[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEGVPN8K8ZBTTYAK31S20C":3,"skill-same:01M6AEGVPN8K8ZBTTYAK31S20C":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6AEGVPN8K8ZBTTYAK31S20C","detecting-ransomware-encryption-behavior",null,"Detects ransomware encryption activity in real time using entropy analysis, file system I\u002FO monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-encryption-behavior\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"encryption","detecting ransomware encryption behavior","ransomware","cryptocurrency","real time","heuristics","file-monitoring","entropy","defense","watchdog","detection","sysmon","cybersecurity","suspicious","routines","data","behavioral-analysis","monitoring","file","pr","2026-11-10 10:12:30",false,"---\nname: detecting-ransomware-encryption-behavior\ndescription: 'Detects ransomware encryption activity in real time using entropy\n  analysis, file system I\u002FO monitoring (Sysmon, watchdog, psutil), and behavioral\n  scoring to identify mass file modification, abnormal entropy spikes in written\n  data, and suspicious process behavior characteristic of encryption routines.\n  Use when building real-time ransomware detection, tuning entropy thresholds,\n  or investigating suspected active encryption on an endpoint.\n\n  '\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- detection\n- entropy\n- behavioral-analysis\n- file-monitoring\n- heuristics\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1486\n- T1490\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - monetization\n  - positioning\n  - stealth\n  techniques:\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1017.001\n    name: 'Conversion to Physical Monetary Instruments: Cash'\n    tactic: monetization\n    source: f3\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n  - id: T1070\n    name: Indicator Removal\n    tactic: stealth\n    source: attack\n---\n\n# Detecting Ransomware Encryption Behavior\n\n## When to Use\n\n- Building or tuning a behavioral detection layer for ransomware that catches unknown\u002Fzero-day variants\n- Monitoring file servers and endpoints for mass encryption activity that evades signature-based detection\n- Implementing entropy-based detection to identify when files are being replaced with encrypted (high-entropy) content\n- Analyzing suspicious process behavior patterns: rapid sequential file opens, writes, renames, and deletes\n- Validating EDR detection rules against actual ransomware encryption patterns during red team exercises\n\n**Do not use** entropy analysis alone as the only detection signal. Compressed files (ZIP, JPEG, MP4) naturally have high entropy and will cause false positives. Always combine entropy with behavioral signals like I\u002FO rate and file rename patterns.\n\n## Prerequisites\n\n- Python 3.8+ with `watchdog` and `psutil` libraries\n- Administrative access for process monitoring and file system event capture\n- Understanding of Shannon entropy and its application to file content analysis\n- Windows: Sysmon installed for detailed process and file system event logging\n- Linux: auditd configured for file access monitoring, or inotify-based watchers\n- Baseline entropy values for common file types in the monitored environment\n\n## Workflow\n\n### Step 1: Establish Entropy Baselines\n\nCalculate normal entropy ranges for files in the environment:\n\n```\nEntropy Baselines by File Type:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nFile Type       Normal Entropy    Encrypted Entropy\n.docx           3.5 - 6.5        7.8 - 8.0\n.xlsx           4.0 - 6.8        7.8 - 8.0\n.pdf            5.0 - 7.2        7.8 - 8.0\n.txt            2.0 - 5.0        7.8 - 8.0\n.csv            2.0 - 5.5        7.8 - 8.0\n.sql            2.5 - 5.0        7.8 - 8.0\n.jpg\u002F.png       7.0 - 7.9        7.9 - 8.0 (hard to distinguish)\n.zip\u002F.7z        7.5 - 8.0        7.9 - 8.0 (hard to distinguish)\n\nKey insight: Text-based files show the largest entropy jump when encrypted,\nmaking them the best candidates for entropy-based detection.\n```\n\n### Step 2: Implement Real-Time Entropy Monitoring\n\nMonitor file writes and calculate entropy of new content:\n\n```python\nimport math\nfrom collections import Counter\n\ndef shannon_entropy(data):\n    \"\"\"Calculate Shannon entropy of byte data (0.0 to 8.0 scale).\"\"\"\n    if not data:\n        return 0.0\n    freq = Counter(data)\n    length = len(data)\n    return -sum((c \u002F length) * math.log2(c \u002F length) for c in freq.values())\n\ndef is_encryption_entropy(data, threshold=7.5):\n    \"\"\"Check if data entropy indicates encryption.\"\"\"\n    entropy = shannon_entropy(data)\n    return entropy >= threshold, entropy\n```\n\n### Step 3: Monitor File System I\u002FO Patterns\n\nTrack process-level file operations for ransomware patterns:\n\n```\nRansomware I\u002FO Behavior Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Rapid sequential file modification:\n   - >20 files modified per minute by single process\n   - Read original → Write encrypted → Rename with new extension\n   - Pattern: CreateFile → ReadFile → WriteFile → CloseHandle → MoveFile\n\n2. File extension changes:\n   - Original: report.docx → Encrypted: report.docx.locked\n   - Many extensions changed within short time window\n\n3. Ransom note creation:\n   - Same text file (README.txt, DECRYPT.html) created in multiple directories\n   - Created immediately after file encryption in each directory\n\n4. Shadow copy deletion:\n   - vssadmin.exe delete shadows \u002Fall \u002Fquiet\n   - wmic.exe shadowcopy delete\n   - PowerShell: Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\n\n5. Entropy spike pattern:\n   - File read: entropy 3.5 (normal document)\n   - File write: entropy 7.9 (encrypted content)\n   - Delta > 3.0 is strong ransomware indicator\n```\n\n### Step 4: Implement Behavioral Scoring\n\nCombine multiple signals into a composite ransomware score:\n\n```python\ndef calculate_ransomware_score(process_metrics):\n    \"\"\"Score process behavior for ransomware likelihood (0-100).\"\"\"\n    score = 0\n\n    # High file modification rate\n    files_per_min = process_metrics.get(\"files_modified_per_minute\", 0)\n    if files_per_min > 50:\n        score += 30\n    elif files_per_min > 20:\n        score += 15\n\n    # Entropy increase in written files\n    avg_entropy_delta = process_metrics.get(\"avg_entropy_delta\", 0)\n    if avg_entropy_delta > 3.0:\n        score += 30\n    elif avg_entropy_delta > 2.0:\n        score += 15\n\n    # File extension changes\n    extension_changes = process_metrics.get(\"extension_changes\", 0)\n    if extension_changes > 10:\n        score += 20\n    elif extension_changes > 3:\n        score += 10\n\n    # Ransom note creation\n    if process_metrics.get(\"ransom_note_created\", False):\n        score += 20\n\n    return min(score, 100)\n```\n\n### Step 5: Configure Automated Response Thresholds\n\nSet detection thresholds and automated containment actions:\n\n```\nDetection Thresholds:\n━━━━━━━━━━━━━━━━━━━━\nScore 0-25:   INFORMATIONAL - Log only, no action\nScore 25-50:  LOW - Alert SOC for investigation\nScore 50-75:  HIGH - Alert SOC, suspend process, snapshot VM\nScore 75-100: CRITICAL - Kill process, isolate endpoint, alert IR team\n\nAutomated Response Actions:\n  - Suspend\u002Fkill the encrypting process\n  - Disable network adapter to prevent lateral movement\n  - Create volume shadow copy snapshot before further damage\n  - Capture process memory dump for forensic analysis\n  - Send SIEM alert with process details, affected files, and timeline\n```\n\n## Verification\n\n- Test detection against known ransomware samples in an isolated sandbox environment\n- Verify that entropy monitoring correctly identifies encrypted vs. compressed files\n- Confirm that behavioral scoring produces low false-positive rates on normal workloads\n- Validate automated response actions execute within acceptable time (under 5 seconds)\n- Test with multiple ransomware families (LockBit, BlackCat, Conti) to verify coverage\n- Benchmark monitoring overhead to ensure it does not degrade endpoint performance\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Shannon Entropy** | Mathematical measure of randomness in data (0-8 for bytes); encrypted data approaches 8.0, while text files are typically 2-5 |\n| **Differential Entropy** | The change in entropy between a file's original and modified content; a spike indicates encryption |\n| **I\u002FO Rate Anomaly** | Abnormally high rate of file read\u002Fwrite operations by a single process, characteristic of bulk encryption |\n| **Behavioral Scoring** | Combining multiple weak signals (entropy, I\u002FO rate, file renames) into a composite confidence score |\n| **Entropy Evasion** | Techniques used by advanced ransomware to defeat entropy detection, such as Base64 encoding output or partial encryption |\n\n## Tools & Systems\n\n- **Sysmon**: Windows system monitor providing detailed file system and process events for behavioral analysis\n- **watchdog (Python)**: Cross-platform file system monitoring library for real-time file change detection\n- **psutil (Python)**: Process and system monitoring library for tracking per-process I\u002FO statistics\n- **Elastic Endpoint**: Commercial endpoint protection with built-in ransomware behavioral detection using canary files\n- **Wazuh**: Open-source security platform with file integrity monitoring and active response capabilities\n","# Detecting Ransomware Encryption Behavior\n\n## When to Use\n\n- Building or tuning a behavioral detection layer for ransomware that catches unknown\u002Fzero-day variants\n- Monitoring file servers and endpoints for mass encryption activity that evades signature-based detection\n- Implementing entropy-based detection to identify when files are being replaced with encrypted (high-entropy) content\n- Analyzing suspicious process behavior patterns: rapid sequential file opens, writes, renames, and deletes\n- Validating EDR detection rules against actual ransomware encryption patterns during red team exercises\n\n**Do not use** entropy analysis alone as the only detection signal. Compressed files (ZIP, JPEG, MP4) naturally have high entropy and will cause false positives. Always combine entropy with behavioral signals like I\u002FO rate and file rename patterns.\n\n## Prerequisites\n\n- Python 3.8+ with `watchdog` and `psutil` libraries\n- Administrative access for process monitoring and file system event capture\n- Understanding of Shannon entropy and its application to file content analysis\n- Windows: Sysmon installed for detailed process and file system event logging\n- Linux: auditd configured for file access monitoring, or inotify-based watchers\n- Baseline entropy values for common file types in the monitored environment\n\n## Workflow\n\n### Step 1: Establish Entropy Baselines\n\nCalculate normal entropy ranges for files in the environment:\n\n```\nEntropy Baselines by File Type:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nFile Type       Normal Entropy    Encrypted Entropy\n.docx           3.5 - 6.5        7.8 - 8.0\n.xlsx           4.0 - 6.8        7.8 - 8.0\n.pdf            5.0 - 7.2        7.8 - 8.0\n.txt            2.0 - 5.0        7.8 - 8.0\n.csv            2.0 - 5.5        7.8 - 8.0\n.sql            2.5 - 5.0        7.8 - 8.0\n.jpg\u002F.png       7.0 - 7.9        7.9 - 8.0 (hard to distinguish)\n.zip\u002F.7z        7.5 - 8.0        7.9 - 8.0 (hard to distinguish)\n\nKey insight: Text-based files show the largest entropy jump when encrypted,\nmaking them the best candidates for entropy-based detection.\n```\n\n### Step 2: Implement Real-Time Entropy Monitoring\n\nMonitor file writes and calculate entropy of new content:\n\n```python\nimport math\nfrom collections import Counter\n\ndef shannon_entropy(data):\n    \"\"\"Calculate Shannon entropy of byte data (0.0 to 8.0 scale).\"\"\"\n    if not data:\n        return 0.0\n    freq = Counter(data)\n    length = len(data)\n    return -sum((c \u002F length) * math.log2(c \u002F length) for c in freq.values())\n\ndef is_encryption_entropy(data, threshold=7.5):\n    \"\"\"Check if data entropy indicates encryption.\"\"\"\n    entropy = shannon_entropy(data)\n    return entropy >= threshold, entropy\n```\n\n### Step 3: Monitor File System I\u002FO Patterns\n\nTrack process-level file operations for ransomware patterns:\n\n```\nRansomware I\u002FO Behavior Signatures:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Rapid sequential file modification:\n   - >20 files modified per minute by single process\n   - Read original → Write encrypted → Rename with new extension\n   - Pattern: CreateFile → ReadFile → WriteFile → CloseHandle → MoveFile\n\n2. File extension changes:\n   - Original: report.docx → Encrypted: report.docx.locked\n   - Many extensions changed within short time window\n\n3. Ransom note creation:\n   - Same text file (README.txt, DECRYPT.html) created in multiple directories\n   - Created immediately after file encryption in each directory\n\n4. Shadow copy deletion:\n   - vssadmin.exe delete shadows \u002Fall \u002Fquiet\n   - wmic.exe shadowcopy delete\n   - PowerShell: Get-WmiObject Win32_Shadowcopy | Remove-WmiObject\n\n5. Entropy spike pattern:\n   - File read: entropy 3.5 (normal document)\n   - File write: entropy 7.9 (encrypted content)\n   - Delta > 3.0 is strong ransomware indicator\n```\n\n### Step 4: Implement Behavioral Scoring\n\nCombine multiple signals into a composite ransomware score:\n\n```python\ndef calculate_ransomware_score(process_metrics):\n    \"\"\"Score process behavior for ransomware likelihood (0-100).\"\"\"\n    score = 0\n\n    # High file modification rate\n    files_per_min = process_metrics.get(\"files_modified_per_minute\", 0)\n    if files_per_min > 50:\n        score += 30\n    elif files_per_min > 20:\n        score += 15\n\n    # Entropy increase in written files\n    avg_entropy_delta = process_metrics.get(\"avg_entropy_delta\", 0)\n    if avg_entropy_delta > 3.0:\n        score += 30\n    elif avg_entropy_delta > 2.0:\n        score += 15\n\n    # File extension changes\n    extension_changes = process_metrics.get(\"extension_changes\", 0)\n    if extension_changes > 10:\n        score += 20\n    elif extension_changes > 3:\n        score += 10\n\n    # Ransom note creation\n    if process_metrics.get(\"ransom_note_created\", False):\n        score += 20\n\n    return min(score, 100)\n```\n\n### Step 5: Configure Automated Response Thresholds\n\nSet detection thresholds and automated containment actions:\n\n```\nDetection Thresholds:\n━━━━━━━━━━━━━━━━━━━━\nScore 0-25:   INFORMATIONAL - Log only, no action\nScore 25-50:  LOW - Alert SOC for investigation\nScore 50-75:  HIGH - Alert SOC, suspend process, snapshot VM\nScore 75-100: CRITICAL - Kill process, isolate endpoint, alert IR team\n\nAutomated Response Actions:\n  - Suspend\u002Fkill the encrypting process\n  - Disable network adapter to prevent lateral movement\n  - Create volume shadow copy snapshot before further damage\n  - Capture process memory dump for forensic analysis\n  - Send SIEM alert with process details, affected files, and timeline\n```\n\n## Verification\n\n- Test detection against known ransomware samples in an isolated sandbox environment\n- Verify that entropy monitoring correctly identifies encrypted vs. compressed files\n- Confirm that behavioral scoring produces low false-positive rates on normal workloads\n- Validate automated response actions execute within acceptable time (under 5 seconds)\n- Test with multiple ransomware families (LockBit, BlackCat, Conti) to verify coverage\n- Benchmark monitoring overhead to ensure it does not degrade endpoint performance\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Shannon Entropy** | Mathematical measure of randomness in data (0-8 for bytes); encrypted data approaches 8.0, while text files are typically 2-5 |\n| **Differential Entropy** | The change in entropy between a file's original and modified content; a spike indicates encryption |\n| **I\u002FO Rate Anomaly** | Abnormally high rate of file read\u002Fwrite operations by a single process, characteristic of bulk encryption |\n| **Behavioral Scoring** | Combining multiple weak signals (entropy, I\u002FO rate, file renames) into a composite confidence score |\n| **Entropy Evasion** | Techniques used by advanced ransomware to defeat entropy detection, such as Base64 encoding output or partial encryption |\n\n## Tools & Systems\n\n- **Sysmon**: Windows system monitor providing detailed file system and process events for behavioral analysis\n- **watchdog (Python)**: Cross-platform file system monitoring library for real-time file change detection\n- **psutil (Python)**: Process and system monitoring library for tracking per-process I\u002FO statistics\n- **Elastic Endpoint**: Commercial endpoint protection with built-in ransomware behavioral detection using canary files\n- **Wazuh**: Open-source security platform with file integrity monitoring and active response capabilities\n",{"name":5,"tags":49,"author":50,"domain":36,"license":15,"version":51,"mitre_f3":52,"nist_csf":73,"subdomain":78,"description":79,"mitre_attack":80},[26,34,31,40,30,29],"mahipal","1.0.0",{"tactics":53,"version":57,"techniques":58},[54,55,56],"monetization","positioning","stealth","1.1",[59,63,66,70],{"id":60,"name":61,"source":62,"tactic":54},"F1018","Convert to Cryptocurrency","f3",{"id":64,"name":65,"source":62,"tactic":54},"F1017.001","Conversion to Physical Monetary Instruments: Cash",{"id":67,"name":68,"source":69,"tactic":55},"T1219","Remote Access Tools","attack",{"id":71,"name":72,"source":69,"tactic":56},"T1070","Indicator Removal",[74,75,76,77],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense","Detects ransomware encryption activity in real time using entropy analysis, file system I\u002FO monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint.\n",[81,82,83,84,85],"T1078","T1190","T1059","T1486","T1490","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-ransomware-encryption-behavior",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behavior",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behavior",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-ransomware-encryption-behavior","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-encryption-behavior\u002FSKILL.md",true,[110,115,121],{"path":111,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-encryption-behavior\u002FLICENSE",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fapi-reference.md","REFERENCE","参考文档",2623,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-encryption-behavior\u002Freferences\u002Fapi-reference.md",{"path":122,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fagent.py","SCRIPT","脚本",11975,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-ransomware-encryption-behavior\u002Fscripts\u002Fagent.py",[128,154,178,203,228,255],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,140,36,141,142,43,143,144,145,146,147,148,149,150,151,152,153],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,150,163,164,140,165,36,43,166,167,168,169,170,171,172,173,174,175,176,177],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[184,187],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[172,189,190,191,192,36,193,194,166,195,196,197,26,27,34,198,199,200,201,202],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,36,214,215,216,217,218,219,220,39,221,222,223,224,169,225,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,36,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,263,36,264,42,265,266,267,268,269,270,198,271,199,272,273,274,275,276,277],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]