unfamiliar locations,\n  responding to an exposed-credential notification, or scoping a credential compromise.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- credential-compromise\n- threat-detection\n- guardduty\n- incident-response\n- anomaly-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - defense-impairment\n  techniques:\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n  - id: F1006.001\n    name: 'Account Takeover: Exposed API Key'\n    tactic: initial-access\n    source: f3\n  - id: T1110.004\n    name: 'Brute Force:  Credential Stuffing'\n    tactic: initial-access\n    source: attack\n  - id: T1586.003\n    name: 'Compromise Accounts: Cloud Accounts'\n    tactic: resource-development\n    source: attack\n  - id: F1005\n    name: Account Manipulation\n    tactic: defense-impairment\n    source: f3\n---\n\n# Detecting Compromised Cloud Credentials\n\n## When to Use\n\n- When investigating alerts about unusual cloud API activity from unfamiliar locations\n- When building detection rules for credential theft and abuse across cloud environments\n- When responding to notifications from cloud providers about exposed credentials\n- When monitoring for credential stuffing or brute force attacks against cloud identities\n- When assessing the scope of a credential compromise after initial detection\n\n**Do not use** for preventing credential compromise (use MFA, credential rotation, and secrets management), for detecting application-level credential theft (use application security monitoring), or for endpoint credential harvesting detection (use EDR tools).\n\n## Prerequisites\n\n- AWS GuardDuty enabled across all accounts and regions\n- Azure Defender for Identity and Entra ID Protection configured\n- GCP Security Command Center with Event Threat Detection enabled\n- CloudTrail, Azure Activity Log, and GCP Audit Log centralized for analysis\n- SIEM integration for cross-cloud correlation of credential abuse indicators\n- Threat intelligence feeds for known malicious IP ranges\n\n## Workflow\n\n### Step 1: Detect Credential Compromise Indicators in AWS\n\nMonitor GuardDuty findings and CloudTrail anomalies that indicate credential abuse.\n\n```bash\n# List GuardDuty credential-related findings\naws guardduty list-findings \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --finding-criteria '{\n    \"Criterion\": {\n      \"type\": {\n        \"Eq\": [\n          \"UnauthorizedAccess:IAMUser\u002FInstanceCredentialExfiltration.OutsideAWS\",\n          \"UnauthorizedAccess:IAMUser\u002FMaliciousIPCaller\",\n          \"UnauthorizedAccess:IAMUser\u002FMaliciousIPCaller.Custom\",\n          \"UnauthorizedAccess:IAMUser\u002FTorIPCaller\",\n          \"UnauthorizedAccess:IAMUser\u002FConsoleLoginSuccess.B\",\n          \"Recon:IAMUser\u002FMaliciousIPCaller\",\n          \"Recon:IAMUser\u002FMaliciousIPCaller.Custom\",\n          \"InitialAccess:IAMUser\u002FAnomalousBehavior\",\n          \"CredentialAccess:IAMUser\u002FAnomalousBehavior\",\n          \"Persistence:IAMUser\u002FAnomalousBehavior\"\n        ]\n      },\n      \"service.archived\": {\"Eq\": [\"false\"]}\n    }\n  }' --output json\n\n# Check for console logins from new locations\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"7 days ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.userName, sourceIPAddress, responseElements.ConsoleLogin\n    | filter eventName = \"ConsoleLogin\"\n    | filter responseElements.ConsoleLogin = \"Success\"\n    | stats count() by userIdentity.userName, sourceIPAddress\n    | sort count desc\n  '\n\n# Detect impossible travel (same user from geographically distant IPs within short time)\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"24 hours ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.arn, sourceIPAddress, eventName\n    | filter userIdentity.type = \"IAMUser\"\n    | stats earliest(@timestamp) as first_seen, latest(@timestamp) as last_seen,\n            count_distinct(sourceIPAddress) as unique_ips by userIdentity.arn\n    | filter unique_ips > 3\n  '\n```\n\n### Step 2: Detect Credential Abuse in Azure\n\nMonitor Entra ID sign-in logs and Defender for Identity alerts for compromised credentials.\n\n```bash\n# Check for risky sign-ins\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FsignIns?\\$filter=riskLevelDuringSignIn ne 'none' and createdDateTime ge 2026-02-16T00:00:00Z&\\$top=50\" \\\n  --query \"value[*].{User:userPrincipalName,Risk:riskLevelDuringSignIn,IP:ipAddress,Location:location.city,App:appDisplayName,Status:status.errorCode}\" \\\n  -o table\n\n# Check for sign-ins from anonymous or Tor IPs\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FsignIns?\\$filter=riskEventTypes_v2\u002Fany(r:r eq 'anonymizedIPAddress') and createdDateTime ge 2026-02-22T00:00:00Z\" \\\n  --query \"value[*].{User:userPrincipalName,IP:ipAddress,Location:location.city}\" \\\n  -o table\n\n# List users flagged as compromised by Identity Protection\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FidentityProtection\u002FriskyUsers?\\$filter=riskLevel eq 'high'\" \\\n  --query \"value[*].{User:userPrincipalName,RiskLevel:riskLevel,RiskState:riskState,LastDetected:riskLastUpdatedDateTime}\" \\\n  -o table\n\n# Check for suspicious application consent grants\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FdirectoryAudits?\\$filter=activityDisplayName eq 'Consent to application' and activityDateTime ge 2026-02-16T00:00:00Z\" \\\n  --query \"value[*].{Activity:activityDisplayName,User:initiatedBy.user.userPrincipalName,App:targetResources[0].displayName}\" \\\n  -o table\n```\n\n### Step 3: Detect Credential Abuse in GCP\n\nQuery GCP audit logs and SCC findings for credential compromise indicators.\n\n```bash\n# Check SCC Event Threat Detection findings\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND (category=\\\"ANOMALOUS_CALLER_LOCATION\\\" OR category=\\\"SUSPICIOUS_LOGIN\\\" OR category=\\\"CREDENTIAL_ACCESS\\\")\" \\\n  --format=\"table(finding.category, finding.severity, finding.resourceName, finding.eventTime)\"\n\n# Query audit logs for service account key usage from unusual IPs\ngcloud logging read '\n  protoPayload.authenticationInfo.principalEmail:*@*.iam.gserviceaccount.com\n  AND protoPayload.requestMetadata.callerIp!=(\"10.\" OR \"172.\" OR \"192.168.\")\n  AND timestamp>=\"2026-02-22T00:00:00Z\"\n' --limit=100 --format=\"table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.requestMetadata.callerIp, protoPayload.methodName)\"\n\n# Detect API calls from Tor exit nodes\ngcloud logging read '\n  protoPayload.requestMetadata.callerIp:(\"185.\" OR \"198.\" OR \"45.\")\n  AND protoPayload.authenticationInfo.principalEmail:*@company.com\n  AND timestamp>=\"2026-02-22T00:00:00Z\"\n' --limit=50 --format=json\n\n# Check for new service account keys created (persistence indicator)\ngcloud logging read '\n  protoPayload.methodName=\"google.iam.admin.v1.CreateServiceAccountKey\"\n  AND timestamp>=\"2026-02-16T00:00:00Z\"\n' --format=\"table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.request.name)\"\n```\n\n### Step 4: Build Cross-Cloud Correlation Rules\n\nCreate SIEM rules that correlate credential abuse indicators across cloud providers.\n\n```python\n# siem_correlation.py - Cross-cloud credential abuse detection\nimport json\nfrom datetime import datetime, timedelta\n\ndef detect_impossible_travel(events):\n    \"\"\"Detect same identity used from distant locations in short timeframe.\"\"\"\n    user_events = {}\n    for event in events:\n        user = event.get('principal', '')\n        ip = event.get('source_ip', '')\n        ts = event.get('timestamp', '')\n        cloud = event.get('cloud_provider', '')\n\n        key = f\"{user}_{cloud}\"\n        if key not in user_events:\n            user_events[key] = []\n        user_events[key].append({'ip': ip, 'timestamp': ts, 'cloud': cloud})\n\n    alerts = []\n    for user_key, accesses in user_events.items():\n        accesses.sort(key=lambda x: x['timestamp'])\n        for i in range(1, len(accesses)):\n            time_diff = (datetime.fromisoformat(accesses[i]['timestamp']) -\n                        datetime.fromisoformat(accesses[i-1]['timestamp']))\n            if time_diff \u003C timedelta(hours=1) and accesses[i]['ip'] != accesses[i-1]['ip']:\n                alerts.append({\n                    'type': 'IMPOSSIBLE_TRAVEL',\n                    'user': user_key,\n                    'ip_1': accesses[i-1]['ip'],\n                    'ip_2': accesses[i]['ip'],\n                    'time_gap_minutes': time_diff.total_seconds() \u002F 60,\n                    'severity': 'HIGH'\n                })\n    return alerts\n\ndef detect_credential_stuffing(events, threshold=10):\n    \"\"\"Detect multiple failed logins followed by success.\"\"\"\n    user_attempts = {}\n    for event in events:\n        user = event.get('principal', '')\n        success = event.get('success', False)\n        key = user\n        if key not in user_attempts:\n            user_attempts[key] = {'failures': 0, 'success_after_failures': False}\n        if not success:\n            user_attempts[key]['failures'] += 1\n        elif user_attempts[key]['failures'] >= threshold:\n            user_attempts[key]['success_after_failures'] = True\n\n    return [{'user': u, 'failures': d['failures'], 'severity': 'CRITICAL'}\n            for u, d in user_attempts.items() if d['success_after_failures']]\n```\n\n### Step 5: Respond to Confirmed Credential Compromise\n\nExecute containment actions when credential compromise is confirmed.\n\n```bash\n# AWS: Deactivate access key immediately\naws iam update-access-key --user-name COMPROMISED_USER \\\n  --access-key-id AKIA_COMPROMISED --status Inactive\n\n# AWS: Invalidate temporary role credentials by updating role trust policy\naws iam update-assume-role-policy --role-name COMPROMISED_ROLE \\\n  --policy-document '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"sts:AssumeRole\"}]}'\n\n# AWS: Revoke all sessions for an IAM user\naws iam put-user-policy --user-name COMPROMISED_USER \\\n  --policy-name RevokeOldSessions \\\n  --policy-document '{\n    \"Version\":\"2012-10-17\",\n    \"Statement\":[{\n      \"Effect\":\"Deny\",\n      \"Action\":\"*\",\n      \"Resource\":\"*\",\n      \"Condition\":{\"DateLessThan\":{\"aws:TokenIssueTime\":\"2026-02-23T10:00:00Z\"}}\n    }]\n  }'\n\n# Azure: Revoke all sign-in sessions\naz rest --method POST \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002FCOMPROMISED_USER_ID\u002FrevokeSignInSessions\"\n\n# Azure: Force password reset\naz ad user update --id COMPROMISED_USER_ID --force-change-password-next-sign-in true\n\n# GCP: Disable service account\ngcloud iam service-accounts disable COMPROMISED_SA_EMAIL\n\n# GCP: Delete service account keys\ngcloud iam service-accounts keys delete KEY_ID --iam-account=COMPROMISED_SA_EMAIL\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Impossible Travel | Detection of the same credential being used from geographically distant locations within a time period that makes physical travel impossible |\n| Credential Stuffing | Attack using stolen username\u002Fpassword combinations from data breaches to attempt login across multiple cloud services |\n| Instance Credential Exfiltration | GuardDuty finding indicating EC2 instance role credentials are being used from outside the expected AWS network |\n| Anomalous Behavior | Machine learning-based detection of API call patterns that deviate significantly from the established baseline for a principal |\n| Session Revocation | Invalidating all active authentication sessions for a compromised principal to force re-authentication with new credentials |\n| Persistence Indicator | Attacker actions designed to maintain access after initial compromise, such as creating new access keys or service account keys |\n\n## Tools & Systems\n\n- **AWS GuardDuty**: ML-based threat detection with specific finding types for credential compromise and unauthorized access\n- **Microsoft Entra ID Protection**: Identity risk detection for sign-in anomalies, compromised credentials, and risky user behavior\n- **GCP Event Threat Detection**: SCC component detecting anomalous API usage and credential abuse in GCP environments\n- **CloudTrail \u002F Activity Log \u002F Audit Log**: API audit logs providing the raw data for credential compromise investigation\n- **SIEM (Splunk, Elastic, Sentinel)**: Centralized platform for cross-cloud correlation of credential abuse indicators\n\n## Common Scenarios\n\n### Scenario: Detecting an Access Key Compromised via Phishing\n\n**Context**: A developer receives a phishing email that harvests their AWS console credentials. The attacker logs in from a foreign IP, creates a new access key, and begins enumerating the account.\n\n**Approach**:\n1. GuardDuty triggers `UnauthorizedAccess:IAMUser\u002FConsoleLoginSuccess.B` for login from unusual country\n2. SOC reviews the finding and correlates with phishing reports from the email security team\n3. Query CloudTrail for all actions by the compromised user from the attacker's IP\n4. Discover the attacker created new access keys and ran IAM enumeration commands\n5. Immediately deactivate all access keys for the user and revoke active sessions\n6. Force password reset and re-enroll MFA\n7. Check for persistence: new IAM users, roles, Lambda functions, or EC2 instances created\n8. Remove any persistence artifacts and document the incident timeline\n\n**Pitfalls**: Simply changing the password does not invalidate existing access keys or active sessions. All access keys must be rotated and temporary credentials revoked by adding a deny-all policy for tokens issued before the compromise was detected. Attackers may create new IAM users or roles for persistence before the initial credential is revoked.\n\n## Output Format\n\n```\nCloud Credential Compromise Detection Report\n===============================================\nDetection Date: 2026-02-23\nScope: Multi-cloud (AWS, Azure, GCP)\nPeriod: 2026-02-16 to 2026-02-23\n\nACTIVE COMPROMISE INDICATORS:\n[CRED-001] AWS Console Login from Unusual Location\n  User: developer@company.com\n  Source IP: 185.x.x.x (Russia)\n  Normal Location: US-East\n  GuardDuty Finding: UnauthorizedAccess:IAMUser\u002FConsoleLoginSuccess.B\n  Severity: HIGH\n  Status: Credential deactivated\n\n[CRED-002] Azure Impossible Travel Detection\n  User: admin@company.onmicrosoft.com\n  Location 1: New York, US (09:00 UTC)\n  Location 2: Beijing, CN (09:15 UTC)\n  Risk Level: HIGH\n  Status: Sessions revoked, under investigation\n\nDETECTION METRICS (Last 7 Days):\n  Impossible travel detections:        5\n  Anomalous API activity alerts:      12\n  Failed login attempts > threshold:   3\n  New credentials from unusual IPs:    2\n  Total compromises confirmed:         2\n\nCONTAINMENT ACTIONS TAKEN:\n  AWS access keys deactivated:    3\n  Azure sessions revoked:         2\n  GCP service accounts disabled:  1\n  Passwords force-reset:          4\n  MFA re-enrolled:                4\n```\n","# Detecting Compromised Cloud Credentials\n\n## When to Use\n\n- When investigating alerts about unusual cloud API activity from unfamiliar locations\n- When building detection rules for credential theft and abuse across cloud environments\n- When responding to notifications from cloud providers about exposed credentials\n- When monitoring for credential stuffing or brute force attacks against cloud identities\n- When assessing the scope of a credential compromise after initial detection\n\n**Do not use** for preventing credential compromise (use MFA, credential rotation, and secrets management), for detecting application-level credential theft (use application security monitoring), or for endpoint credential harvesting detection (use EDR tools).\n\n## Prerequisites\n\n- AWS GuardDuty enabled across all accounts and regions\n- Azure Defender for Identity and Entra ID Protection configured\n- GCP Security Command Center with Event Threat Detection enabled\n- CloudTrail, Azure Activity Log, and GCP Audit Log centralized for analysis\n- SIEM integration for cross-cloud correlation of credential abuse indicators\n- Threat intelligence feeds for known malicious IP ranges\n\n## Workflow\n\n### Step 1: Detect Credential Compromise Indicators in AWS\n\nMonitor GuardDuty findings and CloudTrail anomalies that indicate credential abuse.\n\n```bash\n# List GuardDuty credential-related findings\naws guardduty list-findings \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --finding-criteria '{\n    \"Criterion\": {\n      \"type\": {\n        \"Eq\": [\n          \"UnauthorizedAccess:IAMUser\u002FInstanceCredentialExfiltration.OutsideAWS\",\n          \"UnauthorizedAccess:IAMUser\u002FMaliciousIPCaller\",\n          \"UnauthorizedAccess:IAMUser\u002FMaliciousIPCaller.Custom\",\n          \"UnauthorizedAccess:IAMUser\u002FTorIPCaller\",\n          \"UnauthorizedAccess:IAMUser\u002FConsoleLoginSuccess.B\",\n          \"Recon:IAMUser\u002FMaliciousIPCaller\",\n          \"Recon:IAMUser\u002FMaliciousIPCaller.Custom\",\n          \"InitialAccess:IAMUser\u002FAnomalousBehavior\",\n          \"CredentialAccess:IAMUser\u002FAnomalousBehavior\",\n          \"Persistence:IAMUser\u002FAnomalousBehavior\"\n        ]\n      },\n      \"service.archived\": {\"Eq\": [\"false\"]}\n    }\n  }' --output json\n\n# Check for console logins from new locations\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"7 days ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.userName, sourceIPAddress, responseElements.ConsoleLogin\n    | filter eventName = \"ConsoleLogin\"\n    | filter responseElements.ConsoleLogin = \"Success\"\n    | stats count() by userIdentity.userName, sourceIPAddress\n    | sort count desc\n  '\n\n# Detect impossible travel (same user from geographically distant IPs within short time)\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"24 hours ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.arn, sourceIPAddress, eventName\n    | filter userIdentity.type = \"IAMUser\"\n    | stats earliest(@timestamp) as first_seen, latest(@timestamp) as last_seen,\n            count_distinct(sourceIPAddress) as unique_ips by userIdentity.arn\n    | filter unique_ips > 3\n  '\n```\n\n### Step 2: Detect Credential Abuse in Azure\n\nMonitor Entra ID sign-in logs and Defender for Identity alerts for compromised credentials.\n\n```bash\n# Check for risky sign-ins\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FsignIns?\\$filter=riskLevelDuringSignIn ne 'none' and createdDateTime ge 2026-02-16T00:00:00Z&\\$top=50\" \\\n  --query \"value[*].{User:userPrincipalName,Risk:riskLevelDuringSignIn,IP:ipAddress,Location:location.city,App:appDisplayName,Status:status.errorCode}\" \\\n  -o table\n\n# Check for sign-ins from anonymous or Tor IPs\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FsignIns?\\$filter=riskEventTypes_v2\u002Fany(r:r eq 'anonymizedIPAddress') and createdDateTime ge 2026-02-22T00:00:00Z\" \\\n  --query \"value[*].{User:userPrincipalName,IP:ipAddress,Location:location.city}\" \\\n  -o table\n\n# List users flagged as compromised by Identity Protection\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FidentityProtection\u002FriskyUsers?\\$filter=riskLevel eq 'high'\" \\\n  --query \"value[*].{User:userPrincipalName,RiskLevel:riskLevel,RiskState:riskState,LastDetected:riskLastUpdatedDateTime}\" \\\n  -o table\n\n# Check for suspicious application consent grants\naz rest --method GET \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FauditLogs\u002FdirectoryAudits?\\$filter=activityDisplayName eq 'Consent to application' and activityDateTime ge 2026-02-16T00:00:00Z\" \\\n  --query \"value[*].{Activity:activityDisplayName,User:initiatedBy.user.userPrincipalName,App:targetResources[0].displayName}\" \\\n  -o table\n```\n\n### Step 3: Detect Credential Abuse in GCP\n\nQuery GCP audit logs and SCC findings for credential compromise indicators.\n\n```bash\n# Check SCC Event Threat Detection findings\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND (category=\\\"ANOMALOUS_CALLER_LOCATION\\\" OR category=\\\"SUSPICIOUS_LOGIN\\\" OR category=\\\"CREDENTIAL_ACCESS\\\")\" \\\n  --format=\"table(finding.category, finding.severity, finding.resourceName, finding.eventTime)\"\n\n# Query audit logs for service account key usage from unusual IPs\ngcloud logging read '\n  protoPayload.authenticationInfo.principalEmail:*@*.iam.gserviceaccount.com\n  AND protoPayload.requestMetadata.callerIp!=(\"10.\" OR \"172.\" OR \"192.168.\")\n  AND timestamp>=\"2026-02-22T00:00:00Z\"\n' --limit=100 --format=\"table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.requestMetadata.callerIp, protoPayload.methodName)\"\n\n# Detect API calls from Tor exit nodes\ngcloud logging read '\n  protoPayload.requestMetadata.callerIp:(\"185.\" OR \"198.\" OR \"45.\")\n  AND protoPayload.authenticationInfo.principalEmail:*@company.com\n  AND timestamp>=\"2026-02-22T00:00:00Z\"\n' --limit=50 --format=json\n\n# Check for new service account keys created (persistence indicator)\ngcloud logging read '\n  protoPayload.methodName=\"google.iam.admin.v1.CreateServiceAccountKey\"\n  AND timestamp>=\"2026-02-16T00:00:00Z\"\n' --format=\"table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.request.name)\"\n```\n\n### Step 4: Build Cross-Cloud Correlation Rules\n\nCreate SIEM rules that correlate credential abuse indicators across cloud providers.\n\n```python\n# siem_correlation.py - Cross-cloud credential abuse detection\nimport json\nfrom datetime import datetime, timedelta\n\ndef detect_impossible_travel(events):\n    \"\"\"Detect same identity used from distant locations in short timeframe.\"\"\"\n    user_events = {}\n    for event in events:\n        user = event.get('principal', '')\n        ip = event.get('source_ip', '')\n        ts = event.get('timestamp', '')\n        cloud = event.get('cloud_provider', '')\n\n        key = f\"{user}_{cloud}\"\n        if key not in user_events:\n            user_events[key] = []\n        user_events[key].append({'ip': ip, 'timestamp': ts, 'cloud': cloud})\n\n    alerts = []\n    for user_key, accesses in user_events.items():\n        accesses.sort(key=lambda x: x['timestamp'])\n        for i in range(1, len(accesses)):\n            time_diff = (datetime.fromisoformat(accesses[i]['timestamp']) -\n                        datetime.fromisoformat(accesses[i-1]['timestamp']))\n            if time_diff \u003C timedelta(hours=1) and accesses[i]['ip'] != accesses[i-1]['ip']:\n                alerts.append({\n                    'type': 'IMPOSSIBLE_TRAVEL',\n                    'user': user_key,\n                    'ip_1': accesses[i-1]['ip'],\n                    'ip_2': accesses[i]['ip'],\n                    'time_gap_minutes': time_diff.total_seconds() \u002F 60,\n                    'severity': 'HIGH'\n                })\n    return alerts\n\ndef detect_credential_stuffing(events, threshold=10):\n    \"\"\"Detect multiple failed logins followed by success.\"\"\"\n    user_attempts = {}\n    for event in events:\n        user = event.get('principal', '')\n        success = event.get('success', False)\n        key = user\n        if key not in user_attempts:\n            user_attempts[key] = {'failures': 0, 'success_after_failures': False}\n        if not success:\n            user_attempts[key]['failures'] += 1\n        elif user_attempts[key]['failures'] >= threshold:\n            user_attempts[key]['success_after_failures'] = True\n\n    return [{'user': u, 'failures': d['failures'], 'severity': 'CRITICAL'}\n            for u, d in user_attempts.items() if d['success_after_failures']]\n```\n\n### Step 5: Respond to Confirmed Credential Compromise\n\nExecute containment actions when credential compromise is confirmed.\n\n```bash\n# AWS: Deactivate access key immediately\naws iam update-access-key --user-name COMPROMISED_USER \\\n  --access-key-id AKIA_COMPROMISED --status Inactive\n\n# AWS: Invalidate temporary role credentials by updating role trust policy\naws iam update-assume-role-policy --role-name COMPROMISED_ROLE \\\n  --policy-document '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"sts:AssumeRole\"}]}'\n\n# AWS: Revoke all sessions for an IAM user\naws iam put-user-policy --user-name COMPROMISED_USER \\\n  --policy-name RevokeOldSessions \\\n  --policy-document '{\n    \"Version\":\"2012-10-17\",\n    \"Statement\":[{\n      \"Effect\":\"Deny\",\n      \"Action\":\"*\",\n      \"Resource\":\"*\",\n      \"Condition\":{\"DateLessThan\":{\"aws:TokenIssueTime\":\"2026-02-23T10:00:00Z\"}}\n    }]\n  }'\n\n# Azure: Revoke all sign-in sessions\naz rest --method POST \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002FCOMPROMISED_USER_ID\u002FrevokeSignInSessions\"\n\n# Azure: Force password reset\naz ad user update --id COMPROMISED_USER_ID --force-change-password-next-sign-in true\n\n# GCP: Disable service account\ngcloud iam service-accounts disable COMPROMISED_SA_EMAIL\n\n# GCP: Delete service account keys\ngcloud iam service-accounts keys delete KEY_ID --iam-account=COMPROMISED_SA_EMAIL\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Impossible Travel | Detection of the same credential being used from geographically distant locations within a time period that makes physical travel impossible |\n| Credential Stuffing | Attack using stolen username\u002Fpassword combinations from data breaches to attempt login across multiple cloud services |\n| Instance Credential Exfiltration | GuardDuty finding indicating EC2 instance role credentials are being used from outside the expected AWS network |\n| Anomalous Behavior | Machine learning-based detection of API call patterns that deviate significantly from the established baseline for a principal |\n| Session Revocation | Invalidating all active authentication sessions for a compromised principal to force re-authentication with new credentials |\n| Persistence Indicator | Attacker actions designed to maintain access after initial compromise, such as creating new access keys or service account keys |\n\n## Tools & Systems\n\n- **AWS GuardDuty**: ML-based threat detection with specific finding types for credential compromise and unauthorized access\n- **Microsoft Entra ID Protection**: Identity risk detection for sign-in anomalies, compromised credentials, and risky user behavior\n- **GCP Event Threat Detection**: SCC component detecting anomalous API usage and credential abuse in GCP environments\n- **CloudTrail \u002F Activity Log \u002F Audit Log**: API audit logs providing the raw data for credential compromise investigation\n- **SIEM (Splunk, Elastic, Sentinel)**: Centralized platform for cross-cloud correlation of credential abuse indicators\n\n## Common Scenarios\n\n### Scenario: Detecting an Access Key Compromised via Phishing\n\n**Context**: A developer receives a phishing email that harvests their AWS console credentials. The attacker logs in from a foreign IP, creates a new access key, and begins enumerating the account.\n\n**Approach**:\n1. GuardDuty triggers `UnauthorizedAccess:IAMUser\u002FConsoleLoginSuccess.B` for login from unusual country\n2. SOC reviews the finding and correlates with phishing reports from the email security team\n3. Query CloudTrail for all actions by the compromised user from the attacker's IP\n4. Discover the attacker created new access keys and ran IAM enumeration commands\n5. Immediately deactivate all access keys for the user and revoke active sessions\n6. Force password reset and re-enroll MFA\n7. Check for persistence: new IAM users, roles, Lambda functions, or EC2 instances created\n8. Remove any persistence artifacts and document the incident timeline\n\n**Pitfalls**: Simply changing the password does not invalidate existing access keys or active sessions. All access keys must be rotated and temporary credentials revoked by adding a deny-all policy for tokens issued before the compromise was detected. Attackers may create new IAM users or roles for persistence before the initial credential is revoked.\n\n## Output Format\n\n```\nCloud Credential Compromise Detection Report\n===============================================\nDetection Date: 2026-02-23\nScope: Multi-cloud (AWS, Azure, GCP)\nPeriod: 2026-02-16 to 2026-02-23\n\nACTIVE COMPROMISE INDICATORS:\n[CRED-001] AWS Console Login from Unusual Location\n  User: developer@company.com\n  Source IP: 185.x.x.x (Russia)\n  Normal Location: US-East\n  GuardDuty Finding: UnauthorizedAccess:IAMUser\u002FConsoleLoginSuccess.B\n  Severity: HIGH\n  Status: Credential deactivated\n\n[CRED-002] Azure Impossible Travel Detection\n  User: admin@company.onmicrosoft.com\n  Location 1: New York, US (09:00 UTC)\n  Location 2: Beijing, CN (09:15 UTC)\n  Risk Level: HIGH\n  Status: Sessions revoked, under investigation\n\nDETECTION METRICS (Last 7 Days):\n  Impossible travel detections:        5\n  Anomalous API activity alerts:      12\n  Failed login attempts > threshold:   3\n  New credentials from unusual IPs:    2\n  Total compromises confirmed:         2\n\nCONTAINMENT ACTIONS TAKEN:\n  AWS access keys deactivated:    3\n  Azure sessions revoked:         2\n  GCP service accounts disabled:  1\n  Passwords force-reset:          4\n  MFA re-enrolled:                4\n```\n",{"name":5,"tags":57,"author":59,"domain":51,"license":15,"version":60,"mitre_f3":61,"nist_csf":86,"subdomain":45,"description":91,"mitre_attack":92},[45,41,44,35,58,38],"incident-response","mahipal","1.0",{"tactics":62,"version":66,"techniques":67},[63,64,65],"initial-access","positioning","defense-impairment","1.1",[68,72,75,79,83],{"id":69,"name":70,"source":71,"tactic":63},"F1006.002","Account Takeover: Exposed Login Credential","f3",{"id":73,"name":74,"source":71,"tactic":63},"F1006.001","Account Takeover: Exposed API Key",{"id":76,"name":77,"source":78,"tactic":63},"T1110.004","Brute Force:  Credential Stuffing","attack",{"id":80,"name":81,"source":78,"tactic":82},"T1586.003","Compromise Accounts: Cloud Accounts","resource-development",{"id":84,"name":85,"source":71,"tactic":65},"F1005","Account Manipulation",[87,88,89,90],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft Defender for Identity, and Google SCC Event Threat Detection. Use when investigating alerts about cloud API activity from unfamiliar locations, responding to an exposed-credential notification, or scoping a credential compromise.\n",[93,94,95,96,97],"T1078.004","T1530","T1537","T1580","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-compromised-cloud-credentials",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":109,"prompt":119,"zipAvailable":120},[110,113,116],{"tool":111,"command":112},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-compromised-cloud-credentials",{"tool":114,"command":115},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-compromised-cloud-credentials",{"tool":117,"command":118},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-compromised-cloud-credentials","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-compromised-cloud-credentials\u002FSKILL.md",true,[122,127,133],{"path":123,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-compromised-cloud-credentials\u002FLICENSE",{"path":128,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fapi-reference.md","REFERENCE","参考文档",2521,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-compromised-cloud-credentials\u002Freferences\u002Fapi-reference.md",{"path":134,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fagent.py","SCRIPT","脚本",7443,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-compromised-cloud-credentials\u002Fscripts\u002Fagent.py",[140,166,190,216,242,269],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[146],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[148,149,150,151,152,51,153,154,47,155,156,157,158,159,160,161,162,163,164,165],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":173,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[172],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[174,162,175,176,152,177,51,47,178,179,180,181,182,183,184,185,186,187,188,189],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":200,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[196,199],{"categoryNo":197,"categoryName":198,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[184,201,202,203,204,51,205,206,178,207,208,58,209,210,40,211,212,213,214,215],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[222],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,51,227,228,229,230,231,232,233,234,235,236,237,238,181,239,240,241],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[248],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[250,251,252,51,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":270,"name":271,"nameZh":6,"description":272,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":273,"categories":274,"keywords":276,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[275],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[152,277,51,278,279,280,281,282,283,284,285,211,286,212,287,288,289,290,291,292],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]