[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AERHVY2APJW8V9SMBSXR92":3,"skill-same:01M6AERHVY2APJW8V9SMBSXR92":150},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AERHVY2APJW8V9SMBSXR92","extracting-config-from-agent-tesla-rat",null,"Extracts embedded configuration from Agent Tesla RAT samples, including SMTP\u002FFTP\u002FTelegram exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation and memory analysis. Use when analyzing a suspected or confirmed Agent Tesla sample and you need to recover its exfiltration channel and C2 configuration for threat intelligence or incident response.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"extracting config from agent tesla rat","config","config-extraction","keylogger","rat","agent-tesla","t1055","t1003","credential-theft","analyzing","exfiltration","memory","malware-analysis","c2","malware","extraction","dotnet","threat intelligence","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: extracting-config-from-agent-tesla-rat\ndescription: Extracts embedded configuration from Agent Tesla RAT samples, including\n  SMTP\u002FFTP\u002FTelegram exfiltration credentials, keylogger settings, and C2 endpoints,\n  via .NET decompilation and memory analysis. Use when analyzing a suspected or\n  confirmed Agent Tesla sample and you need to recover its exfiltration channel\n  and C2 configuration for threat intelligence or incident response.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- agent-tesla\n- rat\n- config-extraction\n- dotnet\n- malware-analysis\n- keylogger\n- credential-theft\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0056\n- AML.T0086\nnist_ai_rmf:\n- GOVERN-1.1\n- MEASURE-2.7\n- MANAGE-3.1\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T1003\n---\n# Extracting Config from Agent Tesla RAT\n\n## Overview\n\nAgent Tesla is a .NET-based Remote Access Trojan (RAT) and keylogger that ranked among the top 10 malware variants in 2024, impacting 6.3% of corporate networks globally. It exfiltrates stolen credentials via SMTP email, FTP upload, Telegram bot API, or Discord webhooks. The malware configuration is embedded in the .NET assembly, typically obfuscated using string encryption, resource encryption, or custom loaders that decrypt and execute Agent Tesla in memory via .NET Reflection (fileless). Configuration extraction involves decompiling the .NET assembly with dnSpy or ILSpy, identifying the decryption routine for configuration strings, and extracting SMTP server addresses, credentials, FTP endpoints, Telegram bot tokens, and targeted applications.\n\n\n## When to Use\n\n- When performing authorized security testing that involves extracting config from agent tesla rat\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- dnSpy or ILSpy for .NET decompilation\n- Python 3.9+ with `dnlib` or `pythonnet` for automated extraction\n- de4dot for .NET deobfuscation\n- Understanding of .NET IL code and Reflection\n- Sandbox for dynamic analysis (ANY.RUN, CAPE)\n\n## Workflow\n\n### Step 1: Deobfuscate and Extract Configuration\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Extract Agent Tesla RAT configuration from .NET assemblies.\"\"\"\nimport re\nimport sys\nimport json\nimport base64\nimport hashlib\nfrom pathlib import Path\n\n\ndef extract_strings_from_dotnet(filepath):\n    \"\"\"Extract readable strings from .NET binary for config analysis.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    # Extract US (User Strings) heap from .NET metadata\n    strings = []\n\n    # Look for common Agent Tesla config patterns\n    patterns = {\n        \"smtp_server\": re.compile(rb'smtp[\\.\\-][\\w\\.\\-]+\\.\\w{2,}', re.I),\n        \"email\": re.compile(rb'[\\w\\.\\-]+@[\\w\\.\\-]+\\.\\w{2,}'),\n        \"ftp_url\": re.compile(rb'ftp:\u002F\u002F[\\w\\.\\-:\u002F]+', re.I),\n        \"telegram_token\": re.compile(rb'\\d{8,10}:[A-Za-z0-9_-]{35}'),\n        \"telegram_chat\": re.compile(rb'(?:chat_id=|chatid[=:])[\\-]?\\d{5,15}', re.I),\n        \"discord_webhook\": re.compile(rb'https:\u002F\u002Fdiscord\\.com\u002Fapi\u002Fwebhooks\u002F\\d+\u002F[\\w-]+'),\n        \"password\": re.compile(rb'(?:pass(?:word)?|pwd)[=:]\\s*[\\w!@#$%^&*]{4,}', re.I),\n        \"port\": re.compile(rb'(?:port|smtp_port)[=:]\\s*\\d{2,5}', re.I),\n    }\n\n    results = {}\n    for name, pattern in patterns.items():\n        matches = pattern.findall(data)\n        if matches:\n            results[name] = [m.decode('utf-8', errors='replace') for m in matches]\n\n    # Extract Base64-encoded strings (common obfuscation)\n    b64_pattern = re.compile(rb'[A-Za-z0-9+\u002F]{20,}={0,2}')\n    b64_decoded = []\n    for match in b64_pattern.finditer(data):\n        try:\n            decoded = base64.b64decode(match.group())\n            text = decoded.decode('utf-8', errors='strict')\n            if text.isprintable() and len(text) > 5:\n                b64_decoded.append(text)\n        except Exception:\n            pass\n\n    if b64_decoded:\n        results[\"base64_decoded_strings\"] = b64_decoded[:30]\n\n    return results\n\n\ndef decrypt_agenttesla_strings(data, key_hex):\n    \"\"\"Decrypt Agent Tesla encrypted configuration strings.\"\"\"\n    key = bytes.fromhex(key_hex)\n    # Agent Tesla V1: Simple XOR with key\n    decrypted_strings = []\n\n    # Find encrypted blobs (high-entropy byte sequences)\n    blob_pattern = re.compile(rb'[\\x80-\\xff]{16,256}')\n    for match in blob_pattern.finditer(data):\n        blob = match.group()\n        # Try XOR decryption\n        decrypted = bytes(b ^ key[i % len(key)] for i, b in enumerate(blob))\n        try:\n            text = decrypted.decode('utf-8', errors='strict')\n            if text.isprintable() and len(text.strip()) > 3:\n                decrypted_strings.append(text.strip())\n        except UnicodeDecodeError:\n            pass\n\n    # V2: SHA256-based key derivation then AES\n    sha256_key = hashlib.sha256(key).digest()\n\n    return decrypted_strings\n\n\ndef analyze_exfiltration_config(config):\n    \"\"\"Analyze extracted configuration for exfiltration methods.\"\"\"\n    methods = []\n\n    if config.get(\"smtp_server\"):\n        methods.append({\n            \"type\": \"SMTP\",\n            \"servers\": config[\"smtp_server\"],\n            \"emails\": config.get(\"email\", []),\n        })\n\n    if config.get(\"ftp_url\"):\n        methods.append({\n            \"type\": \"FTP\",\n            \"urls\": config[\"ftp_url\"],\n        })\n\n    if config.get(\"telegram_token\"):\n        methods.append({\n            \"type\": \"Telegram\",\n            \"tokens\": config[\"telegram_token\"],\n            \"chat_ids\": config.get(\"telegram_chat\", []),\n        })\n\n    if config.get(\"discord_webhook\"):\n        methods.append({\n            \"type\": \"Discord\",\n            \"webhooks\": config[\"discord_webhook\"],\n        })\n\n    return methods\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cagent_tesla_sample>\")\n        sys.exit(1)\n\n    config = extract_strings_from_dotnet(sys.argv[1])\n    methods = analyze_exfiltration_config(config)\n\n    report = {\"raw_config\": config, \"exfiltration_methods\": methods}\n    print(json.dumps(report, indent=2))\n```\n\n## Validation Criteria\n\n- Exfiltration method identified (SMTP\u002FFTP\u002FTelegram\u002FDiscord)\n- Server addresses and credentials extracted from config\n- Targeted applications list recovered\n- Keylogger and screenshot capture settings documented\n- Persistence mechanism identified\n- IOCs suitable for network blocking extracted\n\n## References\n\n- [Splunk - Agent Tesla Detection and Analysis](https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fblog\u002Fsecurity\u002Finside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html)\n- [Qualys - Catching the RAT Agent Tesla](https:\u002F\u002Fblog.qualys.com\u002Fvulnerabilities-threat-research\u002F2022\u002F02\u002F02\u002Fcatching-the-rat-called-agent-tesla)\n- [ANY.RUN Agent Tesla Analysis](https:\u002F\u002Fany.run\u002Fmalware-trends\u002Fagenttesla\u002F)\n- [Trustwave - Agent Tesla Novel Loader](https:\u002F\u002Fwww.trustwave.com\u002Fen-us\u002Fresources\u002Fblogs\u002Fspiderlabs-blog\u002Fagent-teslas-new-ride-the-rise-of-a-novel-loader\u002F)\n- [Malpedia - Agent Tesla](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Fdetails\u002Fwin.agent_tesla)\n","# Extracting Config from Agent Tesla RAT\n\n## Overview\n\nAgent Tesla is a .NET-based Remote Access Trojan (RAT) and keylogger that ranked among the top 10 malware variants in 2024, impacting 6.3% of corporate networks globally. It exfiltrates stolen credentials via SMTP email, FTP upload, Telegram bot API, or Discord webhooks. The malware configuration is embedded in the .NET assembly, typically obfuscated using string encryption, resource encryption, or custom loaders that decrypt and execute Agent Tesla in memory via .NET Reflection (fileless). Configuration extraction involves decompiling the .NET assembly with dnSpy or ILSpy, identifying the decryption routine for configuration strings, and extracting SMTP server addresses, credentials, FTP endpoints, Telegram bot tokens, and targeted applications.\n\n\n## When to Use\n\n- When performing authorized security testing that involves extracting config from agent tesla rat\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- dnSpy or ILSpy for .NET decompilation\n- Python 3.9+ with `dnlib` or `pythonnet` for automated extraction\n- de4dot for .NET deobfuscation\n- Understanding of .NET IL code and Reflection\n- Sandbox for dynamic analysis (ANY.RUN, CAPE)\n\n## Workflow\n\n### Step 1: Deobfuscate and Extract Configuration\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Extract Agent Tesla RAT configuration from .NET assemblies.\"\"\"\nimport re\nimport sys\nimport json\nimport base64\nimport hashlib\nfrom pathlib import Path\n\n\ndef extract_strings_from_dotnet(filepath):\n    \"\"\"Extract readable strings from .NET binary for config analysis.\"\"\"\n    with open(filepath, 'rb') as f:\n        data = f.read()\n\n    # Extract US (User Strings) heap from .NET metadata\n    strings = []\n\n    # Look for common Agent Tesla config patterns\n    patterns = {\n        \"smtp_server\": re.compile(rb'smtp[\\.\\-][\\w\\.\\-]+\\.\\w{2,}', re.I),\n        \"email\": re.compile(rb'[\\w\\.\\-]+@[\\w\\.\\-]+\\.\\w{2,}'),\n        \"ftp_url\": re.compile(rb'ftp:\u002F\u002F[\\w\\.\\-:\u002F]+', re.I),\n        \"telegram_token\": re.compile(rb'\\d{8,10}:[A-Za-z0-9_-]{35}'),\n        \"telegram_chat\": re.compile(rb'(?:chat_id=|chatid[=:])[\\-]?\\d{5,15}', re.I),\n        \"discord_webhook\": re.compile(rb'https:\u002F\u002Fdiscord\\.com\u002Fapi\u002Fwebhooks\u002F\\d+\u002F[\\w-]+'),\n        \"password\": re.compile(rb'(?:pass(?:word)?|pwd)[=:]\\s*[\\w!@#$%^&*]{4,}', re.I),\n        \"port\": re.compile(rb'(?:port|smtp_port)[=:]\\s*\\d{2,5}', re.I),\n    }\n\n    results = {}\n    for name, pattern in patterns.items():\n        matches = pattern.findall(data)\n        if matches:\n            results[name] = [m.decode('utf-8', errors='replace') for m in matches]\n\n    # Extract Base64-encoded strings (common obfuscation)\n    b64_pattern = re.compile(rb'[A-Za-z0-9+\u002F]{20,}={0,2}')\n    b64_decoded = []\n    for match in b64_pattern.finditer(data):\n        try:\n            decoded = base64.b64decode(match.group())\n            text = decoded.decode('utf-8', errors='strict')\n            if text.isprintable() and len(text) > 5:\n                b64_decoded.append(text)\n        except Exception:\n            pass\n\n    if b64_decoded:\n        results[\"base64_decoded_strings\"] = b64_decoded[:30]\n\n    return results\n\n\ndef decrypt_agenttesla_strings(data, key_hex):\n    \"\"\"Decrypt Agent Tesla encrypted configuration strings.\"\"\"\n    key = bytes.fromhex(key_hex)\n    # Agent Tesla V1: Simple XOR with key\n    decrypted_strings = []\n\n    # Find encrypted blobs (high-entropy byte sequences)\n    blob_pattern = re.compile(rb'[\\x80-\\xff]{16,256}')\n    for match in blob_pattern.finditer(data):\n        blob = match.group()\n        # Try XOR decryption\n        decrypted = bytes(b ^ key[i % len(key)] for i, b in enumerate(blob))\n        try:\n            text = decrypted.decode('utf-8', errors='strict')\n            if text.isprintable() and len(text.strip()) > 3:\n                decrypted_strings.append(text.strip())\n        except UnicodeDecodeError:\n            pass\n\n    # V2: SHA256-based key derivation then AES\n    sha256_key = hashlib.sha256(key).digest()\n\n    return decrypted_strings\n\n\ndef analyze_exfiltration_config(config):\n    \"\"\"Analyze extracted configuration for exfiltration methods.\"\"\"\n    methods = []\n\n    if config.get(\"smtp_server\"):\n        methods.append({\n            \"type\": \"SMTP\",\n            \"servers\": config[\"smtp_server\"],\n            \"emails\": config.get(\"email\", []),\n        })\n\n    if config.get(\"ftp_url\"):\n        methods.append({\n            \"type\": \"FTP\",\n            \"urls\": config[\"ftp_url\"],\n        })\n\n    if config.get(\"telegram_token\"):\n        methods.append({\n            \"type\": \"Telegram\",\n            \"tokens\": config[\"telegram_token\"],\n            \"chat_ids\": config.get(\"telegram_chat\", []),\n        })\n\n    if config.get(\"discord_webhook\"):\n        methods.append({\n            \"type\": \"Discord\",\n            \"webhooks\": config[\"discord_webhook\"],\n        })\n\n    return methods\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cagent_tesla_sample>\")\n        sys.exit(1)\n\n    config = extract_strings_from_dotnet(sys.argv[1])\n    methods = analyze_exfiltration_config(config)\n\n    report = {\"raw_config\": config, \"exfiltration_methods\": methods}\n    print(json.dumps(report, indent=2))\n```\n\n## Validation Criteria\n\n- Exfiltration method identified (SMTP\u002FFTP\u002FTelegram\u002FDiscord)\n- Server addresses and credentials extracted from config\n- Targeted applications list recovered\n- Keylogger and screenshot capture settings documented\n- Persistence mechanism identified\n- IOCs suitable for network blocking extracted\n\n## References\n\n- [Splunk - Agent Tesla Detection and Analysis](https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fblog\u002Fsecurity\u002Finside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html)\n- [Qualys - Catching the RAT Agent Tesla](https:\u002F\u002Fblog.qualys.com\u002Fvulnerabilities-threat-research\u002F2022\u002F02\u002F02\u002Fcatching-the-rat-called-agent-tesla)\n- [ANY.RUN Agent Tesla Analysis](https:\u002F\u002Fany.run\u002Fmalware-trends\u002Fagenttesla\u002F)\n- [Trustwave - Agent Tesla Novel Loader](https:\u002F\u002Fwww.trustwave.com\u002Fen-us\u002Fresources\u002Fblogs\u002Fspiderlabs-blog\u002Fagent-teslas-new-ride-the-rise-of-a-novel-loader\u002F)\n- [Malpedia - Agent Tesla](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Fdetails\u002Fwin.agent_tesla)\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":36,"description":7,"nist_ai_rmf":57,"mitre_attack":61,"atlas_techniques":67},[29,28,26,40,36,27,32],"mahipal","1.0",[53,54,55,56],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[58,59,60],"GOVERN-1.1","MEASURE-2.7","MANAGE-3.1",[62,63,64,65,66],"T1027","T1055","T1140","T1497","T1003",[68,69,70],"AML.T0024","AML.T0056","AML.T0086","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fextracting-config-from-agent-tesla-rat",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill extracting-config-from-agent-tesla-rat",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill extracting-config-from-agent-tesla-rat",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill extracting-config-from-agent-tesla-rat","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002FSKILL.md",true,[95,101,106,112,116,120,124,128,132,136,140,144],{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"assets\u002Ftemplate.md","ASSET","资产文件",419,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002Fassets\u002Ftemplate.md",{"path":102,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002FLICENSE",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fadditional_features.md","REFERENCE","参考文档",10119,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fprotocolsio-integration\u002Freferences\u002Fadditional_features.md",{"path":113,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fapi-reference.md",2295,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002Freferences\u002Fapi-reference.md",{"path":117,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fauthentication.md",3374,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fprotocolsio-integration\u002Freferences\u002Fauthentication.md",{"path":121,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fdiscussions.md",6915,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fprotocolsio-integration\u002Freferences\u002Fdiscussions.md",{"path":125,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":126,"sourceHtmlUrl":127},"references\u002Ffile_manager.md",11036,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fprotocolsio-integration\u002Freferences\u002Ffile_manager.md",{"path":129,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":130,"sourceHtmlUrl":131},"references\u002Fprotocols_api.md",7937,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fprotocolsio-integration\u002Freferences\u002Fprotocols_api.md",{"path":133,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":134,"sourceHtmlUrl":135},"references\u002Fstandards.md",307,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002Freferences\u002Fstandards.md",{"path":137,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":138,"sourceHtmlUrl":139},"references\u002Fworkflows.md",466,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002Freferences\u002Fworkflows.md",{"path":141,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":142,"sourceHtmlUrl":143},"references\u002Fworkspaces.md",8098,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fprotocolsio-integration\u002Freferences\u002Fworkspaces.md",{"path":145,"resourceType":146,"resourceTypeDesc":147,"sizeBytes":148,"sourceHtmlUrl":149},"scripts\u002Fagent.py","SCRIPT","脚本",5640,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fextracting-config-from-agent-tesla-rat\u002Fscripts\u002Fagent.py",[151,177,201,229,255,282],{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[157],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,160,161,162,163,43,42,164,165,166,167,168,169,170,171,172,173,174,175,176],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[185,173,186,187,163,188,43,165,189,190,191,192,193,194,195,196,197,198,199,200],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":211,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[207,210],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,212,213,214,215,43,216,217,189,218,219,220,221,222,223,224,225,226,227,228],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":230,"name":231,"nameZh":6,"description":232,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":233,"categories":234,"keywords":236,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[235],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[237,238,239,43,240,241,242,243,244,245,246,247,248,249,250,251,192,252,253,254],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[261],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[263,264,265,43,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":283,"name":284,"nameZh":6,"description":285,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":286,"categories":287,"keywords":289,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[288],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[163,290,43,291,292,293,294,295,296,297,298,224,299,225,300,301,302,303,304,305],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]