[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEF0KMZRY39G6TJRKSS1XN":3,"skill-same:01M6AEF0KMZRY39G6TJRKSS1XN":151},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":92,"commitSha":93,"skillDirectory":94,"forksCount":95,"repositoryHtmlUrl":96,"repositoryHomepageUrl":97,"ownerHtmlUrl":98,"ownerBlogUrl":99,"ownerDescription":100,"updatedAt":101,"install":102,"resources":115},"01M6AEF0KMZRY39G6TJRKSS1XN","detecting-mobile-malware-behavior",null,"Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting mobile malware behavior","malware","malware analysis","analyzing","owasp-mobile","ios","mobile-security","exfiltration","command-and-control","malware-analysis","testing","monitoring","communication","verification","pr","accessibility","cybersecurity","android","suspicious","malicious","2026-11-10 10:12:30",false,"---\nname: detecting-mobile-malware-behavior\ndescription: 'Detects and analyzes malicious behavior in mobile applications through\n  behavioral analysis, permission abuse detection, network traffic monitoring, and\n  dynamic instrumentation. Use when analyzing suspicious mobile applications for data\n  exfiltration, command-and-control communication, credential stealing, SMS interception,\n  or other malware indicators. Activates for requests involving mobile malware analysis,\n  app behavior monitoring, trojan detection, or suspicious app investigation.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- ios\n- malware-analysis\n- owasp-mobile\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1003\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - execution\n  - initial-access\n  techniques:\n  - id: T1453\n    name: Abuse Accessibility Features\n    tactic: positioning\n    source: attack\n  - id: F1003\n    name: Abuse SMS verification\n    tactic: execution\n    source: f3\n  - id: T1113\n    name: Screen Capture\n    tactic: positioning\n    source: attack\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n  - id: F1002.001\n    name: 'Abuse of Public-Facing API: Mobile API Abuse'\n    tactic: positioning\n    source: f3\n---\n# Detecting Mobile Malware Behavior\n\n## When to Use\n\nUse this skill when:\n- Analyzing suspicious mobile applications submitted by users or discovered during incident response\n- Monitoring enterprise mobile fleet for malicious app indicators\n- Performing malware triage on APK\u002FIPA samples\n- Investigating data exfiltration or unauthorized device access from mobile apps\n\n**Do not use** this skill to create, enhance, or distribute malware. This skill is for defensive analysis only.\n\n## Prerequisites\n\n- Isolated analysis environment (dedicated device or emulator, not connected to production networks)\n- MobSF for automated static+dynamic analysis\n- Frida\u002FObjection for runtime behavior monitoring\n- Wireshark\u002Ftcpdump for network traffic capture\n- Android emulator (AVD) or Genymotion for safe execution\n- VirusTotal API key for hash lookups\n\n## Workflow\n\n### Step 1: Static Indicator Analysis\n\n```bash\n# Hash the sample\nsha256sum suspicious.apk\n\n# Check VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F\u003CSHA256>\" \\\n  -H \"x-apikey: \u003CVT_API_KEY>\" | jq '.data.attributes.last_analysis_stats'\n\n# Extract permissions from AndroidManifest.xml\naapt dump permissions suspicious.apk\n\n# High-risk permission combinations:\n# READ_SMS + INTERNET = SMS stealer\n# RECEIVE_SMS + SEND_SMS = SMS interceptor\u002Fbanker trojan\n# ACCESSIBILITY_SERVICE + INTERNET = overlay attack capability\n# CAMERA + RECORD_AUDIO + INTERNET = spyware\n# DEVICE_ADMIN + INTERNET = ransomware capability\n# READ_CONTACTS + INTERNET = contact exfiltration\n```\n\n### Step 2: MobSF Automated Malware Scan\n\n```bash\n# Upload to MobSF\ncurl -F \"file=@suspicious.apk\" http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fupload \\\n  -H \"Authorization: \u003CAPI_KEY>\"\n\n# Review malware indicators in report:\n# - Hardcoded C2 server addresses\n# - Dynamic code loading (DexClassLoader)\n# - Reflection-based API calls (to evade static analysis)\n# - Encrypted\u002Fobfuscated payloads\n# - Root detection (malware often checks for root)\n# - Anti-emulator checks (malware evades sandbox)\n```\n\n### Step 3: Network Behavior Monitoring\n\n```bash\n# Start packet capture on emulator\ntcpdump -i any -w malware_traffic.pcap\n\n# Or use mitmproxy for HTTP\u002FHTTPS\nmitmproxy --mode transparent\n\n# Monitor for:\n# - DNS lookups to suspicious\u002Fnewly registered domains\n# - Connections to known C2 infrastructure\n# - Data exfiltration patterns (large POST requests)\n# - Beaconing behavior (regular interval connections)\n# - Non-standard ports and protocols\n# - Domain Generation Algorithm (DGA) patterns\n```\n\n### Step 4: Runtime Behavior Monitoring with Frida\n\n```javascript\n\u002F\u002F monitor_malware.js - Comprehensive behavior monitoring\nJava.perform(function() {\n    \u002F\u002F Monitor SMS access\n    var SmsManager = Java.use(\"android.telephony.SmsManager\");\n    SmsManager.sendTextMessage.overload(\"java.lang.String\", \"java.lang.String\",\n        \"java.lang.String\", \"android.app.PendingIntent\", \"android.app.PendingIntent\")\n        .implementation = function(dest, sc, text, sent, delivery) {\n            console.log(\"[SMS] Sending to: \" + dest + \" Text: \" + text);\n            \u002F\u002F Allow or block based on analysis needs\n            return this.sendTextMessage(dest, sc, text, sent, delivery);\n        };\n\n    \u002F\u002F Monitor file operations\n    var FileOutputStream = Java.use(\"java.io.FileOutputStream\");\n    FileOutputStream.$init.overload(\"java.lang.String\").implementation = function(path) {\n        console.log(\"[FILE-WRITE] \" + path);\n        return this.$init(path);\n    };\n\n    \u002F\u002F Monitor network connections\n    var URL = Java.use(\"java.net.URL\");\n    URL.openConnection.overload().implementation = function() {\n        console.log(\"[NET] \" + this.toString());\n        return this.openConnection();\n    };\n\n    \u002F\u002F Monitor dynamic code loading\n    var DexClassLoader = Java.use(\"dalvik.system.DexClassLoader\");\n    DexClassLoader.$init.implementation = function(dexPath, optDir, libPath, parent) {\n        console.log(\"[DEX-LOAD] Loading: \" + dexPath);\n        return this.$init(dexPath, optDir, libPath, parent);\n    };\n\n    \u002F\u002F Monitor command execution\n    var Runtime = Java.use(\"java.lang.Runtime\");\n    Runtime.exec.overload(\"java.lang.String\").implementation = function(cmd) {\n        console.log(\"[EXEC] \" + cmd);\n        return this.exec(cmd);\n    };\n\n    \u002F\u002F Monitor camera\u002Faudio access\n    var Camera = Java.use(\"android.hardware.Camera\");\n    Camera.open.overload(\"int\").implementation = function(id) {\n        console.log(\"[CAMERA] Camera opened: \" + id);\n        return this.open(id);\n    };\n\n    \u002F\u002F Monitor content provider access (contacts, call log)\n    var ContentResolver = Java.use(\"android.content.ContentResolver\");\n    ContentResolver.query.overload(\"android.net.Uri\", \"[Ljava.lang.String;\",\n        \"java.lang.String\", \"[Ljava.lang.String;\", \"java.lang.String\")\n        .implementation = function(uri, proj, sel, selArgs, sort) {\n            console.log(\"[QUERY] \" + uri.toString());\n            return this.query(uri, proj, sel, selArgs, sort);\n        };\n\n    console.log(\"[*] Malware behavior monitor active\");\n});\n```\n\n### Step 5: Classify Malware Type\n\nBased on observed behaviors, classify the sample:\n\n| Behavior Pattern | Malware Type |\n|-----------------|-------------|\n| SMS interception + C2 communication | Banking Trojan |\n| Camera\u002Fmic access + data upload | Spyware\u002FStalkerware |\n| File encryption + ransom note display | Mobile Ransomware |\n| Ad injection + click fraud traffic | Adware |\n| Root exploit + persistence | Rootkit |\n| Contact harvesting + SMS spam | Worm\u002FSMS Spammer |\n| Overlay attacks + credential capture | Credential Stealer |\n| Crypto mining network activity | Cryptojacker |\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Dynamic Code Loading** | Loading executable code at runtime from external sources, commonly used by malware to evade static analysis |\n| **C2 Beacon** | Regular network check-in from malware to command-and-control server, identifiable by periodic timing patterns |\n| **DGA** | Domain Generation Algorithm creating pseudo-random domain names for resilient C2 infrastructure |\n| **Overlay Attack** | Drawing fake UI over legitimate apps to capture credentials, requiring SYSTEM_ALERT_WINDOW permission |\n| **Anti-Emulator** | Techniques malware uses to detect sandbox\u002Femulator environments and suppress malicious behavior |\n\n## Tools & Systems\n\n- **MobSF**: Automated static and dynamic analysis for initial malware triage\n- **VirusTotal**: Multi-engine malware scanning and hash reputation lookup\n- **Frida**: Runtime behavior monitoring through method hooking\n- **Wireshark**: Network traffic analysis for C2 communication patterns\n- **Cuckoo Sandbox \u002F CuckooDroid**: Automated malware analysis sandbox for Android samples\n\n## Common Pitfalls\n\n- **Anti-analysis evasion**: Sophisticated malware detects emulators, debuggers, and Frida. Use hardware devices and stealthy Frida configurations for accurate analysis.\n- **Time-delayed payloads**: Some malware activates only after a delay or specific trigger. Monitor for extended periods and simulate various conditions.\n- **Encrypted C2**: Malware using encrypted communications requires TLS interception or memory inspection to observe payload content.\n- **Multi-stage payloads**: Initial APK may be benign; malicious payload downloads later. Monitor for dynamic code loading and file downloads.\n","# Detecting Mobile Malware Behavior\n\n## When to Use\n\nUse this skill when:\n- Analyzing suspicious mobile applications submitted by users or discovered during incident response\n- Monitoring enterprise mobile fleet for malicious app indicators\n- Performing malware triage on APK\u002FIPA samples\n- Investigating data exfiltration or unauthorized device access from mobile apps\n\n**Do not use** this skill to create, enhance, or distribute malware. This skill is for defensive analysis only.\n\n## Prerequisites\n\n- Isolated analysis environment (dedicated device or emulator, not connected to production networks)\n- MobSF for automated static+dynamic analysis\n- Frida\u002FObjection for runtime behavior monitoring\n- Wireshark\u002Ftcpdump for network traffic capture\n- Android emulator (AVD) or Genymotion for safe execution\n- VirusTotal API key for hash lookups\n\n## Workflow\n\n### Step 1: Static Indicator Analysis\n\n```bash\n# Hash the sample\nsha256sum suspicious.apk\n\n# Check VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F\u003CSHA256>\" \\\n  -H \"x-apikey: \u003CVT_API_KEY>\" | jq '.data.attributes.last_analysis_stats'\n\n# Extract permissions from AndroidManifest.xml\naapt dump permissions suspicious.apk\n\n# High-risk permission combinations:\n# READ_SMS + INTERNET = SMS stealer\n# RECEIVE_SMS + SEND_SMS = SMS interceptor\u002Fbanker trojan\n# ACCESSIBILITY_SERVICE + INTERNET = overlay attack capability\n# CAMERA + RECORD_AUDIO + INTERNET = spyware\n# DEVICE_ADMIN + INTERNET = ransomware capability\n# READ_CONTACTS + INTERNET = contact exfiltration\n```\n\n### Step 2: MobSF Automated Malware Scan\n\n```bash\n# Upload to MobSF\ncurl -F \"file=@suspicious.apk\" http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fupload \\\n  -H \"Authorization: \u003CAPI_KEY>\"\n\n# Review malware indicators in report:\n# - Hardcoded C2 server addresses\n# - Dynamic code loading (DexClassLoader)\n# - Reflection-based API calls (to evade static analysis)\n# - Encrypted\u002Fobfuscated payloads\n# - Root detection (malware often checks for root)\n# - Anti-emulator checks (malware evades sandbox)\n```\n\n### Step 3: Network Behavior Monitoring\n\n```bash\n# Start packet capture on emulator\ntcpdump -i any -w malware_traffic.pcap\n\n# Or use mitmproxy for HTTP\u002FHTTPS\nmitmproxy --mode transparent\n\n# Monitor for:\n# - DNS lookups to suspicious\u002Fnewly registered domains\n# - Connections to known C2 infrastructure\n# - Data exfiltration patterns (large POST requests)\n# - Beaconing behavior (regular interval connections)\n# - Non-standard ports and protocols\n# - Domain Generation Algorithm (DGA) patterns\n```\n\n### Step 4: Runtime Behavior Monitoring with Frida\n\n```javascript\n\u002F\u002F monitor_malware.js - Comprehensive behavior monitoring\nJava.perform(function() {\n    \u002F\u002F Monitor SMS access\n    var SmsManager = Java.use(\"android.telephony.SmsManager\");\n    SmsManager.sendTextMessage.overload(\"java.lang.String\", \"java.lang.String\",\n        \"java.lang.String\", \"android.app.PendingIntent\", \"android.app.PendingIntent\")\n        .implementation = function(dest, sc, text, sent, delivery) {\n            console.log(\"[SMS] Sending to: \" + dest + \" Text: \" + text);\n            \u002F\u002F Allow or block based on analysis needs\n            return this.sendTextMessage(dest, sc, text, sent, delivery);\n        };\n\n    \u002F\u002F Monitor file operations\n    var FileOutputStream = Java.use(\"java.io.FileOutputStream\");\n    FileOutputStream.$init.overload(\"java.lang.String\").implementation = function(path) {\n        console.log(\"[FILE-WRITE] \" + path);\n        return this.$init(path);\n    };\n\n    \u002F\u002F Monitor network connections\n    var URL = Java.use(\"java.net.URL\");\n    URL.openConnection.overload().implementation = function() {\n        console.log(\"[NET] \" + this.toString());\n        return this.openConnection();\n    };\n\n    \u002F\u002F Monitor dynamic code loading\n    var DexClassLoader = Java.use(\"dalvik.system.DexClassLoader\");\n    DexClassLoader.$init.implementation = function(dexPath, optDir, libPath, parent) {\n        console.log(\"[DEX-LOAD] Loading: \" + dexPath);\n        return this.$init(dexPath, optDir, libPath, parent);\n    };\n\n    \u002F\u002F Monitor command execution\n    var Runtime = Java.use(\"java.lang.Runtime\");\n    Runtime.exec.overload(\"java.lang.String\").implementation = function(cmd) {\n        console.log(\"[EXEC] \" + cmd);\n        return this.exec(cmd);\n    };\n\n    \u002F\u002F Monitor camera\u002Faudio access\n    var Camera = Java.use(\"android.hardware.Camera\");\n    Camera.open.overload(\"int\").implementation = function(id) {\n        console.log(\"[CAMERA] Camera opened: \" + id);\n        return this.open(id);\n    };\n\n    \u002F\u002F Monitor content provider access (contacts, call log)\n    var ContentResolver = Java.use(\"android.content.ContentResolver\");\n    ContentResolver.query.overload(\"android.net.Uri\", \"[Ljava.lang.String;\",\n        \"java.lang.String\", \"[Ljava.lang.String;\", \"java.lang.String\")\n        .implementation = function(uri, proj, sel, selArgs, sort) {\n            console.log(\"[QUERY] \" + uri.toString());\n            return this.query(uri, proj, sel, selArgs, sort);\n        };\n\n    console.log(\"[*] Malware behavior monitor active\");\n});\n```\n\n### Step 5: Classify Malware Type\n\nBased on observed behaviors, classify the sample:\n\n| Behavior Pattern | Malware Type |\n|-----------------|-------------|\n| SMS interception + C2 communication | Banking Trojan |\n| Camera\u002Fmic access + data upload | Spyware\u002FStalkerware |\n| File encryption + ransom note display | Mobile Ransomware |\n| Ad injection + click fraud traffic | Adware |\n| Root exploit + persistence | Rootkit |\n| Contact harvesting + SMS spam | Worm\u002FSMS Spammer |\n| Overlay attacks + credential capture | Credential Stealer |\n| Crypto mining network activity | Cryptojacker |\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Dynamic Code Loading** | Loading executable code at runtime from external sources, commonly used by malware to evade static analysis |\n| **C2 Beacon** | Regular network check-in from malware to command-and-control server, identifiable by periodic timing patterns |\n| **DGA** | Domain Generation Algorithm creating pseudo-random domain names for resilient C2 infrastructure |\n| **Overlay Attack** | Drawing fake UI over legitimate apps to capture credentials, requiring SYSTEM_ALERT_WINDOW permission |\n| **Anti-Emulator** | Techniques malware uses to detect sandbox\u002Femulator environments and suppress malicious behavior |\n\n## Tools & Systems\n\n- **MobSF**: Automated static and dynamic analysis for initial malware triage\n- **VirusTotal**: Multi-engine malware scanning and hash reputation lookup\n- **Frida**: Runtime behavior monitoring through method hooking\n- **Wireshark**: Network traffic analysis for C2 communication patterns\n- **Cuckoo Sandbox \u002F CuckooDroid**: Automated malware analysis sandbox for Android samples\n\n## Common Pitfalls\n\n- **Anti-analysis evasion**: Sophisticated malware detects emulators, debuggers, and Frida. Use hardware devices and stealthy Frida configurations for accurate analysis.\n- **Time-delayed payloads**: Some malware activates only after a delay or specific trigger. Monitor for extended periods and simulate various conditions.\n- **Encrypted C2**: Malware using encrypted communications requires TLS interception or memory inspection to observe payload content.\n- **Multi-stage payloads**: Initial APK may be benign; malicious payload downloads later. Monitor for dynamic code loading and file downloads.\n",{"name":5,"tags":52,"author":54,"domain":43,"license":15,"version":55,"mitre_f3":56,"nist_csf":80,"subdomain":33,"description":85,"mitre_attack":86},[33,44,32,36,31,53],"penetration-testing","mahipal","1.0.0",{"tactics":57,"version":61,"techniques":62},[58,59,60],"positioning","execution","initial-access","1.1",[63,67,71,74,77],{"id":64,"name":65,"source":66,"tactic":58},"T1453","Abuse Accessibility Features","attack",{"id":68,"name":69,"source":70,"tactic":59},"F1003","Abuse SMS verification","f3",{"id":72,"name":73,"source":66,"tactic":58},"T1113","Screen Capture",{"id":75,"name":76,"source":66,"tactic":58},"T1219","Remote Access Tools",{"id":78,"name":79,"source":70,"tactic":58},"F1002.001","Abuse of Public-Facing API: Mobile API Abuse",[81,82,83,84],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.\n",[87,88,89,90,91],"T1059","T1056","T1036","T1078","T1003","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-mobile-malware-behavior",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":103,"prompt":113,"zipAvailable":114},[104,107,110],{"tool":105,"command":106},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-mobile-malware-behavior",{"tool":108,"command":109},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-mobile-malware-behavior",{"tool":111,"command":112},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-mobile-malware-behavior","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002FSKILL.md",true,[116,122,127,133,137,141,147],{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"assets\u002Ftemplate.md","ASSET","资产文件",956,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002Fassets\u002Ftemplate.md",{"path":123,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002FLICENSE",{"path":128,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fapi-reference.md","REFERENCE","参考文档",1765,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002Freferences\u002Fapi-reference.md",{"path":134,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":135,"sourceHtmlUrl":136},"references\u002Fstandards.md",931,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002Freferences\u002Fstandards.md",{"path":138,"resourceType":129,"resourceTypeDesc":130,"sizeBytes":139,"sourceHtmlUrl":140},"references\u002Fworkflows.md",1037,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002Freferences\u002Fworkflows.md",{"path":142,"resourceType":143,"resourceTypeDesc":144,"sizeBytes":145,"sourceHtmlUrl":146},"scripts\u002Fagent.py","SCRIPT","脚本",6249,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002Fscripts\u002Fagent.py",{"path":148,"resourceType":143,"resourceTypeDesc":144,"sizeBytes":149,"sourceHtmlUrl":150},"scripts\u002Fprocess.py",9036,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002Fscripts\u002Fprocess.py",[152,178,201,226,252,279],{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[158],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[160,161,162,163,164,43,165,166,41,167,168,169,170,171,172,173,174,175,176,177],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[184],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[186,174,187,188,164,189,43,41,40,190,191,192,193,194,195,196,197,198,199,200],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":209,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[207,208],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[195,210,211,212,37,43,213,214,40,215,216,217,218,219,220,221,222,223,224,225],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":233,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[232],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[234,235,236,43,237,238,239,240,241,242,243,244,245,246,247,248,192,249,250,251],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[258],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[260,261,262,43,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":280,"name":281,"nameZh":6,"description":282,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":283,"categories":284,"keywords":286,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[285],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[164,287,43,288,289,290,291,292,293,294,295,221,59,222,296,297,298,299,300,301],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]