[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AES43T4HEP7358DGPPMTRZ":3,"skill-same:01M6AES43T4HEP7358DGPPMTRZ":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AES43T4HEP7358DGPPMTRZ","fleet-hunting-with-velociraptor",null,"Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged\u002Fair-gapped hosts.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"fleet hunting with velociraptor","dfir","fleet-collection","endpoint-visibility","vql","velociraptor","t1059","endpoint","digital-forensics","incident-response","cybersecurity","threat-hunting","forensics","server","offline","artifacts","run","deploy","incident response","2026-11-10 10:12:30",false,"---\nname: fleet-hunting-with-velociraptor\ndescription: Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged\u002Fair-gapped hosts.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- velociraptor\n- vql\n- dfir\n- endpoint-visibility\n- incident-response\n- fleet-collection\n- digital-forensics\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1059\n---\n# Fleet Hunting with Velociraptor\n\n> **Authorized Use Only:** Velociraptor agents provide deep endpoint visibility and remote collection. Deploy only on assets you own or are authorized to monitor, in accordance with your monitoring policy and applicable law.\n\n## Overview\n\nVelociraptor is an open-source endpoint visibility and digital-forensics platform from Rapid7\u002FVelocidex. A single Go binary acts as server, client (agent), and CLI depending on how it is invoked and configured. Its power comes from **VQL (Velociraptor Query Language)** — an SQL-like language whose plugins query the live state of an endpoint (processes, files, registry, event logs, WMI, network connections, prefetch, etc.). VQL queries are packaged into reusable **Artifacts**, and Artifacts are run at scale as **Hunts** that fan out across every connected client and stream results back to the server as structured rows.\n\nThis makes Velociraptor ideal for fleet-wide threat hunting: a hypothesis (\"are any hosts running suspicious PowerShell?\") becomes a VQL artifact, deployed as a hunt, with results aggregated centrally in minutes. It also supports offline collectors (standalone executables that collect and bundle artifacts on air-gapped or unmanaged hosts) and live forensic notebooks.\n\n## When to Use\n\n- Hunting for a TTP across hundreds or thousands of endpoints from a single console.\n- Collecting forensic artifacts on demand during incident response without re-imaging.\n- Continuously monitoring for an indicator using client-side event artifacts.\n- Generating standalone offline collectors for hosts you cannot enroll.\n\n## Prerequisites\n\n- A Linux or Windows host for the server (Linux recommended for production).\n- The Velociraptor binary from the official release page: https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor\u002Freleases\n- Outbound\u002Finbound connectivity from clients to the server frontend port (default 8000) and admin GUI (default 8889).\n- Make the binary executable on Linux:\n  ```bash\n  chmod +x velociraptor-v0.*-linux-amd64\n  sudo mv velociraptor-v0.*-linux-amd64 \u002Fusr\u002Flocal\u002Fbin\u002Fvelociraptor\n  ```\n\n## Objectives\n\n- Generate server and client configurations.\n- Run the server frontend and admin GUI.\n- Enroll clients across the fleet.\n- Author and test VQL hunts.\n- Launch a fleet-wide hunt and collect results.\n- Produce an offline collector for unmanaged hosts.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Technique Name | Relevance to this skill |\n|----|------------------------|--------------------------|\n| T1059 | Command and Scripting Interpreter | A primary hunt target — VQL artifacts surface anomalous interpreter execution (PowerShell, cmd, wscript) across the fleet for detection and triage. |\n\nVelociraptor is a defensive hunting platform; the mapping reflects the adversary behavior the hunts are designed to detect.\n\n## Workflow\n\n### 1. Generate the server configuration\nThe interactive generator writes a server config (TLS, datastore paths, GUI users, frontend URL). Use `config generate` for a self-signed lab build or the interactive `-i` wizard for production.\n```bash\n# Non-interactive: dump a default server config\nvelociraptor config generate > server.config.yaml\n\n# Interactive wizard (recommended for production deployments)\nvelociraptor config generate -i\n```\n\n### 2. Add a GUI admin user\nCreate at least one administrator to log into the console.\n```bash\nvelociraptor --config server.config.yaml user add admin --role administrator\n```\n\n### 3. Start the server frontend and GUI\nThe frontend accepts client connections; the GUI is served per the config (default https:\u002F\u002F127.0.0.1:8889).\n```bash\nvelociraptor --config server.config.yaml frontend -v\n```\nFor a quick all-in-one local lab (server + frontend + a local client in one process):\n```bash\nvelociraptor gui\n```\n\n### 4. Generate the client configuration and deploy agents\nDerive the client config from the server config and run it as the client on each endpoint.\n```bash\n# Produce the client config (embeds server URL + CA)\nvelociraptor --config server.config.yaml config client > client.config.yaml\n\n# On a Linux endpoint, run as a client (or install as a service)\nvelociraptor --config client.config.yaml client -v\n```\nOn Windows, build an MSI\u002Fservice installer from the GUI (\"Server Artifacts\" > deployment) or run:\n```cmd\nvelociraptor.exe --config client.config.yaml service install\n```\n\n### 5. Test VQL interactively before hunting\nValidate a query locally with `query` (`-q`) before deploying it fleet-wide. VQL is SQL-like: `SELECT ... FROM plugin(...) WHERE ...`.\n```bash\n# List running processes with their command lines\nvelociraptor query \"SELECT Pid, Name, CommandLine FROM pslist()\"\n\n# Hunt for suspicious PowerShell command lines\nvelociraptor query \"\nSELECT Pid, Name, CommandLine\nFROM pslist()\nWHERE Name =~ 'powershell'\n  AND CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|-w hidden|iex)'\n\"\n```\n\n### 6. List and run a built-in artifact\nArtifacts wrap VQL into reusable, parameterized collections.\n```bash\n# Show available artifacts\nvelociraptor artifacts list\n\n# Collect a built-in artifact and write results to a directory\nvelociraptor artifacts collect Windows.System.Pslist --output results.zip\n```\n\n### 7. Launch a fleet-wide hunt (GUI workflow)\nIn the GUI: **Hunt Manager** > **New Hunt** > select the artifact (e.g. `Windows.Detection.Powershell` or a custom one) and parameters > **Launch**. The hunt fans out to every matching client; results stream into the hunt's results table and can be exported as CSV\u002FJSON. Equivalent server-side VQL:\n```sql\n-- Create a hunt programmatically via a server VQL notebook\nSELECT hunt(\n    description=\"Suspicious PowerShell fleet sweep\",\n    artifacts=\"Windows.Detection.Powershell\"\n) FROM scope()\n```\n\n### 8. Build a custom artifact\nCustom artifacts are YAML documents containing parameters and VQL `sources`. Save in the GUI's Artifact editor or import via `artifacts`:\n```yaml\nname: Custom.Hunt.SuspiciousPowershell\ndescription: Find encoded \u002F download-cradle PowerShell across the fleet.\nparameters:\n  - name: regex\n    default: \"(?i)(-enc|frombase64string|downloadstring|-w hidden|iex)\"\nsources:\n  - query: |\n      SELECT Pid, Name, CommandLine, timestamp(epoch=now()) AS Collected\n      FROM pslist()\n      WHERE Name =~ \"powershell\" AND CommandLine =~ regex\n```\n\n### 9. Generate an offline collector\nFor unmanaged\u002Fair-gapped hosts, build a standalone collector from the GUI (\"Server Artifacts\" > `Server.Utils.CreateCollector`) or via VQL; it produces a single executable that collects chosen artifacts into a ZIP for later import.\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| Velociraptor releases | Official binaries | https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor\u002Freleases |\n| Documentation | Deployment, VQL, artifacts | https:\u002F\u002Fdocs.velociraptor.app\u002F |\n| VQL reference | Plugin\u002Ffunction reference | https:\u002F\u002Fdocs.velociraptor.app\u002Fvql_reference\u002F |\n| Artifact Exchange | Community artifacts | https:\u002F\u002Fdocs.velociraptor.app\u002Fexchange\u002F |\n| Source | GitHub repository | https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor |\n\n## Key Commands\n\n| Command | Purpose |\n|---------|---------|\n| `config generate [-i]` | Create server config (interactive optional) |\n| `config client` | Derive client config from server config |\n| `user add \u003Cname> --role administrator` | Add a GUI admin |\n| `frontend -v` | Start server frontend (client comms + GUI) |\n| `gui` | All-in-one local lab instance |\n| `client -v` | Run as an endpoint agent |\n| `service install` | Install the agent as a service |\n| `query \"\u003CVQL>\"` | Run VQL ad hoc |\n| `artifacts list` | List available artifacts |\n| `artifacts collect \u003Cname> --output \u003Czip>` | Collect an artifact locally |\n\n## Validation Criteria\n\n- [ ] Server config generated and GUI admin created\n- [ ] Frontend running and GUI reachable over TLS\n- [ ] Client config generated and at least one agent enrolled\n- [ ] VQL query validated locally with `query`\n- [ ] Built-in artifact collected successfully\n- [ ] Fleet-wide hunt launched and results aggregated\n- [ ] Custom VQL artifact authored and tested\n- [ ] Offline collector produced for unmanaged hosts where needed\n","# Fleet Hunting with Velociraptor\n\n> **Authorized Use Only:** Velociraptor agents provide deep endpoint visibility and remote collection. Deploy only on assets you own or are authorized to monitor, in accordance with your monitoring policy and applicable law.\n\n## Overview\n\nVelociraptor is an open-source endpoint visibility and digital-forensics platform from Rapid7\u002FVelocidex. A single Go binary acts as server, client (agent), and CLI depending on how it is invoked and configured. Its power comes from **VQL (Velociraptor Query Language)** — an SQL-like language whose plugins query the live state of an endpoint (processes, files, registry, event logs, WMI, network connections, prefetch, etc.). VQL queries are packaged into reusable **Artifacts**, and Artifacts are run at scale as **Hunts** that fan out across every connected client and stream results back to the server as structured rows.\n\nThis makes Velociraptor ideal for fleet-wide threat hunting: a hypothesis (\"are any hosts running suspicious PowerShell?\") becomes a VQL artifact, deployed as a hunt, with results aggregated centrally in minutes. It also supports offline collectors (standalone executables that collect and bundle artifacts on air-gapped or unmanaged hosts) and live forensic notebooks.\n\n## When to Use\n\n- Hunting for a TTP across hundreds or thousands of endpoints from a single console.\n- Collecting forensic artifacts on demand during incident response without re-imaging.\n- Continuously monitoring for an indicator using client-side event artifacts.\n- Generating standalone offline collectors for hosts you cannot enroll.\n\n## Prerequisites\n\n- A Linux or Windows host for the server (Linux recommended for production).\n- The Velociraptor binary from the official release page: https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor\u002Freleases\n- Outbound\u002Finbound connectivity from clients to the server frontend port (default 8000) and admin GUI (default 8889).\n- Make the binary executable on Linux:\n  ```bash\n  chmod +x velociraptor-v0.*-linux-amd64\n  sudo mv velociraptor-v0.*-linux-amd64 \u002Fusr\u002Flocal\u002Fbin\u002Fvelociraptor\n  ```\n\n## Objectives\n\n- Generate server and client configurations.\n- Run the server frontend and admin GUI.\n- Enroll clients across the fleet.\n- Author and test VQL hunts.\n- Launch a fleet-wide hunt and collect results.\n- Produce an offline collector for unmanaged hosts.\n\n## MITRE ATT&CK Mapping\n\n| ID | Official Technique Name | Relevance to this skill |\n|----|------------------------|--------------------------|\n| T1059 | Command and Scripting Interpreter | A primary hunt target — VQL artifacts surface anomalous interpreter execution (PowerShell, cmd, wscript) across the fleet for detection and triage. |\n\nVelociraptor is a defensive hunting platform; the mapping reflects the adversary behavior the hunts are designed to detect.\n\n## Workflow\n\n### 1. Generate the server configuration\nThe interactive generator writes a server config (TLS, datastore paths, GUI users, frontend URL). Use `config generate` for a self-signed lab build or the interactive `-i` wizard for production.\n```bash\n# Non-interactive: dump a default server config\nvelociraptor config generate > server.config.yaml\n\n# Interactive wizard (recommended for production deployments)\nvelociraptor config generate -i\n```\n\n### 2. Add a GUI admin user\nCreate at least one administrator to log into the console.\n```bash\nvelociraptor --config server.config.yaml user add admin --role administrator\n```\n\n### 3. Start the server frontend and GUI\nThe frontend accepts client connections; the GUI is served per the config (default https:\u002F\u002F127.0.0.1:8889).\n```bash\nvelociraptor --config server.config.yaml frontend -v\n```\nFor a quick all-in-one local lab (server + frontend + a local client in one process):\n```bash\nvelociraptor gui\n```\n\n### 4. Generate the client configuration and deploy agents\nDerive the client config from the server config and run it as the client on each endpoint.\n```bash\n# Produce the client config (embeds server URL + CA)\nvelociraptor --config server.config.yaml config client > client.config.yaml\n\n# On a Linux endpoint, run as a client (or install as a service)\nvelociraptor --config client.config.yaml client -v\n```\nOn Windows, build an MSI\u002Fservice installer from the GUI (\"Server Artifacts\" > deployment) or run:\n```cmd\nvelociraptor.exe --config client.config.yaml service install\n```\n\n### 5. Test VQL interactively before hunting\nValidate a query locally with `query` (`-q`) before deploying it fleet-wide. VQL is SQL-like: `SELECT ... FROM plugin(...) WHERE ...`.\n```bash\n# List running processes with their command lines\nvelociraptor query \"SELECT Pid, Name, CommandLine FROM pslist()\"\n\n# Hunt for suspicious PowerShell command lines\nvelociraptor query \"\nSELECT Pid, Name, CommandLine\nFROM pslist()\nWHERE Name =~ 'powershell'\n  AND CommandLine =~ '(?i)(-enc|frombase64string|downloadstring|-w hidden|iex)'\n\"\n```\n\n### 6. List and run a built-in artifact\nArtifacts wrap VQL into reusable, parameterized collections.\n```bash\n# Show available artifacts\nvelociraptor artifacts list\n\n# Collect a built-in artifact and write results to a directory\nvelociraptor artifacts collect Windows.System.Pslist --output results.zip\n```\n\n### 7. Launch a fleet-wide hunt (GUI workflow)\nIn the GUI: **Hunt Manager** > **New Hunt** > select the artifact (e.g. `Windows.Detection.Powershell` or a custom one) and parameters > **Launch**. The hunt fans out to every matching client; results stream into the hunt's results table and can be exported as CSV\u002FJSON. Equivalent server-side VQL:\n```sql\n-- Create a hunt programmatically via a server VQL notebook\nSELECT hunt(\n    description=\"Suspicious PowerShell fleet sweep\",\n    artifacts=\"Windows.Detection.Powershell\"\n) FROM scope()\n```\n\n### 8. Build a custom artifact\nCustom artifacts are YAML documents containing parameters and VQL `sources`. Save in the GUI's Artifact editor or import via `artifacts`:\n```yaml\nname: Custom.Hunt.SuspiciousPowershell\ndescription: Find encoded \u002F download-cradle PowerShell across the fleet.\nparameters:\n  - name: regex\n    default: \"(?i)(-enc|frombase64string|downloadstring|-w hidden|iex)\"\nsources:\n  - query: |\n      SELECT Pid, Name, CommandLine, timestamp(epoch=now()) AS Collected\n      FROM pslist()\n      WHERE Name =~ \"powershell\" AND CommandLine =~ regex\n```\n\n### 9. Generate an offline collector\nFor unmanaged\u002Fair-gapped hosts, build a standalone collector from the GUI (\"Server Artifacts\" > `Server.Utils.CreateCollector`) or via VQL; it produces a single executable that collects chosen artifacts into a ZIP for later import.\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| Velociraptor releases | Official binaries | https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor\u002Freleases |\n| Documentation | Deployment, VQL, artifacts | https:\u002F\u002Fdocs.velociraptor.app\u002F |\n| VQL reference | Plugin\u002Ffunction reference | https:\u002F\u002Fdocs.velociraptor.app\u002Fvql_reference\u002F |\n| Artifact Exchange | Community artifacts | https:\u002F\u002Fdocs.velociraptor.app\u002Fexchange\u002F |\n| Source | GitHub repository | https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor |\n\n## Key Commands\n\n| Command | Purpose |\n|---------|---------|\n| `config generate [-i]` | Create server config (interactive optional) |\n| `config client` | Derive client config from server config |\n| `user add \u003Cname> --role administrator` | Add a GUI admin |\n| `frontend -v` | Start server frontend (client comms + GUI) |\n| `gui` | All-in-one local lab instance |\n| `client -v` | Run as an endpoint agent |\n| `service install` | Install the agent as a service |\n| `query \"\u003CVQL>\"` | Run VQL ad hoc |\n| `artifacts list` | List available artifacts |\n| `artifacts collect \u003Cname> --output \u003Czip>` | Collect an artifact locally |\n\n## Validation Criteria\n\n- [ ] Server config generated and GUI admin created\n- [ ] Frontend running and GUI reachable over TLS\n- [ ] Client config generated and at least one agent enrolled\n- [ ] VQL query validated locally with `query`\n- [ ] Built-in artifact collected successfully\n- [ ] Fleet-wide hunt launched and results aggregated\n- [ ] Custom VQL artifact authored and tested\n- [ ] Offline collector produced for unmanaged hosts where needed\n",{"name":5,"tags":51,"author":52,"domain":37,"license":15,"version":53,"nist_csf":54,"subdomain":38,"description":7,"mitre_attack":56},[38,32,31,28,30,36,29,35],"mahipal","1.0",[55],"DE.CM-01",[57],"T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ffleet-hunting-with-velociraptor",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill fleet-hunting-with-velociraptor",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill fleet-hunting-with-velociraptor",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill fleet-hunting-with-velociraptor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002FSKILL.md",true,[82,87,93,97],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi-reference.md","REFERENCE","参考文档",2515,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002Freferences\u002Fapi-reference.md",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fstandards.md",1051,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002Freferences\u002Fstandards.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",5385,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ffleet-hunting-with-velociraptor\u002Fscripts\u002Fagent.py",[104,129,153,180,204,231],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,116,37,45,117,118,119,42,120,121,122,123,124,125,126,127,128],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[135],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[137,125,138,139,116,140,37,118,141,142,143,144,145,146,147,148,149,150,151,152],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":163,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[159,162],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[147,164,165,166,167,37,168,169,141,170,171,36,172,173,174,175,176,177,178,179],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[186],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,190,37,191,192,193,194,28,195,196,197,198,199,35,200,144,201,202,203],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[210],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,37,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[237],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,239,37,240,241,242,243,244,245,246,247,175,248,176,249,250,251,252,253,254],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]