[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEBTVXABS0AVT66MDY52E2":3,"skill-same:01M6AEBTVXABS0AVT66MDY52E2":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AEBTVXABS0AVT66MDY52E2","detecting-dcsync-attack-in-active-directory",null,"Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"detecting dcsync attack in active directory","dcsync","directory","mimikatz","mitre-t1003-006","credential-theft","kerberos","Impacket","controller","network","threat-hunting","active-directory","server","monitoring","admin","rpc","protocol","permissions","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-dcsync-attack-in-active-directory\ndescription: Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- active-directory\n- dcsync\n- credential-theft\n- mitre-t1003-006\n- mimikatz\n- kerberos\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Platform Monitoring\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1003\n---\n\n# Detecting DCSync Attack in Active Directory\n\n## When to Use\n\n- When hunting for credential theft in Active Directory environments\n- After compromise of accounts with Replicating Directory Changes permissions\n- When investigating suspected use of Mimikatz or Impacket secretsdump\n- During incident response involving lateral movement with domain admin credentials\n- When auditing AD replication permissions as part of security hardening\n\n## Prerequisites\n\n- Windows Security Event Logs with Event ID 4662 (Object Access) enabled\n- Advanced Audit Policy: Audit Directory Service Access enabled\n- Domain Controller event forwarding to SIEM\n- Knowledge of legitimate domain controller hostnames and IPs\n- Directory Service Access auditing with SACL on domain object\n\n## Workflow\n\n1. **Identify Legitimate Replication Sources**: Document all domain controllers in the environment by hostname, IP, and computer account. Only these should perform directory replication.\n2. **Enable Required Auditing**: Configure Advanced Audit Policy to capture Event ID 4662 on domain controllers with specific GUID monitoring for replication rights.\n3. **Monitor Replication Rights Access**: Track access to three critical GUIDs -- DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2), DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), and DS-Replication-Get-Changes-In-Filtered-Set (89e95b76-444d-4c62-991a-0facbeda640c).\n4. **Detect Non-DC Replication Requests**: Alert when any account NOT associated with a domain controller requests replication rights.\n5. **Correlate with Network Traffic**: DCSync generates replication traffic (MS-DRSR\u002FRPC) from the attacker's machine to the DC. Monitor for DrsGetNCChanges RPC calls from non-DC IP addresses.\n6. **Investigate Source Context**: Examine the process, user account, and machine originating the replication request.\n7. **Check for Credential Abuse**: After DCSync detection, audit for subsequent use of extracted hashes (pass-the-hash, golden ticket creation).\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1003.006 | OS Credential Dumping: DCSync |\n| DCSync | Mimicking domain controller replication to extract credentials |\n| DsGetNCChanges | RPC function used to request AD replication data |\n| DS-Replication-Get-Changes | AD permission required (GUID: 1131f6aa-...) |\n| DS-Replication-Get-Changes-All | Permission including confidential attributes (GUID: 1131f6ad-...) |\n| MS-DRSR | Microsoft Directory Replication Service Remote Protocol |\n| KRBTGT Hash | Key target of DCSync enabling Golden Ticket attacks |\n| Event ID 4662 | Directory service object access audit event |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Mimikatz (lsadump::dcsync) | Primary DCSync attack tool |\n| Impacket secretsdump.py | Python-based DCSync implementation |\n| DSInternals | PowerShell module for AD replication |\n| BloodHound | Map accounts with replication rights |\n| Splunk \u002F Elastic | SIEM correlation of 4662 events |\n| Microsoft Defender for Identity | Native DCSync detection |\n| CrowdStrike Falcon | EDR-based DCSync detection |\n\n## Detection Queries\n\n### Splunk -- DCSync Detection via Event 4662\n```spl\nindex=wineventlog EventCode=4662\n| where Properties IN (\"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*\",\n    \"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*\",\n    \"*89e95b76-444d-4c62-991a-0facbeda640c*\")\n| where NOT match(SubjectUserName, \".*\\\\$$\")\n| where NOT SubjectUserName IN (\"known_svc_account1\", \"known_svc_account2\")\n| stats count values(Properties) as ReplicationRights by SubjectUserName SubjectDomainName Computer\n| where count > 0\n| table SubjectUserName SubjectDomainName Computer count ReplicationRights\n```\n\n### KQL -- Microsoft Sentinel DCSync Detection\n```kql\nSecurityEvent\n| where EventID == 4662\n| where Properties has \"1131f6ad-9c07-11d1-f79f-00c04fc2dcd2\"\n    or Properties has \"1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\"\n| where SubjectUserName !endswith \"$\"\n| where SubjectUserName !in (\"AzureADConnect\", \"MSOL_*\")\n| project TimeGenerated, SubjectUserName, SubjectDomainName, Computer, Properties\n| sort by TimeGenerated desc\n```\n\n### Sigma Rule -- DCSync Activity\n```yaml\ntitle: DCSync Activity Detected - Non-DC Replication Request\nstatus: stable\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4662\n        Properties|contains:\n            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'\n            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'\n    filter_dc:\n        SubjectUserName|endswith: '$'\n    condition: selection and not filter_dc\nlevel: critical\ntags:\n    - attack.credential_access\n    - attack.t1003.006\n```\n\n## Common Scenarios\n\n1. **Mimikatz DCSync**: Attacker with Domain Admin privileges runs `lsadump::dcsync \u002Fuser:krbtgt` to extract KRBTGT hash for Golden Ticket creation.\n2. **Impacket secretsdump**: Remote DCSync via `secretsdump.py domain\u002Fuser:password@dc-ip` extracting all domain hashes.\n3. **Delegated Replication Rights**: Attacker grants themselves Replicating Directory Changes rights via ACL modification before performing DCSync.\n4. **Azure AD Connect Abuse**: Compromising the Azure AD Connect service account which has legitimate replication rights.\n5. **DSInternals PowerShell**: Using `Get-ADReplAccount` cmdlet to replicate specific account credentials.\n\n## Output Format\n\n```\nHunt ID: TH-DCSYNC-[DATE]-[SEQ]\nAlert Severity: Critical\nSource Account: [Account requesting replication]\nSource Machine: [Hostname\u002FIP of requestor]\nTarget DC: [Domain controller receiving request]\nReplication Rights: [GUIDs accessed]\nTimestamp: [Event time]\nLegitimate DC: [Yes\u002FNo]\nKnown Service Account: [Yes\u002FNo]\nRisk Assessment: [Critical - non-DC replication detected]\n```\n","# Detecting DCSync Attack in Active Directory\n\n## When to Use\n\n- When hunting for credential theft in Active Directory environments\n- After compromise of accounts with Replicating Directory Changes permissions\n- When investigating suspected use of Mimikatz or Impacket secretsdump\n- During incident response involving lateral movement with domain admin credentials\n- When auditing AD replication permissions as part of security hardening\n\n## Prerequisites\n\n- Windows Security Event Logs with Event ID 4662 (Object Access) enabled\n- Advanced Audit Policy: Audit Directory Service Access enabled\n- Domain Controller event forwarding to SIEM\n- Knowledge of legitimate domain controller hostnames and IPs\n- Directory Service Access auditing with SACL on domain object\n\n## Workflow\n\n1. **Identify Legitimate Replication Sources**: Document all domain controllers in the environment by hostname, IP, and computer account. Only these should perform directory replication.\n2. **Enable Required Auditing**: Configure Advanced Audit Policy to capture Event ID 4662 on domain controllers with specific GUID monitoring for replication rights.\n3. **Monitor Replication Rights Access**: Track access to three critical GUIDs -- DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2), DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2), and DS-Replication-Get-Changes-In-Filtered-Set (89e95b76-444d-4c62-991a-0facbeda640c).\n4. **Detect Non-DC Replication Requests**: Alert when any account NOT associated with a domain controller requests replication rights.\n5. **Correlate with Network Traffic**: DCSync generates replication traffic (MS-DRSR\u002FRPC) from the attacker's machine to the DC. Monitor for DrsGetNCChanges RPC calls from non-DC IP addresses.\n6. **Investigate Source Context**: Examine the process, user account, and machine originating the replication request.\n7. **Check for Credential Abuse**: After DCSync detection, audit for subsequent use of extracted hashes (pass-the-hash, golden ticket creation).\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1003.006 | OS Credential Dumping: DCSync |\n| DCSync | Mimicking domain controller replication to extract credentials |\n| DsGetNCChanges | RPC function used to request AD replication data |\n| DS-Replication-Get-Changes | AD permission required (GUID: 1131f6aa-...) |\n| DS-Replication-Get-Changes-All | Permission including confidential attributes (GUID: 1131f6ad-...) |\n| MS-DRSR | Microsoft Directory Replication Service Remote Protocol |\n| KRBTGT Hash | Key target of DCSync enabling Golden Ticket attacks |\n| Event ID 4662 | Directory service object access audit event |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Mimikatz (lsadump::dcsync) | Primary DCSync attack tool |\n| Impacket secretsdump.py | Python-based DCSync implementation |\n| DSInternals | PowerShell module for AD replication |\n| BloodHound | Map accounts with replication rights |\n| Splunk \u002F Elastic | SIEM correlation of 4662 events |\n| Microsoft Defender for Identity | Native DCSync detection |\n| CrowdStrike Falcon | EDR-based DCSync detection |\n\n## Detection Queries\n\n### Splunk -- DCSync Detection via Event 4662\n```spl\nindex=wineventlog EventCode=4662\n| where Properties IN (\"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*\",\n    \"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*\",\n    \"*89e95b76-444d-4c62-991a-0facbeda640c*\")\n| where NOT match(SubjectUserName, \".*\\\\$$\")\n| where NOT SubjectUserName IN (\"known_svc_account1\", \"known_svc_account2\")\n| stats count values(Properties) as ReplicationRights by SubjectUserName SubjectDomainName Computer\n| where count > 0\n| table SubjectUserName SubjectDomainName Computer count ReplicationRights\n```\n\n### KQL -- Microsoft Sentinel DCSync Detection\n```kql\nSecurityEvent\n| where EventID == 4662\n| where Properties has \"1131f6ad-9c07-11d1-f79f-00c04fc2dcd2\"\n    or Properties has \"1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\"\n| where SubjectUserName !endswith \"$\"\n| where SubjectUserName !in (\"AzureADConnect\", \"MSOL_*\")\n| project TimeGenerated, SubjectUserName, SubjectDomainName, Computer, Properties\n| sort by TimeGenerated desc\n```\n\n### Sigma Rule -- DCSync Activity\n```yaml\ntitle: DCSync Activity Detected - Non-DC Replication Request\nstatus: stable\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4662\n        Properties|contains:\n            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'\n            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'\n    filter_dc:\n        SubjectUserName|endswith: '$'\n    condition: selection and not filter_dc\nlevel: critical\ntags:\n    - attack.credential_access\n    - attack.t1003.006\n```\n\n## Common Scenarios\n\n1. **Mimikatz DCSync**: Attacker with Domain Admin privileges runs `lsadump::dcsync \u002Fuser:krbtgt` to extract KRBTGT hash for Golden Ticket creation.\n2. **Impacket secretsdump**: Remote DCSync via `secretsdump.py domain\u002Fuser:password@dc-ip` extracting all domain hashes.\n3. **Delegated Replication Rights**: Attacker grants themselves Replicating Directory Changes rights via ACL modification before performing DCSync.\n4. **Azure AD Connect Abuse**: Compromising the Azure AD Connect service account which has legitimate replication rights.\n5. **DSInternals PowerShell**: Using `Get-ADReplAccount` cmdlet to replicate specific account credentials.\n\n## Output Format\n\n```\nHunt ID: TH-DCSYNC-[DATE]-[SEQ]\nAlert Severity: Critical\nSource Account: [Account requesting replication]\nSource Machine: [Hostname\u002FIP of requestor]\nTarget DC: [Domain controller receiving request]\nReplication Rights: [GUIDs accessed]\nTimestamp: [Event time]\nLegitimate DC: [Yes\u002FNo]\nKnown Service Account: [Yes\u002FNo]\nRisk Assessment: [Critical - non-DC replication detected]\n```\n",{"name":5,"tags":48,"author":49,"domain":42,"license":15,"version":50,"nist_csf":51,"subdomain":34,"description":7,"mitre_attack":56,"d3fend_techniques":62},[34,35,25,29,28,27,30],"mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[57,58,59,60,61],"T1046","T1057","T1082","T1083","T1003",[63,64,65,66,67],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-dcsync-attack-in-active-directory",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-dcsync-attack-in-active-directory",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-dcsync-attack-in-active-directory",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-dcsync-attack-in-active-directory","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1674,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",2081,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",2372,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",3106,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",6252,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",5977,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002Fscripts\u002Fprocess.py",[128,155,179,207,233,260],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,140,42,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,151,164,165,140,166,42,143,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,42,194,195,167,196,197,198,199,200,201,202,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,42,218,219,220,221,222,223,224,225,226,227,228,229,170,230,231,232],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[239],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[241,242,243,42,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[266],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,268,42,269,270,271,272,273,274,275,276,202,277,203,278,279,280,281,282,283],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]