[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AESBB6VEKMFQAAB5J3Z4YY":3,"skill-same:01M6AESBB6VEKMFQAAB5J3Z4YY":115},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AESBB6VEKMFQAAB5J3Z4YY","generating-forensic-timelines-with-hayabusa",null,"Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV\u002FJSON timeline with severity levels, MITRE ATT&CK mappings, and per-host\u002Fper-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"generating forensic timelines with hayabusa","hayabusa","T1059.001","t1059","windows-event-logs","ATT&CK","severity","sigma","digital-forensics","event-logs","cybersecurity","dfir","threat-hunting","csv","logs","produce","metrics","run","windows","siem","2026-11-10 10:12:30",false,"---\nname: generating-forensic-timelines-with-hayabusa\ndescription: Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV\u002FJSON timeline with severity levels, MITRE ATT&CK mappings, and per-host\u002Fper-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- hayabusa\n- dfir\n- evtx\n- sigma\n- timeline\n- threat-hunting\n- windows-event-logs\n- forensics\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\nmitre_attack:\n- T1059.001\n---\n# Generating Forensic Timelines with Hayabusa\n\n## Overview\n\nHayabusa (隼, Japanese for \"peregrine falcon\") is a Sigma-based threat-hunting and fast-forensics timeline generator for Windows event logs, developed by Yamato Security in Rust. It parses `.evtx` files (offline or via live analysis of a local host), applies a large built-in library of Sigma detection rules plus Hayabusa-specific rules, and produces a single, readable, chronological timeline of high-signal events with severity levels, MITRE ATT&CK tactics, and rule references. This collapses thousands of raw event-log records into a prioritized incident timeline that an analyst can review quickly.\n\nHayabusa is purpose-built for DFIR triage. Instead of loading EVTX into a SIEM, an investigator runs a single binary against a directory of collected logs and gets a CSV or JSON timeline plus metrics (events per computer, per Event ID, per channel). Because detections are Sigma-based, coverage tracks the open detection-engineering community, and rules can be updated on demand with `update-rules`. The tool's output integrates with downstream analysis: CSV opens in Timeline Explorer, JSONL feeds into `jq`, and `timesketch-*` profiles export directly into Timesketch.\n\nA frequent finding in Hayabusa timelines is malicious PowerShell — MITRE ATT&CK **T1059.001 (Command and Scripting Interpreter: PowerShell)** — surfaced via Sigma rules over Event ID 4104 (script-block logging), 4103, and Sysmon process creation. This skill maps to NIST CSF **RS.AN-03** (analysis is performed to establish what has taken place during an incident).\n\n## When to Use\n\n- During incident-response triage, to turn a pile of collected `.evtx` files into a prioritized timeline.\n- When you need fast, SIEM-free detection over Windows event logs with community Sigma coverage.\n- To enumerate suspicious activity (PowerShell, account changes, lateral movement) across many hosts' logs.\n- To produce metrics (events per computer\u002FEvent ID\u002Fchannel) and pivot keywords for deeper hunting.\n- To export an incident timeline into Timesketch or Timeline Explorer for collaborative analysis.\n\n## Prerequisites\n\n- Hayabusa binary. Download a pre-compiled release (Windows\u002FLinux\u002FmacOS) from GitHub:\n  ```bash\n  # Linux example\n  curl -LO https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa\u002Freleases\u002Flatest\u002Fdownload\u002Fhayabusa-3.0.0-lin-x64-gnu.zip\n  unzip hayabusa-*.zip && cd hayabusa-*\n  .\u002Fhayabusa-3.0.0-lin-x64-gnu --version\n  ```\n  Or build from source (rules are a submodule):\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa.git --recursive\n  cd hayabusa && cargo build --release\n  ```\n- Collected Windows `.evtx` files (or run with `--live-analysis` on the host, as Administrator).\n- Updated detection rules:\n  ```bash\n  .\u002Fhayabusa update-rules\n  ```\n- Optional: Timeline Explorer (Windows) or Timesketch for visualizing output; `jq` for JSONL.\n\n## Objectives\n\n- Build a CSV or JSON forensic timeline from a directory of `.evtx` files.\n- Update and tune the Sigma rule set used for detection.\n- Select an output profile appropriate to the investigation (minimal vs. verbose vs. timesketch).\n- Generate metrics (computer, Event ID, log) and pivot keywords for hunting leads.\n- Filter the timeline by minimum severity to focus triage.\n- Search logs for specific IOCs by keyword or regex.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Official Name | Why Hayabusa Detects It |\n|--------------|---------------|-------------------------|\n| T1059.001 | Command and Scripting Interpreter: PowerShell | Sigma rules over Event IDs 4104\u002F4103 and Sysmon flag malicious PowerShell |\n| T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Rules over process-creation events surface suspicious cmd usage |\n| T1078 | Valid Accounts | Logon events (4624\u002F4625\u002F4672) reveal anomalous authentication |\n| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys \u002F Startup Folder | Rules over registry-modification events flag persistence |\n| T1053.005 | Scheduled Task\u002FJob: Scheduled Task | Event ID 4698\u002F106 rules surface task creation |\n| T1003 | OS Credential Dumping | Rules flag LSASS access and credential-dumping patterns |\n\n## Workflow\n\n### 1. Update the rule set\nPull the latest Sigma and Hayabusa rules before every investigation.\n```bash\n.\u002Fhayabusa update-rules\n```\n\n### 2. Build a CSV timeline from collected logs\nPoint Hayabusa at a directory of `.evtx` files and write a CSV timeline. `-w` skips the interactive wizard for scripted runs.\n```bash\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline.csv -w\n# UTC timestamps for cross-host correlation\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline_utc.csv -U -w\n```\n\n### 3. Choose an output profile\nProfiles control detail. Use `verbose` to include MITRE ATT&CK tactics, tags, and the source rule\u002FEVTX file; `all-field-info` to retain every original field.\n```bash\n# Verbose: adds MITRE tactics, tags, rule file, evtx file\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline_verbose.csv -p verbose -w\n# Preserve all original event fields\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline_full.csv -p all-field-info -w\n```\nAvailable profiles: `minimal`, `standard` (default), `verbose`, `all-field-info`, `all-field-info-verbose`, `super-verbose`, `timesketch-minimal`, `timesketch-verbose`.\n\n### 4. Filter by minimum severity\nFocus triage on the highest-confidence detections with `-m`\u002F`--min-level`.\n```bash\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o critical.csv -m high -w\n```\nLevels: `informational`, `low`, `medium`, `high`, `critical`.\n\n### 5. Produce a JSON\u002FJSONL timeline for tooling\nJSONL feeds cleanly into `jq` and downstream pipelines.\n```bash\n.\u002Fhayabusa json-timeline -d .\u002Fcollected_evtx -L -o timeline.jsonl -w\n# Example: top rule titles\njq -r '.RuleTitle' timeline.jsonl | sort | uniq -c | sort -rn | head\n```\n\n### 6. Generate metrics and pivot keywords\nSummaries reveal which hosts and Event IDs dominate, and pivot keywords give hunting leads.\n```bash\n.\u002Fhayabusa computer-metrics -d .\u002Fcollected_evtx -o computers.csv\n.\u002Fhayabusa eid-metrics -d .\u002Fcollected_evtx -o eid.csv\n.\u002Fhayabusa log-metrics -d .\u002Fcollected_evtx -o logs.csv\n.\u002Fhayabusa pivot-keywords-list -d .\u002Fcollected_evtx -m medium -o pivots\n```\n\n### 7. Search logs for specific IOCs\nUse the `search` command for keyword or regex hunting independent of detection rules.\n```bash\n# Keyword search (case-insensitive) for a suspicious binary\n.\u002Fhayabusa search -d .\u002Fcollected_evtx -k \"powershell\" -i\n# Regex search for base64-looking PowerShell encoded commands\n.\u002Fhayabusa search -d .\u002Fcollected_evtx -r \"-[Ee]nc(odedCommand)?\\s+[A-Za-z0-9+\u002F=]{20,}\"\n```\n\n### 8. Live triage on a running host\nOn the affected machine (Administrator), analyze local logs without exporting first.\n```bash\n.\u002Fhayabusa csv-timeline -l -o live_timeline.csv -m high -w\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| Hayabusa | Sigma-based EVTX timeline\u002Fthreat hunting | https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa |\n| hayabusa-rules | Sigma + Hayabusa detection rules | https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa-rules |\n| Takajō | Hayabusa results analyzer | https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Ftakajo |\n| Timeline Explorer | Review CSV timelines | https:\u002F\u002Fericzimmerman.github.io\u002F |\n| Timesketch | Collaborative timeline analysis | https:\u002F\u002Ftimesketch.org\u002F |\n| Sigma | Generic detection rule format | https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma |\n\n## Validation Criteria\n\n- [ ] Hayabusa binary installed and `--version` confirmed.\n- [ ] Rules updated with `update-rules` before analysis.\n- [ ] CSV timeline generated from the collected `.evtx` directory.\n- [ ] Appropriate output profile selected for the investigation goal.\n- [ ] Timeline filtered by minimum severity for triage focus.\n- [ ] JSON\u002FJSONL timeline produced for downstream tooling where needed.\n- [ ] Computer\u002FEID\u002Flog metrics generated.\n- [ ] Pivot keywords list produced for hunting leads.\n- [ ] Targeted IOC searches run with keyword\u002Fregex.\n- [ ] Findings (e.g., PowerShell T1059.001 detections) documented in the incident timeline.\n","# Generating Forensic Timelines with Hayabusa\n\n## Overview\n\nHayabusa (隼, Japanese for \"peregrine falcon\") is a Sigma-based threat-hunting and fast-forensics timeline generator for Windows event logs, developed by Yamato Security in Rust. It parses `.evtx` files (offline or via live analysis of a local host), applies a large built-in library of Sigma detection rules plus Hayabusa-specific rules, and produces a single, readable, chronological timeline of high-signal events with severity levels, MITRE ATT&CK tactics, and rule references. This collapses thousands of raw event-log records into a prioritized incident timeline that an analyst can review quickly.\n\nHayabusa is purpose-built for DFIR triage. Instead of loading EVTX into a SIEM, an investigator runs a single binary against a directory of collected logs and gets a CSV or JSON timeline plus metrics (events per computer, per Event ID, per channel). Because detections are Sigma-based, coverage tracks the open detection-engineering community, and rules can be updated on demand with `update-rules`. The tool's output integrates with downstream analysis: CSV opens in Timeline Explorer, JSONL feeds into `jq`, and `timesketch-*` profiles export directly into Timesketch.\n\nA frequent finding in Hayabusa timelines is malicious PowerShell — MITRE ATT&CK **T1059.001 (Command and Scripting Interpreter: PowerShell)** — surfaced via Sigma rules over Event ID 4104 (script-block logging), 4103, and Sysmon process creation. This skill maps to NIST CSF **RS.AN-03** (analysis is performed to establish what has taken place during an incident).\n\n## When to Use\n\n- During incident-response triage, to turn a pile of collected `.evtx` files into a prioritized timeline.\n- When you need fast, SIEM-free detection over Windows event logs with community Sigma coverage.\n- To enumerate suspicious activity (PowerShell, account changes, lateral movement) across many hosts' logs.\n- To produce metrics (events per computer\u002FEvent ID\u002Fchannel) and pivot keywords for deeper hunting.\n- To export an incident timeline into Timesketch or Timeline Explorer for collaborative analysis.\n\n## Prerequisites\n\n- Hayabusa binary. Download a pre-compiled release (Windows\u002FLinux\u002FmacOS) from GitHub:\n  ```bash\n  # Linux example\n  curl -LO https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa\u002Freleases\u002Flatest\u002Fdownload\u002Fhayabusa-3.0.0-lin-x64-gnu.zip\n  unzip hayabusa-*.zip && cd hayabusa-*\n  .\u002Fhayabusa-3.0.0-lin-x64-gnu --version\n  ```\n  Or build from source (rules are a submodule):\n  ```bash\n  git clone https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa.git --recursive\n  cd hayabusa && cargo build --release\n  ```\n- Collected Windows `.evtx` files (or run with `--live-analysis` on the host, as Administrator).\n- Updated detection rules:\n  ```bash\n  .\u002Fhayabusa update-rules\n  ```\n- Optional: Timeline Explorer (Windows) or Timesketch for visualizing output; `jq` for JSONL.\n\n## Objectives\n\n- Build a CSV or JSON forensic timeline from a directory of `.evtx` files.\n- Update and tune the Sigma rule set used for detection.\n- Select an output profile appropriate to the investigation (minimal vs. verbose vs. timesketch).\n- Generate metrics (computer, Event ID, log) and pivot keywords for hunting leads.\n- Filter the timeline by minimum severity to focus triage.\n- Search logs for specific IOCs by keyword or regex.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Official Name | Why Hayabusa Detects It |\n|--------------|---------------|-------------------------|\n| T1059.001 | Command and Scripting Interpreter: PowerShell | Sigma rules over Event IDs 4104\u002F4103 and Sysmon flag malicious PowerShell |\n| T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Rules over process-creation events surface suspicious cmd usage |\n| T1078 | Valid Accounts | Logon events (4624\u002F4625\u002F4672) reveal anomalous authentication |\n| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys \u002F Startup Folder | Rules over registry-modification events flag persistence |\n| T1053.005 | Scheduled Task\u002FJob: Scheduled Task | Event ID 4698\u002F106 rules surface task creation |\n| T1003 | OS Credential Dumping | Rules flag LSASS access and credential-dumping patterns |\n\n## Workflow\n\n### 1. Update the rule set\nPull the latest Sigma and Hayabusa rules before every investigation.\n```bash\n.\u002Fhayabusa update-rules\n```\n\n### 2. Build a CSV timeline from collected logs\nPoint Hayabusa at a directory of `.evtx` files and write a CSV timeline. `-w` skips the interactive wizard for scripted runs.\n```bash\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline.csv -w\n# UTC timestamps for cross-host correlation\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline_utc.csv -U -w\n```\n\n### 3. Choose an output profile\nProfiles control detail. Use `verbose` to include MITRE ATT&CK tactics, tags, and the source rule\u002FEVTX file; `all-field-info` to retain every original field.\n```bash\n# Verbose: adds MITRE tactics, tags, rule file, evtx file\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline_verbose.csv -p verbose -w\n# Preserve all original event fields\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o timeline_full.csv -p all-field-info -w\n```\nAvailable profiles: `minimal`, `standard` (default), `verbose`, `all-field-info`, `all-field-info-verbose`, `super-verbose`, `timesketch-minimal`, `timesketch-verbose`.\n\n### 4. Filter by minimum severity\nFocus triage on the highest-confidence detections with `-m`\u002F`--min-level`.\n```bash\n.\u002Fhayabusa csv-timeline -d .\u002Fcollected_evtx -o critical.csv -m high -w\n```\nLevels: `informational`, `low`, `medium`, `high`, `critical`.\n\n### 5. Produce a JSON\u002FJSONL timeline for tooling\nJSONL feeds cleanly into `jq` and downstream pipelines.\n```bash\n.\u002Fhayabusa json-timeline -d .\u002Fcollected_evtx -L -o timeline.jsonl -w\n# Example: top rule titles\njq -r '.RuleTitle' timeline.jsonl | sort | uniq -c | sort -rn | head\n```\n\n### 6. Generate metrics and pivot keywords\nSummaries reveal which hosts and Event IDs dominate, and pivot keywords give hunting leads.\n```bash\n.\u002Fhayabusa computer-metrics -d .\u002Fcollected_evtx -o computers.csv\n.\u002Fhayabusa eid-metrics -d .\u002Fcollected_evtx -o eid.csv\n.\u002Fhayabusa log-metrics -d .\u002Fcollected_evtx -o logs.csv\n.\u002Fhayabusa pivot-keywords-list -d .\u002Fcollected_evtx -m medium -o pivots\n```\n\n### 7. Search logs for specific IOCs\nUse the `search` command for keyword or regex hunting independent of detection rules.\n```bash\n# Keyword search (case-insensitive) for a suspicious binary\n.\u002Fhayabusa search -d .\u002Fcollected_evtx -k \"powershell\" -i\n# Regex search for base64-looking PowerShell encoded commands\n.\u002Fhayabusa search -d .\u002Fcollected_evtx -r \"-[Ee]nc(odedCommand)?\\s+[A-Za-z0-9+\u002F=]{20,}\"\n```\n\n### 8. Live triage on a running host\nOn the affected machine (Administrator), analyze local logs without exporting first.\n```bash\n.\u002Fhayabusa csv-timeline -l -o live_timeline.csv -m high -w\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| Hayabusa | Sigma-based EVTX timeline\u002Fthreat hunting | https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa |\n| hayabusa-rules | Sigma + Hayabusa detection rules | https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Fhayabusa-rules |\n| Takajō | Hayabusa results analyzer | https:\u002F\u002Fgithub.com\u002FYamato-Security\u002Ftakajo |\n| Timeline Explorer | Review CSV timelines | https:\u002F\u002Fericzimmerman.github.io\u002F |\n| Timesketch | Collaborative timeline analysis | https:\u002F\u002Ftimesketch.org\u002F |\n| Sigma | Generic detection rule format | https:\u002F\u002Fgithub.com\u002FSigmaHQ\u002Fsigma |\n\n## Validation Criteria\n\n- [ ] Hayabusa binary installed and `--version` confirmed.\n- [ ] Rules updated with `update-rules` before analysis.\n- [ ] CSV timeline generated from the collected `.evtx` directory.\n- [ ] Appropriate output profile selected for the investigation goal.\n- [ ] Timeline filtered by minimum severity for triage focus.\n- [ ] JSON\u002FJSONL timeline produced for downstream tooling where needed.\n- [ ] Computer\u002FEID\u002Flog metrics generated.\n- [ ] Pivot keywords list produced for hunting leads.\n- [ ] Targeted IOC searches run with keyword\u002Fregex.\n- [ ] Findings (e.g., PowerShell T1059.001 detections) documented in the incident timeline.\n",{"name":5,"tags":49,"author":53,"domain":34,"license":15,"version":54,"nist_csf":55,"subdomain":32,"description":7,"mitre_attack":57},[25,35,50,31,51,36,28,52],"evtx","timeline","forensics","mahipal","1.0",[56],"RS.AN-03",[26],"main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fgenerating-forensic-timelines-with-hayabusa",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002FSKILL.md",true,[82,87,93,97,101,105,111],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi_reference.md","REFERENCE","参考文档",7162,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydeseq2\u002Freferences\u002Fapi_reference.md",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md",2114,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1962,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fworkflow_guide.md",13026,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydeseq2\u002Freferences\u002Fworkflow_guide.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",4584,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgenerating-forensic-timelines-with-hayabusa\u002Fscripts\u002Fagent.py",{"path":112,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Frun_deseq2_analysis.py",11887,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpydeseq2\u002Fscripts\u002Frun_deseq2_analysis.py",[116,143,167,195,217,244],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,128,34,129,130,131,132,133,134,135,136,137,138,139,140,141,142],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[149],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[151,139,152,153,128,154,34,131,155,156,157,158,159,160,161,162,163,164,165,166],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[173,176],{"categoryNo":174,"categoryName":175,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,178,179,180,181,34,182,183,155,184,185,186,187,188,189,190,191,192,193,194],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,203,204,34,205,206,38,207,35,208,209,210,211,212,32,213,158,214,215,216],"kape","triaging windows with kape","registry","browser","windows-forensics","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,34,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[250],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[128,252,34,43,253,254,255,256,257,30,258,190,259,191,260,261,262,263,264,265],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]