[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEM7BQN3M1F2QHCKR1MFEA":3,"skill-same:01M6AEM7BQN3M1F2QHCKR1MFEA":128},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AEM7BQN3M1F2QHCKR1MFEA","executing-red-team-engagement-planning",null,"Build the foundational red team engagement plan - scope definition, Rules of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization), MITRE ATT&CK-aligned threat profile selection, and operational timelines - producing an engagement brief for stakeholder approval. Use before any offensive testing begins, when scoping a full-scope, assumed-breach, objective-based, or purple-team engagement.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"executing red team engagement planning","planning","red team","adversary-simulation","rules-of-engagement","engagement-planning","t1059","t1078","ATT&CK","exploitation","assumed-breach","purple-team","testing","mitre-attack","post-exploitation","red-team","brief","communication","engagement plan","cybersecurity","2026-11-10 10:12:30",false,"---\nname: executing-red-team-engagement-planning\ndescription: Build the foundational red team engagement plan - scope definition, Rules\n  of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization),\n  MITRE ATT&CK-aligned threat profile selection, and operational timelines - producing an\n  engagement brief for stakeholder approval. Use before any offensive testing begins, when\n  scoping a full-scope, assumed-breach, objective-based, or purple-team engagement.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- adversary-simulation\n- mitre-attack\n- exploitation\n- post-exploitation\n- engagement-planning\n- rules-of-engagement\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n---\n# Executing Red Team Engagement Planning\n\n## Overview\n\nRed team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins. A well-structured engagement plan ensures the red team simulates realistic adversary behavior while maintaining safety guardrails that prevent unintended business disruption.\n\n\n## When to Use\n\n- When conducting security assessments that involve executing red team engagement planning\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Define clear engagement scope including in-scope and out-of-scope assets, networks, and personnel\n- Establish Rules of Engagement (ROE) with emergency stop procedures, communication channels, and legal boundaries\n- Select appropriate threat profiles from the MITRE ATT&CK framework aligned to the organization's threat landscape\n- Create a detailed attack plan mapping adversary TTPs to engagement objectives\n- Develop deconfliction procedures with the organization's SOC\u002Fblue team\n- Produce a comprehensive engagement brief for stakeholder approval\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Core Concepts\n\n### Engagement Types\n\n| Type | Description | Scope |\n|------|-------------|-------|\n| Full Scope | Complete adversary simulation with physical, social, and cyber vectors | Entire organization |\n| Assumed Breach | Starts from initial foothold, focuses on post-exploitation | Internal network |\n| Objective-Based | Target specific crown jewels (e.g., domain admin, PII exfiltration) | Defined targets |\n| Purple Team | Collaborative with blue team for detection improvement | Specific controls |\n\n### Rules of Engagement Components\n\n1. **Scope Definition**: IP ranges, domains, physical locations, personnel\n2. **Restrictions**: Systems\u002Fnetworks that must not be touched (e.g., production databases, medical devices)\n3. **Communication Plan**: Primary and secondary contact channels, escalation procedures\n4. **Emergency Procedures**: Code word for immediate cessation, incident response coordination\n5. **Legal Authorization**: Signed authorization letters, get-out-of-jail letters for physical tests\n6. **Data Handling**: How sensitive data discovered during testing will be handled and destroyed\n7. **Timeline**: Start\u002Fend dates, blackout windows, reporting deadlines\n\n### Threat Profile Selection\n\nMap organizational threats using MITRE ATT&CK Navigator to select relevant adversary profiles:\n\n- **APT29 (Cozy Bear)**: Government\u002Fdefense sector targeting via spearphishing, supply chain\n- **APT28 (Fancy Bear)**: Government organizations, credential harvesting, zero-days\n- **FIN7**: Financial sector, POS malware, social engineering\n- **Lazarus Group**: Financial institutions, cryptocurrency exchanges, destructive malware\n- **Conti\u002FRoyal**: Ransomware operators, double extortion, RaaS model\n\n## Workflow\n\n### Phase 1: Pre-Engagement\n\n1. Conduct initial scoping meeting with stakeholders\n2. Identify crown jewels and critical business assets\n3. Review previous security assessments and audit findings\n4. Define success criteria and engagement objectives\n5. Draft Rules of Engagement document\n\n### Phase 2: Threat Modeling\n\n1. Identify relevant threat actors using MITRE ATT&CK\n2. Map threat actor TTPs to organizational attack surface\n3. Select primary and secondary attack scenarios\n4. Define adversary emulation plan with specific technique IDs\n5. Establish detection checkpoints for purple team opportunities\n\n### Phase 3: Operational Planning\n\n1. Set up secure communication channels (encrypted email, Signal, etc.)\n2. Create operational security (OPSEC) guidelines for the red team\n3. Establish infrastructure requirements (C2 servers, redirectors, phishing domains)\n4. Develop phased attack timeline with go\u002Fno-go decision points\n5. Create deconfliction matrix with SOC\u002FIR team\n\n### Phase 4: Documentation and Approval\n\n1. Compile engagement plan document\n2. Review with legal counsel\n3. Obtain executive sponsor signature\n4. Brief red team operators on ROE and restrictions\n5. Distribute emergency contact cards\n\n## Tools and Resources\n\n- **MITRE ATT&CK Navigator**: Threat actor TTP mapping and visualization\n- **VECTR**: Red team engagement tracking and metrics platform\n- **Cobalt Strike \u002F Nighthawk**: C2 framework planning and infrastructure design\n- **PlexTrac**: Red team reporting and engagement management platform\n- **SCYTHE**: Adversary emulation platform for attack plan creation\n\n## Validation Criteria\n\n- [ ] Signed Rules of Engagement document\n- [ ] Defined scope with explicit in\u002Fout boundaries\n- [ ] Selected threat profile with mapped MITRE ATT&CK techniques\n- [ ] Emergency stop procedures tested and verified\n- [ ] Communication plan distributed to all stakeholders\n- [ ] Legal authorization obtained and filed\n- [ ] Red team operators briefed and acknowledged ROE\n\n## Common Pitfalls\n\n1. **Scope Creep**: Expanding testing beyond approved boundaries during execution\n2. **Inadequate Deconfliction**: SOC investigating red team activity as real incidents\n3. **Missing Legal Authorization**: Testing without proper signed authorization\n4. **Unrealistic Threat Models**: Simulating threats irrelevant to the organization\n5. **Poor Communication**: Failing to maintain contact with stakeholders during engagement\n\n## Related Skills\n\n- performing-open-source-intelligence-gathering\n- conducting-adversary-simulation-with-atomic-red-team\n- performing-assumed-breach-red-team-exercise\n- building-red-team-infrastructure-with-redirectors\n","# Executing Red Team Engagement Planning\n\n## Overview\n\nRed team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins. A well-structured engagement plan ensures the red team simulates realistic adversary behavior while maintaining safety guardrails that prevent unintended business disruption.\n\n\n## When to Use\n\n- When conducting security assessments that involve executing red team engagement planning\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Define clear engagement scope including in-scope and out-of-scope assets, networks, and personnel\n- Establish Rules of Engagement (ROE) with emergency stop procedures, communication channels, and legal boundaries\n- Select appropriate threat profiles from the MITRE ATT&CK framework aligned to the organization's threat landscape\n- Create a detailed attack plan mapping adversary TTPs to engagement objectives\n- Develop deconfliction procedures with the organization's SOC\u002Fblue team\n- Produce a comprehensive engagement brief for stakeholder approval\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Core Concepts\n\n### Engagement Types\n\n| Type | Description | Scope |\n|------|-------------|-------|\n| Full Scope | Complete adversary simulation with physical, social, and cyber vectors | Entire organization |\n| Assumed Breach | Starts from initial foothold, focuses on post-exploitation | Internal network |\n| Objective-Based | Target specific crown jewels (e.g., domain admin, PII exfiltration) | Defined targets |\n| Purple Team | Collaborative with blue team for detection improvement | Specific controls |\n\n### Rules of Engagement Components\n\n1. **Scope Definition**: IP ranges, domains, physical locations, personnel\n2. **Restrictions**: Systems\u002Fnetworks that must not be touched (e.g., production databases, medical devices)\n3. **Communication Plan**: Primary and secondary contact channels, escalation procedures\n4. **Emergency Procedures**: Code word for immediate cessation, incident response coordination\n5. **Legal Authorization**: Signed authorization letters, get-out-of-jail letters for physical tests\n6. **Data Handling**: How sensitive data discovered during testing will be handled and destroyed\n7. **Timeline**: Start\u002Fend dates, blackout windows, reporting deadlines\n\n### Threat Profile Selection\n\nMap organizational threats using MITRE ATT&CK Navigator to select relevant adversary profiles:\n\n- **APT29 (Cozy Bear)**: Government\u002Fdefense sector targeting via spearphishing, supply chain\n- **APT28 (Fancy Bear)**: Government organizations, credential harvesting, zero-days\n- **FIN7**: Financial sector, POS malware, social engineering\n- **Lazarus Group**: Financial institutions, cryptocurrency exchanges, destructive malware\n- **Conti\u002FRoyal**: Ransomware operators, double extortion, RaaS model\n\n## Workflow\n\n### Phase 1: Pre-Engagement\n\n1. Conduct initial scoping meeting with stakeholders\n2. Identify crown jewels and critical business assets\n3. Review previous security assessments and audit findings\n4. Define success criteria and engagement objectives\n5. Draft Rules of Engagement document\n\n### Phase 2: Threat Modeling\n\n1. Identify relevant threat actors using MITRE ATT&CK\n2. Map threat actor TTPs to organizational attack surface\n3. Select primary and secondary attack scenarios\n4. Define adversary emulation plan with specific technique IDs\n5. Establish detection checkpoints for purple team opportunities\n\n### Phase 3: Operational Planning\n\n1. Set up secure communication channels (encrypted email, Signal, etc.)\n2. Create operational security (OPSEC) guidelines for the red team\n3. Establish infrastructure requirements (C2 servers, redirectors, phishing domains)\n4. Develop phased attack timeline with go\u002Fno-go decision points\n5. Create deconfliction matrix with SOC\u002FIR team\n\n### Phase 4: Documentation and Approval\n\n1. Compile engagement plan document\n2. Review with legal counsel\n3. Obtain executive sponsor signature\n4. Brief red team operators on ROE and restrictions\n5. Distribute emergency contact cards\n\n## Tools and Resources\n\n- **MITRE ATT&CK Navigator**: Threat actor TTP mapping and visualization\n- **VECTR**: Red team engagement tracking and metrics platform\n- **Cobalt Strike \u002F Nighthawk**: C2 framework planning and infrastructure design\n- **PlexTrac**: Red team reporting and engagement management platform\n- **SCYTHE**: Adversary emulation platform for attack plan creation\n\n## Validation Criteria\n\n- [ ] Signed Rules of Engagement document\n- [ ] Defined scope with explicit in\u002Fout boundaries\n- [ ] Selected threat profile with mapped MITRE ATT&CK techniques\n- [ ] Emergency stop procedures tested and verified\n- [ ] Communication plan distributed to all stakeholders\n- [ ] Legal authorization obtained and filed\n- [ ] Red team operators briefed and acknowledged ROE\n\n## Common Pitfalls\n\n1. **Scope Creep**: Expanding testing beyond approved boundaries during execution\n2. **Inadequate Deconfliction**: SOC investigating red team activity as real incidents\n3. **Missing Legal Authorization**: Testing without proper signed authorization\n4. **Unrealistic Threat Models**: Simulating threats irrelevant to the organization\n5. **Poor Communication**: Failing to maintain contact with stakeholders during engagement\n\n## Related Skills\n\n- performing-open-source-intelligence-gathering\n- conducting-adversary-simulation-with-atomic-red-team\n- performing-assumed-breach-red-team-exercise\n- building-red-team-infrastructure-with-redirectors\n",{"name":5,"tags":52,"author":53,"domain":46,"license":15,"version":54,"nist_csf":55,"subdomain":59,"description":7,"mitre_attack":60},[42,30,40,36,41,32,31],"mahipal","1.0",[56,57,58],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[61,62,63,64],"T1595","T1190","T1059","T1078","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexecuting-red-team-engagement-planning",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill executing-red-team-engagement-planning",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill executing-red-team-engagement-planning",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill executing-red-team-engagement-planning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002FSKILL.md",true,[89,95,101,106,110,114,118,124],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"agents\u002Fopenai.yaml","REFERENCE","参考文档",97,"https:\u002F\u002Fgithub.com\u002Ftwaldin\u002Fdotfiles\u002Fblob\u002Fmain\u002Fagents\u002Fskills\u002Fwriting\u002Fagents\u002Fopenai.yaml",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"assets\u002Ftemplate.md","ASSET","资产文件",6830,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002Fassets\u002Ftemplate.md",{"path":102,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002FLICENSE",{"path":107,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md",2273,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fstandards.md",2798,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002Freferences\u002Fstandards.md",{"path":115,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fworkflows.md",6292,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002Freferences\u002Fworkflows.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",6072,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002Fscripts\u002Fagent.py",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fprocess.py",33525,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexecuting-red-team-engagement-planning\u002Fscripts\u002Fprocess.py",[129,156,180,204,230,256],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[135],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[137,138,139,140,141,46,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,141,167,46,144,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":188,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[174,189,190,191,39,46,192,193,168,194,195,196,197,198,199,34,200,201,202,203],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,46,215,216,217,218,219,220,221,222,223,224,225,226,171,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,46,241,28,242,243,244,245,246,247,248,249,250,251,252,253,254,255],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":257,"name":258,"nameZh":6,"description":259,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":260,"categories":261,"keywords":263,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[262],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[141,264,46,265,266,267,268,269,270,271,272,34,273,200,274,275,276,277,278,279],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]