[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEE4WPR6FH7320442BQ380":3,"skill-same:01M6AEE4WPR6FH7320442BQ380":145},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AEE4WPR6FH7320442BQ380","detecting-lateral-movement-with-splunk",null,"Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI\u002FPsExec\u002FRDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"splunk","detecting lateral movement with splunk","network","siem","ta0008","detection","ATT&CK","lateral-movement","proactive-detection","pivoting","SPL","windows","cybersecurity","threat-hunting","mitre-attack","server","logs","protocol","authentication","2026-11-10 10:12:30",false,"---\nname: detecting-lateral-movement-with-splunk\ndescription: Detect adversary lateral movement across networks using Splunk SPL queries\n  against Windows authentication logs, SMB traffic, and remote service (WMI\u002FPsExec\u002FRDP)\n  abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating\n  suspected pivoting between hosts during an incident, with Splunk as the SIEM.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- lateral-movement\n- splunk\n- siem\n- proactive-detection\n- ta0008\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Network Traffic Community Deviation\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1021\n---\n\n# Detecting Lateral Movement with Splunk\n\n## When to Use\n\n- When hunting for adversary movement between compromised systems\n- After detecting credential theft to trace subsequent lateral activity\n- When investigating unusual authentication patterns across the network\n- During incident response to scope the breadth of compromise\n- When proactively hunting for TA0008 (Lateral Movement) techniques\n\n## Prerequisites\n\n- Splunk Enterprise or Splunk Cloud with Windows event data ingested\n- Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)\n- Sysmon deployed for process creation and network connection data\n- Network flow data or firewall logs for SMB\u002FRDP\u002FWinRM correlation\n- Active Directory user and group membership reference data\n\n## Workflow\n\n1. **Define Lateral Movement Scope**: Identify which lateral movement techniques to hunt (RDP, SMB\u002FAdmin Shares, WinRM, PsExec, WMI, DCOM, SSH).\n2. **Query Authentication Events**: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.\n3. **Build Authentication Graphs**: Map source-to-destination authentication relationships to identify unusual connection patterns.\n4. **Detect First-Time Relationships**: Identify new source-destination pairs that have not been seen in the historical baseline.\n5. **Correlate with Process Activity**: Link authentication events to subsequent process creation on destination hosts.\n6. **Identify Anomalous Patterns**: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.\n7. **Report and Contain**: Document lateral movement path, affected systems, and coordinate containment response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1021 | Remote Services (parent technique) |\n| T1021.001 | Remote Desktop Protocol (RDP) |\n| T1021.002 | SMB\u002FWindows Admin Shares |\n| T1021.003 | Distributed COM (DCOM) |\n| T1021.004 | SSH |\n| T1021.006 | Windows Remote Management (WinRM) |\n| T1570 | Lateral Tool Transfer |\n| T1047 | Windows Management Instrumentation |\n| T1569.002 | Service Execution (PsExec) |\n| Logon Type 3 | Network logon (SMB, WinRM, mapped drives) |\n| Logon Type 10 | Remote Interactive (RDP) |\n| Event ID 4624 | Successful logon |\n| Event ID 4648 | Explicit credential logon (runas, PsExec) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk Enterprise | SIEM for log aggregation and SPL queries |\n| Splunk Enterprise Security | Threat detection and notable events |\n| Windows Event Forwarding | Centralize Windows logs |\n| Sysmon | Detailed process and network telemetry |\n| BloodHound | AD attack path analysis |\n| PingCastle | AD security assessment |\n\n## Common Scenarios\n\n1. **PsExec Lateral Movement**: Adversary uses PsExec to execute commands on remote systems via SMB, generating Type 3 logon with ADMIN$ share access.\n2. **RDP Pivoting**: Attacker RDPs to internal systems using stolen credentials, creating Type 10 logon events.\n3. **WMI Remote Execution**: Adversary uses WMIC process call create to spawn processes on remote hosts.\n4. **WinRM PowerShell Remoting**: Attacker uses Enter-PSSession or Invoke-Command to execute code on remote systems.\n5. **Pass-the-Hash via SMB**: Compromised NTLM hashes used to authenticate to remote systems without knowing the plaintext password.\n\n## Output Format\n\n```\nHunt ID: TH-LATMOV-[DATE]-[SEQ]\nMovement Type: [RDP\u002FSMB\u002FWinRM\u002FWMI\u002FDCOM\u002FPsExec]\nSource Host: [Hostname\u002FIP]\nDestination Host: [Hostname\u002FIP]\nAccount Used: [Username]\nLogon Type: [3\u002F10\u002Fother]\nFirst Seen: [Timestamp]\nEvent Count: [Number of events]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nLateral Movement Path: [A -> B -> C -> D]\n```\n","# Detecting Lateral Movement with Splunk\n\n## When to Use\n\n- When hunting for adversary movement between compromised systems\n- After detecting credential theft to trace subsequent lateral activity\n- When investigating unusual authentication patterns across the network\n- During incident response to scope the breadth of compromise\n- When proactively hunting for TA0008 (Lateral Movement) techniques\n\n## Prerequisites\n\n- Splunk Enterprise or Splunk Cloud with Windows event data ingested\n- Windows Security Event Logs forwarded (4624, 4625, 4648, 4672, 4768, 4769)\n- Sysmon deployed for process creation and network connection data\n- Network flow data or firewall logs for SMB\u002FRDP\u002FWinRM correlation\n- Active Directory user and group membership reference data\n\n## Workflow\n\n1. **Define Lateral Movement Scope**: Identify which lateral movement techniques to hunt (RDP, SMB\u002FAdmin Shares, WinRM, PsExec, WMI, DCOM, SSH).\n2. **Query Authentication Events**: Use SPL to search for Type 3 (Network) and Type 10 (RemoteInteractive) logons across the environment.\n3. **Build Authentication Graphs**: Map source-to-destination authentication relationships to identify unusual connection patterns.\n4. **Detect First-Time Relationships**: Identify new source-destination pairs that have not been seen in the historical baseline.\n5. **Correlate with Process Activity**: Link authentication events to subsequent process creation on destination hosts.\n6. **Identify Anomalous Patterns**: Flag lateral movement to sensitive servers, unusual hours, service account misuse, or rapid multi-host access.\n7. **Report and Contain**: Document lateral movement path, affected systems, and coordinate containment response.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1021 | Remote Services (parent technique) |\n| T1021.001 | Remote Desktop Protocol (RDP) |\n| T1021.002 | SMB\u002FWindows Admin Shares |\n| T1021.003 | Distributed COM (DCOM) |\n| T1021.004 | SSH |\n| T1021.006 | Windows Remote Management (WinRM) |\n| T1570 | Lateral Tool Transfer |\n| T1047 | Windows Management Instrumentation |\n| T1569.002 | Service Execution (PsExec) |\n| Logon Type 3 | Network logon (SMB, WinRM, mapped drives) |\n| Logon Type 10 | Remote Interactive (RDP) |\n| Event ID 4624 | Successful logon |\n| Event ID 4648 | Explicit credential logon (runas, PsExec) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk Enterprise | SIEM for log aggregation and SPL queries |\n| Splunk Enterprise Security | Threat detection and notable events |\n| Windows Event Forwarding | Centralize Windows logs |\n| Sysmon | Detailed process and network telemetry |\n| BloodHound | AD attack path analysis |\n| PingCastle | AD security assessment |\n\n## Common Scenarios\n\n1. **PsExec Lateral Movement**: Adversary uses PsExec to execute commands on remote systems via SMB, generating Type 3 logon with ADMIN$ share access.\n2. **RDP Pivoting**: Attacker RDPs to internal systems using stolen credentials, creating Type 10 logon events.\n3. **WMI Remote Execution**: Adversary uses WMIC process call create to spawn processes on remote hosts.\n4. **WinRM PowerShell Remoting**: Attacker uses Enter-PSSession or Invoke-Command to execute code on remote systems.\n5. **Pass-the-Hash via SMB**: Compromised NTLM hashes used to authenticate to remote systems without knowing the plaintext password.\n\n## Output Format\n\n```\nHunt ID: TH-LATMOV-[DATE]-[SEQ]\nMovement Type: [RDP\u002FSMB\u002FWinRM\u002FWMI\u002FDCOM\u002FPsExec]\nSource Host: [Hostname\u002FIP]\nDestination Host: [Hostname\u002FIP]\nAccount Used: [Username]\nLogon Type: [3\u002F10\u002Fother]\nFirst Seen: [Timestamp]\nEvent Count: [Number of events]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\nLateral Movement Path: [A -> B -> C -> D]\n```\n",{"name":5,"tags":48,"author":49,"domain":36,"license":15,"version":50,"nist_csf":51,"subdomain":37,"description":7,"mitre_attack":56,"d3fend_techniques":62},[37,38,31,24,27,32,28],"mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[57,58,59,60,61],"T1046","T1057","T1082","T1083","T1021",[63,64,65,66,67],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-lateral-movement-with-splunk",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-splunk",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-splunk",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-splunk","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002FSKILL.md",true,[92,98,103,109,113,117,123,127,131,135,141],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1279,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1562,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",2635,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",4756,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",5029,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",12777,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002Fscripts\u002Fprocess.py",{"path":128,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":129,"sourceHtmlUrl":130},"sections\u002Fmanifest.json",574,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplan-design-review\u002Fsections\u002Fmanifest.json",{"path":132,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":133,"sourceHtmlUrl":134},"sections\u002Freview-sections.md",37983,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplan-design-review\u002Fsections\u002Freview-sections.md",{"path":136,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":139,"sourceHtmlUrl":140},"sections\u002Freview-sections.md.tmpl","OTHER","其他",13791,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplan-design-review\u002Fsections\u002Freview-sections.md.tmpl",{"path":142,"resourceType":137,"resourceTypeDesc":138,"sizeBytes":143,"sourceHtmlUrl":144},"SKILL.md.tmpl",16816,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplan-design-review\u002FSKILL.md.tmpl",[146,173,197,224,248,275],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[152],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[154,155,156,157,158,36,159,160,161,162,163,164,165,166,167,168,169,170,171,172],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[179],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[181,169,182,183,158,184,36,161,185,186,187,188,189,190,191,192,193,194,195,196],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":207,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[203,206],{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[191,208,209,210,211,36,212,213,185,214,215,216,217,218,29,219,220,221,222,223],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[230],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,232,233,36,234,235,40,236,237,238,239,240,241,242,243,244,188,245,246,247],"kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":249,"name":250,"nameZh":6,"description":251,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":252,"categories":253,"keywords":255,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[254],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[256,257,258,36,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":276,"name":277,"nameZh":6,"description":278,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":279,"categories":280,"keywords":282,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[281],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,283,36,27,284,285,286,287,288,289,290,219,291,220,292,293,294,295,296,297],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]