[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEB0XZK975F5JVHWS86PK4":3,"skill-same:01M6AEB0XZK975F5JVHWS86PK4":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AEB0XZK975F5JVHWS86PK4","detecting-container-drift-at-runtime",null,"Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do not use for detecting breakout from the container to the host - use detecting-container-escape-attempts.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting container drift at runtime","monitoring","drift-detection","falco","immutable-containers","runtime-security","container-drift","detection","Microsoft-Defender","container-security","image","package","infrastructure","pr","defender","microsoft","cybersecurity","security","kubernetes","containers","2026-11-10 10:12:30",false,"---\nname: detecting-container-drift-at-runtime\ndescription: >-\n  Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem\n  changes, and configuration deviation from the original immutable image, using Falco and\n  Microsoft Defender for Containers. Use when validating immutable-infrastructure controls,\n  hunting for unexpected package installs or binaries written inside a running container, or\n  determining whether a container diverged from the image it was built from. Keywords: drift,\n  immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do\n  not use for detecting breakout from the container to the host - use\n  detecting-container-escape-attempts.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- container-drift\n- runtime-security\n- immutable-containers\n- falco\n- kubernetes\n- container-security\n- drift-detection\n- microsoft-defender\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n---\n\n# Detecting Container Drift at Runtime\n\n## Overview\n\nContainer drift occurs when running containers deviate from their original image state through unauthorized file modifications, unexpected binary execution, configuration changes, or package installations. Since containers should be treated as immutable infrastructure, any drift is a potential indicator of compromise. Detection techniques leverage the DIE (Detect, Isolate, Evict) model -- an immutable workload should not change during runtime, so any observed change is potentially evidence of malicious activity.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container drift at runtime\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+ with runtime security tooling\n- Falco or Sysdig for runtime drift detection\n- Container image registry with image manifests available\n- Familiarity with Linux filesystem layers and OverlayFS\n\n## Core Concepts\n\n### Types of Container Drift\n\n1. **Binary drift**: Execution of binaries not present in the original image (downloaded malware, compiled tools)\n2. **File drift**: Creation, modification, or deletion of files in the container filesystem\n3. **Configuration drift**: Changes to environment variables, mounted secrets, or runtime parameters\n4. **Package drift**: Installation of new packages via apt, yum, pip, or npm at runtime\n5. **Network drift**: New listening ports or outbound connections not expected for the workload\n\n### Detection Methods\n\n**Image-Based Comparison**: Compare the running container's filesystem against its source image to identify added, modified, or removed files.\n\n**Behavioral Monitoring**: Use eBPF or kernel-level monitoring to detect process execution, file access, and network activity that deviates from expected behavior.\n\n**Digest Verification**: Continuously verify that running container image digests match the approved deployment manifests.\n\n## Implementation with Falco\n\n### Detecting New Binary Execution\n\n```yaml\n- rule: Drift Detected (Container Image Modified Binary)\n  desc: Detect execution of a binary not present in the original container image\n  condition: >\n    spawned_process and\n    container and\n    not proc.pname in (container_entrypoint) and\n    proc.is_exe_upper_layer = true\n  output: >\n    Drift detected: new binary executed in container\n    (user=%user.name command=%proc.cmdline container=%container.name\n     image=%container.image.repository:%container.image.tag\n     exe_path=%proc.exepath)\n  priority: WARNING\n  tags: [container, drift]\n\n- rule: Container Shell Spawned\n  desc: Detect interactive shell in a container that should be immutable\n  condition: >\n    spawned_process and\n    container and\n    proc.name in (bash, sh, dash, zsh, csh, ksh) and\n    not proc.pname in (container_entrypoint)\n  output: >\n    Shell spawned in container (user=%user.name shell=%proc.name\n     container=%container.name image=%container.image.repository)\n  priority: WARNING\n  tags: [container, drift, shell]\n```\n\n### Detecting Package Manager Usage\n\n```yaml\n- rule: Package Manager Execution in Container\n  desc: Detect use of package managers indicating drift\n  condition: >\n    spawned_process and\n    container and\n    proc.name in (apt, apt-get, yum, dnf, apk, pip, pip3, npm, gem, cargo)\n  output: >\n    Package manager executed in container (user=%user.name\n     command=%proc.cmdline container=%container.name\n     image=%container.image.repository)\n  priority: ERROR\n  tags: [container, drift, package-manager]\n```\n\n### Detecting File System Modifications\n\n```yaml\n- rule: Container File System Write\n  desc: Detect writes to container upper layer filesystem\n  condition: >\n    open_write and\n    container and\n    fd.typechar = 'f' and\n    not fd.name startswith \u002Ftmp and\n    not fd.name startswith \u002Fvar\u002Flog and\n    not fd.name startswith \u002Fproc\n  output: >\n    File write in container (user=%user.name file=%fd.name\n     container=%container.name)\n  priority: NOTICE\n  tags: [container, drift, filesystem]\n```\n\n## Implementation with Kubernetes Enforcement\n\n### Read-Only Root Filesystem\n\nPrevent drift by making container filesystems immutable:\n\n```yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: immutable-app\nspec:\n  template:\n    spec:\n      containers:\n        - name: app\n          image: app:v1.0@sha256:abc123...\n          securityContext:\n            readOnlyRootFilesystem: true\n            allowPrivilegeEscalation: false\n            runAsNonRoot: true\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n            - name: cache\n              mountPath: \u002Fvar\u002Fcache\n      volumes:\n        - name: tmp\n          emptyDir:\n            sizeLimit: 100Mi\n        - name: cache\n          emptyDir:\n            sizeLimit: 50Mi\n```\n\n### Pod Security Standards Enforcement\n\n```yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Fwarn: restricted\n```\n\n## Image Digest Verification\n\n### Continuous Digest Monitoring\n\n```bash\n#!\u002Fbin\u002Fbash\n# Compare running container digests against approved manifest\n\nNAMESPACE=\"production\"\n\nkubectl get pods -n \"$NAMESPACE\" -o json | jq -r '\n  .items[] |\n  .spec.containers[] |\n  \"\\(.image) \\(.imageID)\"\n' | while read IMAGE IMAGE_ID; do\n  APPROVED_DIGEST=$(kubectl get deploy -n \"$NAMESPACE\" -o json | \\\n    jq -r \".items[].spec.template.spec.containers[] | select(.image==\\\"$IMAGE\\\") | .image\")\n\n  if [[ \"$IMAGE\" != *\"@sha256:\"* ]]; then\n    echo \"[WARN] Container using mutable tag: $IMAGE\"\n  fi\ndone\n```\n\n## Microsoft Defender for Containers Integration\n\nFor Azure Kubernetes environments, Microsoft Defender provides built-in binary drift detection:\n\n```json\n{\n  \"alertType\": \"K8S.NODE_ImageBinaryDrift\",\n  \"severity\": \"Medium\",\n  \"description\": \"Binary executed that was not part of the original container image\",\n  \"remediationSteps\": [\n    \"Investigate the binary origin and purpose\",\n    \"Check if the container was compromised\",\n    \"Rebuild the container from a clean image\",\n    \"Enable readOnlyRootFilesystem\"\n  ]\n}\n```\n\n## Drift Response Playbook\n\n1. **Detect**: Alert fires on drift event (Falco, Defender, Sysdig)\n2. **Validate**: Confirm the drift is not from an approved process (init containers, config reloads)\n3. **Isolate**: Apply a deny-all NetworkPolicy to the affected pod\n4. **Investigate**: Capture container filesystem diff and process list\n5. **Evict**: Delete the drifted pod (ReplicaSet will recreate from clean image)\n6. **Remediate**: Fix the root cause (patch vulnerability, update image, tighten RBAC)\n\n## References\n\n- [Container Drift Detection with Falco - Sysdig](https:\u002F\u002Fwww.sysdig.com\u002Fblog\u002Fcontainer-drift-detection-with-falco)\n- [Microsoft Defender for Containers Drift Detection](https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftdefendercloudblog\u002Fdetect-container-drift-with-microsoft-defender-for-containers\u002F4232044)\n- [Ensure Immutability of Containers at Runtime](https:\u002F\u002Fnotes.kodekloud.com\u002Fdocs\u002FCertified-Kubernetes-Security-Specialist-CKS\u002FMonitoring-Logging-and-Runtime-Security\u002FEnsure-Immutability-of-Containers-at-Runtime\u002F)\n- [Falco Runtime Security](https:\u002F\u002Ffalco.org\u002F)\n","# Detecting Container Drift at Runtime\n\n## Overview\n\nContainer drift occurs when running containers deviate from their original image state through unauthorized file modifications, unexpected binary execution, configuration changes, or package installations. Since containers should be treated as immutable infrastructure, any drift is a potential indicator of compromise. Detection techniques leverage the DIE (Detect, Isolate, Evict) model -- an immutable workload should not change during runtime, so any observed change is potentially evidence of malicious activity.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container drift at runtime\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Kubernetes cluster v1.24+ with runtime security tooling\n- Falco or Sysdig for runtime drift detection\n- Container image registry with image manifests available\n- Familiarity with Linux filesystem layers and OverlayFS\n\n## Core Concepts\n\n### Types of Container Drift\n\n1. **Binary drift**: Execution of binaries not present in the original image (downloaded malware, compiled tools)\n2. **File drift**: Creation, modification, or deletion of files in the container filesystem\n3. **Configuration drift**: Changes to environment variables, mounted secrets, or runtime parameters\n4. **Package drift**: Installation of new packages via apt, yum, pip, or npm at runtime\n5. **Network drift**: New listening ports or outbound connections not expected for the workload\n\n### Detection Methods\n\n**Image-Based Comparison**: Compare the running container's filesystem against its source image to identify added, modified, or removed files.\n\n**Behavioral Monitoring**: Use eBPF or kernel-level monitoring to detect process execution, file access, and network activity that deviates from expected behavior.\n\n**Digest Verification**: Continuously verify that running container image digests match the approved deployment manifests.\n\n## Implementation with Falco\n\n### Detecting New Binary Execution\n\n```yaml\n- rule: Drift Detected (Container Image Modified Binary)\n  desc: Detect execution of a binary not present in the original container image\n  condition: >\n    spawned_process and\n    container and\n    not proc.pname in (container_entrypoint) and\n    proc.is_exe_upper_layer = true\n  output: >\n    Drift detected: new binary executed in container\n    (user=%user.name command=%proc.cmdline container=%container.name\n     image=%container.image.repository:%container.image.tag\n     exe_path=%proc.exepath)\n  priority: WARNING\n  tags: [container, drift]\n\n- rule: Container Shell Spawned\n  desc: Detect interactive shell in a container that should be immutable\n  condition: >\n    spawned_process and\n    container and\n    proc.name in (bash, sh, dash, zsh, csh, ksh) and\n    not proc.pname in (container_entrypoint)\n  output: >\n    Shell spawned in container (user=%user.name shell=%proc.name\n     container=%container.name image=%container.image.repository)\n  priority: WARNING\n  tags: [container, drift, shell]\n```\n\n### Detecting Package Manager Usage\n\n```yaml\n- rule: Package Manager Execution in Container\n  desc: Detect use of package managers indicating drift\n  condition: >\n    spawned_process and\n    container and\n    proc.name in (apt, apt-get, yum, dnf, apk, pip, pip3, npm, gem, cargo)\n  output: >\n    Package manager executed in container (user=%user.name\n     command=%proc.cmdline container=%container.name\n     image=%container.image.repository)\n  priority: ERROR\n  tags: [container, drift, package-manager]\n```\n\n### Detecting File System Modifications\n\n```yaml\n- rule: Container File System Write\n  desc: Detect writes to container upper layer filesystem\n  condition: >\n    open_write and\n    container and\n    fd.typechar = 'f' and\n    not fd.name startswith \u002Ftmp and\n    not fd.name startswith \u002Fvar\u002Flog and\n    not fd.name startswith \u002Fproc\n  output: >\n    File write in container (user=%user.name file=%fd.name\n     container=%container.name)\n  priority: NOTICE\n  tags: [container, drift, filesystem]\n```\n\n## Implementation with Kubernetes Enforcement\n\n### Read-Only Root Filesystem\n\nPrevent drift by making container filesystems immutable:\n\n```yaml\napiVersion: apps\u002Fv1\nkind: Deployment\nmetadata:\n  name: immutable-app\nspec:\n  template:\n    spec:\n      containers:\n        - name: app\n          image: app:v1.0@sha256:abc123...\n          securityContext:\n            readOnlyRootFilesystem: true\n            allowPrivilegeEscalation: false\n            runAsNonRoot: true\n          volumeMounts:\n            - name: tmp\n              mountPath: \u002Ftmp\n            - name: cache\n              mountPath: \u002Fvar\u002Fcache\n      volumes:\n        - name: tmp\n          emptyDir:\n            sizeLimit: 100Mi\n        - name: cache\n          emptyDir:\n            sizeLimit: 50Mi\n```\n\n### Pod Security Standards Enforcement\n\n```yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: production\n  labels:\n    pod-security.kubernetes.io\u002Fenforce: restricted\n    pod-security.kubernetes.io\u002Faudit: restricted\n    pod-security.kubernetes.io\u002Fwarn: restricted\n```\n\n## Image Digest Verification\n\n### Continuous Digest Monitoring\n\n```bash\n#!\u002Fbin\u002Fbash\n# Compare running container digests against approved manifest\n\nNAMESPACE=\"production\"\n\nkubectl get pods -n \"$NAMESPACE\" -o json | jq -r '\n  .items[] |\n  .spec.containers[] |\n  \"\\(.image) \\(.imageID)\"\n' | while read IMAGE IMAGE_ID; do\n  APPROVED_DIGEST=$(kubectl get deploy -n \"$NAMESPACE\" -o json | \\\n    jq -r \".items[].spec.template.spec.containers[] | select(.image==\\\"$IMAGE\\\") | .image\")\n\n  if [[ \"$IMAGE\" != *\"@sha256:\"* ]]; then\n    echo \"[WARN] Container using mutable tag: $IMAGE\"\n  fi\ndone\n```\n\n## Microsoft Defender for Containers Integration\n\nFor Azure Kubernetes environments, Microsoft Defender provides built-in binary drift detection:\n\n```json\n{\n  \"alertType\": \"K8S.NODE_ImageBinaryDrift\",\n  \"severity\": \"Medium\",\n  \"description\": \"Binary executed that was not part of the original container image\",\n  \"remediationSteps\": [\n    \"Investigate the binary origin and purpose\",\n    \"Check if the container was compromised\",\n    \"Rebuild the container from a clean image\",\n    \"Enable readOnlyRootFilesystem\"\n  ]\n}\n```\n\n## Drift Response Playbook\n\n1. **Detect**: Alert fires on drift event (Falco, Defender, Sysdig)\n2. **Validate**: Confirm the drift is not from an approved process (init containers, config reloads)\n3. **Isolate**: Apply a deny-all NetworkPolicy to the affected pod\n4. **Investigate**: Capture container filesystem diff and process list\n5. **Evict**: Delete the drifted pod (ReplicaSet will recreate from clean image)\n6. **Remediate**: Fix the root cause (patch vulnerability, update image, tighten RBAC)\n\n## References\n\n- [Container Drift Detection with Falco - Sysdig](https:\u002F\u002Fwww.sysdig.com\u002Fblog\u002Fcontainer-drift-detection-with-falco)\n- [Microsoft Defender for Containers Drift Detection](https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftdefendercloudblog\u002Fdetect-container-drift-with-microsoft-defender-for-containers\u002F4232044)\n- [Ensure Immutability of Containers at Runtime](https:\u002F\u002Fnotes.kodekloud.com\u002Fdocs\u002FCertified-Kubernetes-Security-Specialist-CKS\u002FMonitoring-Logging-and-Runtime-Security\u002FEnsure-Immutability-of-Containers-at-Runtime\u002F)\n- [Falco Runtime Security](https:\u002F\u002Ffalco.org\u002F)\n",{"name":5,"tags":52,"author":54,"domain":43,"license":15,"version":55,"nist_csf":56,"subdomain":36,"description":7,"mitre_attack":61},[33,32,31,30,45,36,29,53],"microsoft-defender","mahipal","1.0",[57,58,59,60],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[62,63,64,65],"T1610","T1611","T1609","T1525","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-container-drift-at-runtime",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-drift-at-runtime",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-drift-at-runtime",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-drift-at-runtime","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",728,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",2043,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",1225,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",1785,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",5905,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",7819,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-drift-at-runtime\u002Fscripts\u002Fprocess.py",[126,153,177,203,229,256],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":135,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[136,137,138,139,44,43,140,141,40,142,143,144,145,146,147,148,149,150,151,152],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[159],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},[161,149,162,163,44,164,43,40,165,166,167,168,169,170,171,172,173,174,175,176],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},[171,188,189,190,191,43,39,192,165,193,194,195,196,197,34,198,199,200,201,202],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[209],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,43,214,215,216,217,218,219,220,221,222,223,224,225,168,226,227,228],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":236,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[235],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},[237,238,239,43,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":263,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[262],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},[44,264,43,265,266,267,268,269,270,271,272,198,273,199,274,275,276,277,278,279],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]