[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AET0GAWKT5FKPAQ4NM5PS2":3,"skill-same:01M6AET0GAWKT5FKPAQ4NM5PS2":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AET0GAWKT5FKPAQ4NM5PS2","hunting-advanced-persistent-threats",null,"Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"hunting advanced persistent threats","Enterprise","TTP","osquery","edr","ATT&CK","endpoint","NIST","Zeek","network","memory","NIST-CSF","MITRE-ATT&CK","threat-hunting","threat-intelligence","logs","apt","telemetry","threat hunting","cybersecurity","2026-11-10 10:12:30",false,"---\nname: hunting-advanced-persistent-threats\ndescription: 'Proactively hunts for Advanced Persistent Threat (APT) activity within\n  enterprise environments using hypothesis-driven searches across endpoint telemetry,\n  network logs, and memory artifacts. Use when conducting scheduled threat hunting\n  cycles, investigating anomalous behavior flagged by UEBA, or validating that known\n  APT TTPs are not present in the environment. Activates for requests involving MITRE\n  ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- MITRE-ATT&CK\n- threat-hunting\n- APT\n- Velociraptor\n- osquery\n- Zeek\n- TTP\n- NIST-CSF\n- EDR\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1005\n---\n# Hunting Advanced Persistent Threats\n\n## When to Use\n\nUse this skill when:\n- Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence\n- A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation\n- A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure\n\n**Do not use** this skill as a substitute for incident response when a confirmed breach is in progress — escalate to IR procedures (NIST SP 800-61).\n\n## Prerequisites\n\n- EDR platform with telemetry retention (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) covering 30+ days\n- Access to MITRE ATT&CK Navigator for hypothesis development\n- Network flow data (NetFlow, Zeek, or Suricata logs) in a queryable SIEM\n- Threat hunting platform or query interface (Velociraptor, osquery fleet, or Splunk ES)\n\n## Workflow\n\n### Step 1: Develop Hunt Hypothesis\n\nSelect a threat actor relevant to your sector using MITRE ATT&CK Groups (https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002F). Review the group's known TTPs mapped to ATT&CK techniques. Example hypothesis: \"APT29 (Cozy Bear) uses spearphishing with ISO attachments (T1566.001) and living-off-the-land binaries (T1218) — test for unusual mshta.exe and rundll32.exe parent-child relationships.\"\n\nDocument hypothesis using the Threat Hunting Loop framework: hypothesis → data collection → pattern analysis → response.\n\n### Step 2: Identify Required Data Sources\n\nMap each ATT&CK technique to required log sources using the ATT&CK Data Sources taxonomy:\n- Process creation (T1059): Windows Security Event 4688 or Sysmon Event ID 1\n- Network connections (T1071): Zeek conn.log, NetFlow, EDR network telemetry\n- Registry modifications (T1547): Sysmon Event ID 13, Windows Security 4657\n- Memory injection (T1055): EDR memory scan telemetry, Volatility output\n\nVerify log coverage using ATT&CK Coverage Calculator or a custom data source matrix.\n\n### Step 3: Execute Hunts with Velociraptor or osquery\n\n**Velociraptor VQL hunt** for unusual PowerShell execution:\n```vql\nSELECT Pid, Ppid, Name, CommandLine, CreateTime\nFROM pslist()\nWHERE Name =~ \"powershell.exe\"\nAND CommandLine =~ \"-enc|-nop|-w hidden\"\n```\n\n**osquery** for persistence via scheduled tasks:\n```sql\nSELECT name, action, enabled, path\nFROM scheduled_tasks\nWHERE action NOT LIKE '%System32%'\nAND enabled = 1;\n```\n\n**Splunk SPL** for lateral movement via PsExec:\n```spl\nindex=windows EventCode=7045 ServiceFileName=\"*PSEXESVC*\"\n| stats count by ComputerName, ServiceName, ServiceFileName\n```\n\n### Step 4: Analyze Results and Pivot\n\nFor each anomaly identified, pivot across dimensions:\n- Temporal: Did this occur before or after known IOC timestamps?\n- Host: How many endpoints exhibit this behavior?\n- User: Is the associated account a service account, privileged user, or regular user?\n- Network: Does the host communicate with external IPs not in baseline?\n\nApply the Diamond Model (adversary, capability, infrastructure, victim) to structure findings.\n\n### Step 5: Document and Operationalize Findings\n\nIf hunting reveals confirmed malicious activity, activate IR procedures. If hunting reveals a gap (hunt found nothing but data coverage was insufficient), document the coverage gap and remediate.\n\nConvert successful hunt queries into SIEM detection rules using Sigma format for portability across platforms.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TTP** | Tactics, Techniques, and Procedures — adversary behavioral patterns as defined in MITRE ATT&CK |\n| **Diamond Model** | Analytical framework with four vertices (adversary, capability, infrastructure, victim) used to structure intrusion analysis |\n| **Living-off-the-Land (LotL)** | Attacker technique using legitimate OS tools (PowerShell, WMI, certutil) to evade detection |\n| **UEBA** | User and Entity Behavior Analytics — ML-based detection of anomalous behavior baselines |\n| **Sigma** | Open standard for SIEM-agnostic detection rule format, analogous to YARA for network\u002Flog detection |\n| **Hunt Hypothesis** | A testable prediction about adversary presence based on threat intelligence and environmental knowledge |\n\n## Tools & Systems\n\n- **Velociraptor**: Open-source DFIR platform with VQL query language for scalable endpoint hunting across thousands of systems\n- **osquery**: SQL-based OS instrumentation framework for real-time endpoint telemetry queries\n- **MITRE ATT&CK Navigator**: Web-based tool for visualizing ATT&CK coverage and technique prioritization\n- **Zeek (formerly Bro)**: Network traffic analyzer producing structured logs (conn, dns, http, ssl) suitable for hunting\n- **Elastic Security**: EQL (Event Query Language) enables sequence-based hunting for multi-stage attack patterns\n- **Sigma**: Detection rule format with translators for Splunk, QRadar, Sentinel, and Elastic\n\n## Common Pitfalls\n\n- **Confirmation bias**: Starting a hunt expecting to find something and interpreting benign data as malicious. Document null results — they validate controls.\n- **Insufficient data retention**: Many APT techniques require 90+ days of log history to identify slow-and-low patterns. Default retention periods are often too short.\n- **Hunting without baselines**: Cannot identify anomalies without knowing normal. Spend time on baseline documentation before hunting.\n- **Query performance impact**: Broad queries against production SIEM during business hours can degrade analyst workflows. Schedule intensive hunts during off-peak hours.\n- **Ignoring false positives systematically**: Track false positive rates per query. Queries with >80% FP rate should be refined or retired before operationalization.\n","# Hunting Advanced Persistent Threats\n\n## When to Use\n\nUse this skill when:\n- Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence\n- A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation\n- A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure\n\n**Do not use** this skill as a substitute for incident response when a confirmed breach is in progress — escalate to IR procedures (NIST SP 800-61).\n\n## Prerequisites\n\n- EDR platform with telemetry retention (CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) covering 30+ days\n- Access to MITRE ATT&CK Navigator for hypothesis development\n- Network flow data (NetFlow, Zeek, or Suricata logs) in a queryable SIEM\n- Threat hunting platform or query interface (Velociraptor, osquery fleet, or Splunk ES)\n\n## Workflow\n\n### Step 1: Develop Hunt Hypothesis\n\nSelect a threat actor relevant to your sector using MITRE ATT&CK Groups (https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002F). Review the group's known TTPs mapped to ATT&CK techniques. Example hypothesis: \"APT29 (Cozy Bear) uses spearphishing with ISO attachments (T1566.001) and living-off-the-land binaries (T1218) — test for unusual mshta.exe and rundll32.exe parent-child relationships.\"\n\nDocument hypothesis using the Threat Hunting Loop framework: hypothesis → data collection → pattern analysis → response.\n\n### Step 2: Identify Required Data Sources\n\nMap each ATT&CK technique to required log sources using the ATT&CK Data Sources taxonomy:\n- Process creation (T1059): Windows Security Event 4688 or Sysmon Event ID 1\n- Network connections (T1071): Zeek conn.log, NetFlow, EDR network telemetry\n- Registry modifications (T1547): Sysmon Event ID 13, Windows Security 4657\n- Memory injection (T1055): EDR memory scan telemetry, Volatility output\n\nVerify log coverage using ATT&CK Coverage Calculator or a custom data source matrix.\n\n### Step 3: Execute Hunts with Velociraptor or osquery\n\n**Velociraptor VQL hunt** for unusual PowerShell execution:\n```vql\nSELECT Pid, Ppid, Name, CommandLine, CreateTime\nFROM pslist()\nWHERE Name =~ \"powershell.exe\"\nAND CommandLine =~ \"-enc|-nop|-w hidden\"\n```\n\n**osquery** for persistence via scheduled tasks:\n```sql\nSELECT name, action, enabled, path\nFROM scheduled_tasks\nWHERE action NOT LIKE '%System32%'\nAND enabled = 1;\n```\n\n**Splunk SPL** for lateral movement via PsExec:\n```spl\nindex=windows EventCode=7045 ServiceFileName=\"*PSEXESVC*\"\n| stats count by ComputerName, ServiceName, ServiceFileName\n```\n\n### Step 4: Analyze Results and Pivot\n\nFor each anomaly identified, pivot across dimensions:\n- Temporal: Did this occur before or after known IOC timestamps?\n- Host: How many endpoints exhibit this behavior?\n- User: Is the associated account a service account, privileged user, or regular user?\n- Network: Does the host communicate with external IPs not in baseline?\n\nApply the Diamond Model (adversary, capability, infrastructure, victim) to structure findings.\n\n### Step 5: Document and Operationalize Findings\n\nIf hunting reveals confirmed malicious activity, activate IR procedures. If hunting reveals a gap (hunt found nothing but data coverage was insufficient), document the coverage gap and remediate.\n\nConvert successful hunt queries into SIEM detection rules using Sigma format for portability across platforms.\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TTP** | Tactics, Techniques, and Procedures — adversary behavioral patterns as defined in MITRE ATT&CK |\n| **Diamond Model** | Analytical framework with four vertices (adversary, capability, infrastructure, victim) used to structure intrusion analysis |\n| **Living-off-the-Land (LotL)** | Attacker technique using legitimate OS tools (PowerShell, WMI, certutil) to evade detection |\n| **UEBA** | User and Entity Behavior Analytics — ML-based detection of anomalous behavior baselines |\n| **Sigma** | Open standard for SIEM-agnostic detection rule format, analogous to YARA for network\u002Flog detection |\n| **Hunt Hypothesis** | A testable prediction about adversary presence based on threat intelligence and environmental knowledge |\n\n## Tools & Systems\n\n- **Velociraptor**: Open-source DFIR platform with VQL query language for scalable endpoint hunting across thousands of systems\n- **osquery**: SQL-based OS instrumentation framework for real-time endpoint telemetry queries\n- **MITRE ATT&CK Navigator**: Web-based tool for visualizing ATT&CK coverage and technique prioritization\n- **Zeek (formerly Bro)**: Network traffic analyzer producing structured logs (conn, dns, http, ssl) suitable for hunting\n- **Elastic Security**: EQL (Event Query Language) enables sequence-based hunting for multi-stage attack patterns\n- **Sigma**: Detection rule format with translators for Splunk, QRadar, Sentinel, and Elastic\n\n## Common Pitfalls\n\n- **Confirmation bias**: Starting a hunt expecting to find something and interpreting benign data as malicious. Document null results — they validate controls.\n- **Insufficient data retention**: Many APT techniques require 90+ days of log history to identify slow-and-low patterns. Default retention periods are often too short.\n- **Hunting without baselines**: Cannot identify anomalies without knowing normal. Spend time on baseline documentation before hunting.\n- **Query performance impact**: Broad queries against production SIEM during business hours can degrade analyst workflows. Schedule intensive hunts during off-peak hours.\n- **Ignoring false positives systematically**: Track false positive rates per query. Queries with >80% FP rate should be refined or retired before operationalization.\n",{"name":5,"tags":49,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":38,"description":60,"mitre_attack":61,"d3fend_techniques":67},[36,37,50,51,27,32,26,35,52],"APT","Velociraptor","EDR","mahipal","1.0.0",[56,57,58,59],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.\n",[62,63,64,65,66],"T1591","T1592","T1593","T1589","T1005",[68,69,70,71,72],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fhunting-advanced-persistent-threats",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-advanced-persistent-threats",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-advanced-persistent-threats",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-advanced-persistent-threats","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FSKILL.md",true,[97,102,108],{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",2114,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-advanced-persistent-threats\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",7246,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-advanced-persistent-threats\u002Fscripts\u002Fagent.py",[115,142,166,194,219,246],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,127,43,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,138,151,152,127,153,43,130,154,155,156,157,158,159,160,161,162,163,164,165],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":176,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[172,175],{"categoryNo":173,"categoryName":174,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,177,178,179,180,43,181,182,154,183,184,185,186,187,188,189,190,191,192,193],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[200],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[202,203,204,43,205,206,39,207,208,209,210,211,212,213,214,215,157,216,217,218],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[225],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,43,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":247,"name":248,"nameZh":6,"description":249,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":250,"categories":251,"keywords":253,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[252],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,254,43,255,256,257,258,259,31,260,28,189,261,190,262,263,264,265,266,267],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]