[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEXD1X93P6RJ3T18SWVXE5":3,"skill-same:01M6AEXD1X93P6RJ3T18SWVXE5":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AEXD1X93P6RJ3T18SWVXE5","hunting-for-suspicious-scheduled-tasks",null,"Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe\u002Fat.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"hunting for suspicious scheduled tasks","tasks","suspicious","analyzing","mitre-t1053-005","t1053","t1547","execution","scheduled-tasks","endpoint-detection","detection","endpoint","threat-hunting","logs","persistence","windows","incident response","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: hunting-for-suspicious-scheduled-tasks\ndescription: Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe\u002Fat.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- scheduled-tasks\n- persistence\n- mitre-t1053-005\n- windows\n- endpoint-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1547\n---\n\n# Hunting for Suspicious Scheduled Tasks\n\n## When to Use\n\n- When proactively hunting for persistence mechanisms in Windows environments\n- After detecting schtasks.exe or at.exe usage in process creation logs\n- When investigating malware that survives reboots and user logoffs\n- During incident response to enumerate all persistence on compromised systems\n- When Windows Security Event ID 4698 (Scheduled Task Created) fires for unusual tasks\n\n## Prerequisites\n\n- Windows Security Event ID 4698\u002F4699\u002F4702 (Task Created\u002FDeleted\u002FUpdated)\n- Sysmon Event ID 1 for schtasks.exe process creation with command lines\n- Windows Task Scheduler operational log (Microsoft-Windows-TaskScheduler\u002FOperational)\n- PowerShell logging for Register-ScheduledTask cmdlet usage\n- Access to Task Scheduler XML definitions on endpoints\n\n## Workflow\n\n1. **Enumerate All Scheduled Tasks**: Collect complete task inventory from target systems using `schtasks \u002Fquery \u002Ffo CSV \u002Fv` or `Get-ScheduledTask` PowerShell cmdlet.\n2. **Monitor Task Creation Events**: Track Event ID 4698 for new task creation, correlating with the creating process and user account context.\n3. **Analyze Task Actions**: Examine what each task executes. Flag tasks running scripts (PowerShell, cmd, wscript), binaries from user-writable paths (TEMP, AppData, Downloads), or encoded\u002Fobfuscated commands.\n4. **Check Task Triggers**: Review trigger conditions. Tasks triggered by system startup, user logon, or short intervals (1-5 minutes) warrant investigation.\n5. **Identify Hidden or Disguised Tasks**: Hunt for tasks with names mimicking legitimate Windows tasks, tasks with Security Descriptor modifications hiding them from standard enumeration, or tasks stored in non-standard registry locations.\n6. **Correlate with Process Execution**: Match scheduled task execution events with process creation logs to confirm what actually runs.\n7. **Baseline and Diff**: Compare current task inventory against known-good baselines to identify new, modified, or unexpected tasks.\n\n## Detection Queries\n\n### Splunk -- Scheduled Task Creation\n```spl\nindex=wineventlog EventCode=4698\n| spath output=TaskName path=EventData.TaskName\n| spath output=TaskContent path=EventData.TaskContent\n| where NOT match(TaskName, \"(?i)(\\\\\\\\Microsoft\\\\\\\\|\\\\\\\\Windows\\\\\\\\)\")\n| table _time Computer SubjectUserName TaskName TaskContent\n```\n\n### Splunk -- Schtasks.exe Suspicious Usage\n```spl\nindex=sysmon EventCode=1 Image=\"*\\\\schtasks.exe\"\n| where match(CommandLine, \"(?i)\u002Fcreate\")\n| where match(CommandLine, \"(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|http|https|\\\\\\\\temp\\\\\\\\|\\\\\\\\appdata\\\\\\\\)\")\n| table _time Computer User CommandLine ParentImage\n```\n\n### KQL -- Microsoft Sentinel\n```kql\nSecurityEvent\n| where EventID == 4698\n| extend TaskName = tostring(EventData.TaskName)\n| extend TaskContent = tostring(EventData.TaskContent)\n| where TaskContent has_any (\"powershell\", \"cmd.exe\", \"wscript\", \"http:\u002F\u002F\", \"https:\u002F\u002F\", \"\\\\Temp\\\\\", \"\\\\AppData\\\\\")\n| project TimeGenerated, Computer, Account, TaskName, TaskContent\n```\n\n## Common Scenarios\n\n1. **Cobalt Strike Persistence**: Creates scheduled tasks via schtasks.exe to execute PowerShell download cradles at user logon intervals.\n2. **Ransomware Staging**: Task created to run encryption payload at a future time, often during off-hours for maximum impact.\n3. **Hidden Task via SD Modification**: Attacker modifies Security Descriptor of scheduled task to hide it from normal enumeration while maintaining execution.\n4. **COM Handler Abuse**: Task uses COM handler rather than direct executable path, making action inspection more complex.\n5. **Lateral Movement via Tasks**: Remote scheduled task creation using `schtasks \u002Fcreate \u002Fs REMOTE_HOST` for execution on other systems.\n\n## Output Format\n\n```\nHunt ID: TH-SCHTASK-[DATE]-[SEQ]\nHost: [Hostname]\nTask Name: [Full task path]\nAction: [Command\u002FScript executed]\nTrigger: [Startup\u002FLogon\u002FTimer\u002FEvent]\nCreated By: [User account]\nCreated From: [Local\u002FRemote]\nCreation Time: [Timestamp]\nRun As: [Execution account]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Hunting for Suspicious Scheduled Tasks\n\n## When to Use\n\n- When proactively hunting for persistence mechanisms in Windows environments\n- After detecting schtasks.exe or at.exe usage in process creation logs\n- When investigating malware that survives reboots and user logoffs\n- During incident response to enumerate all persistence on compromised systems\n- When Windows Security Event ID 4698 (Scheduled Task Created) fires for unusual tasks\n\n## Prerequisites\n\n- Windows Security Event ID 4698\u002F4699\u002F4702 (Task Created\u002FDeleted\u002FUpdated)\n- Sysmon Event ID 1 for schtasks.exe process creation with command lines\n- Windows Task Scheduler operational log (Microsoft-Windows-TaskScheduler\u002FOperational)\n- PowerShell logging for Register-ScheduledTask cmdlet usage\n- Access to Task Scheduler XML definitions on endpoints\n\n## Workflow\n\n1. **Enumerate All Scheduled Tasks**: Collect complete task inventory from target systems using `schtasks \u002Fquery \u002Ffo CSV \u002Fv` or `Get-ScheduledTask` PowerShell cmdlet.\n2. **Monitor Task Creation Events**: Track Event ID 4698 for new task creation, correlating with the creating process and user account context.\n3. **Analyze Task Actions**: Examine what each task executes. Flag tasks running scripts (PowerShell, cmd, wscript), binaries from user-writable paths (TEMP, AppData, Downloads), or encoded\u002Fobfuscated commands.\n4. **Check Task Triggers**: Review trigger conditions. Tasks triggered by system startup, user logon, or short intervals (1-5 minutes) warrant investigation.\n5. **Identify Hidden or Disguised Tasks**: Hunt for tasks with names mimicking legitimate Windows tasks, tasks with Security Descriptor modifications hiding them from standard enumeration, or tasks stored in non-standard registry locations.\n6. **Correlate with Process Execution**: Match scheduled task execution events with process creation logs to confirm what actually runs.\n7. **Baseline and Diff**: Compare current task inventory against known-good baselines to identify new, modified, or unexpected tasks.\n\n## Detection Queries\n\n### Splunk -- Scheduled Task Creation\n```spl\nindex=wineventlog EventCode=4698\n| spath output=TaskName path=EventData.TaskName\n| spath output=TaskContent path=EventData.TaskContent\n| where NOT match(TaskName, \"(?i)(\\\\\\\\Microsoft\\\\\\\\|\\\\\\\\Windows\\\\\\\\)\")\n| table _time Computer SubjectUserName TaskName TaskContent\n```\n\n### Splunk -- Schtasks.exe Suspicious Usage\n```spl\nindex=sysmon EventCode=1 Image=\"*\\\\schtasks.exe\"\n| where match(CommandLine, \"(?i)\u002Fcreate\")\n| where match(CommandLine, \"(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|http|https|\\\\\\\\temp\\\\\\\\|\\\\\\\\appdata\\\\\\\\)\")\n| table _time Computer User CommandLine ParentImage\n```\n\n### KQL -- Microsoft Sentinel\n```kql\nSecurityEvent\n| where EventID == 4698\n| extend TaskName = tostring(EventData.TaskName)\n| extend TaskContent = tostring(EventData.TaskContent)\n| where TaskContent has_any (\"powershell\", \"cmd.exe\", \"wscript\", \"http:\u002F\u002F\", \"https:\u002F\u002F\", \"\\\\Temp\\\\\", \"\\\\AppData\\\\\")\n| project TimeGenerated, Computer, Account, TaskName, TaskContent\n```\n\n## Common Scenarios\n\n1. **Cobalt Strike Persistence**: Creates scheduled tasks via schtasks.exe to execute PowerShell download cradles at user logon intervals.\n2. **Ransomware Staging**: Task created to run encryption payload at a future time, often during off-hours for maximum impact.\n3. **Hidden Task via SD Modification**: Attacker modifies Security Descriptor of scheduled task to hide it from normal enumeration while maintaining execution.\n4. **COM Handler Abuse**: Task uses COM handler rather than direct executable path, making action inspection more complex.\n5. **Lateral Movement via Tasks**: Remote scheduled task creation using `schtasks \u002Fcreate \u002Fs REMOTE_HOST` for execution on other systems.\n\n## Output Format\n\n```\nHunt ID: TH-SCHTASK-[DATE]-[SEQ]\nHost: [Hostname]\nTask Name: [Full task path]\nAction: [Command\u002FScript executed]\nTrigger: [Startup\u002FLogon\u002FTimer\u002FEvent]\nCreated By: [User account]\nCreated From: [Local\u002FRemote]\nCreation Time: [Timestamp]\nRun As: [Execution account]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":48,"author":49,"domain":41,"license":15,"version":50,"nist_csf":51,"subdomain":36,"description":7,"mitre_attack":56},[36,32,38,28,39,33],"mahipal","1.0",[52,53,54,55],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[57,58,59,60,61],"T1046","T1057","T1082","T1083","T1547","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fhunting-for-suspicious-scheduled-tasks",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-suspicious-scheduled-tasks",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-suspicious-scheduled-tasks",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-suspicious-scheduled-tasks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002FSKILL.md",true,[86,92,97,103,107,111,117],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"assets\u002Ftemplate.md","ASSET","资产文件",786,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002Fassets\u002Ftemplate.md",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1931,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fstandards.md",1418,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002Freferences\u002Fstandards.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fworkflows.md",1279,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002Freferences\u002Fworkflows.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py","SCRIPT","脚本",6998,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002Fscripts\u002Fagent.py",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fprocess.py",4762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-suspicious-scheduled-tasks\u002Fscripts\u002Fprocess.py",[122,147,171,198,222,249],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,42,41,40,134,135,136,137,138,139,140,141,142,143,144,145,146],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":154,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[153],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,143,156,157,42,158,41,135,159,160,161,162,163,164,165,166,167,168,169,170],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,182,183,184,185,41,186,187,159,188,189,190,191,192,34,193,194,195,196,197],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[204],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[39,206,207,41,208,209,37,210,211,212,213,214,215,216,217,218,162,219,220,221],"kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[228],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[230,231,232,41,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[255],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,257,41,258,259,260,261,262,263,264,265,193,31,194,266,267,268,269,270,271],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]