[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEYDMXKXG7W52M2JHHM6KG":3,"skill-same:01M6AEYDMXKXG7W52M2JHHM6KG":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":85,"commitSha":86,"skillDirectory":87,"forksCount":88,"repositoryHtmlUrl":89,"repositoryHomepageUrl":90,"ownerHtmlUrl":91,"ownerBlogUrl":92,"ownerDescription":93,"updatedAt":94,"install":95,"resources":108},"01M6AEYDMXKXG7W52M2JHHM6KG","implementing-anti-ransomware-group-policy",null,"Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker or Controlled Folder Access, or building endpoint protection policies through Group Policy.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-anti-ransomware-group-policy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing anti ransomware group policy","ransomware","policy","t1078","prevention","AppLocker","group-policy","initial-access","t1490","t1059","execution","Tools","defense","endpoint","cryptocurrency","network","phishing","pr","windows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-anti-ransomware-group-policy\ndescription: 'Configures Windows Group Policy Objects to block ransomware execution\n  and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled\n  Folder Access, attack surface reduction rules, and network protection settings.\n  Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker\n  or Controlled Folder Access, or building endpoint protection policies through Group\n  Policy.'\ndomain: cybersecurity\nsubdomain: ransomware-defense\ntags:\n- ransomware\n- group-policy\n- windows\n- AppLocker\n- hardening\n- prevention\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.DS-11\n- RS.MA-01\n- RC.RP-01\n- PR.IR-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1486\n- T1490\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - positioning\n  - monetization\n  techniques:\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: T1219\n    name: Remote Access Tools\n    tactic: positioning\n    source: attack\n  - id: T1531\n    name: Account Access Removal\n    tactic: positioning\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n---\n\n# Implementing Anti-Ransomware Group Policy\n\n## When to Use\n\n- Hardening a Windows Active Directory environment against ransomware execution and propagation\n- Implementing defense-in-depth by blocking ransomware execution paths via Group Policy\n- Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories\n- Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications\n- Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain\n\n**Do not use** as a standalone ransomware defense. GPO settings complement but do not replace endpoint detection, backups, network segmentation, and user awareness training.\n\n## Prerequisites\n\n- Windows Server 2016+ Active Directory environment with Group Policy Management Console (GPMC)\n- Domain Admin or Group Policy Creator Owners privileges\n- Windows 10\u002F11 Enterprise or Education (required for AppLocker and WDAC)\n- Microsoft Defender Antivirus enabled (required for Controlled Folder Access and ASR rules)\n- Python 3.8+ for audit script that validates GPO compliance\n- Test OU for validating GPO settings before domain-wide deployment\n\n## Workflow\n\n### Step 1: Block Ransomware Execution Paths with AppLocker\n\nConfigure AppLocker to prevent executables from running in common ransomware staging locations:\n\n```\nAppLocker GPO Path:\n  Computer Configuration → Policies → Windows Settings →\n  Security Settings → Application Control Policies → AppLocker\n\nKey Rules:\n━━━━━━━━━\n1. DENY executable rules for user-writable paths:\n   - %USERPROFILE%\\AppData\\Local\\Temp\\*     (email attachment extraction)\n   - %USERPROFILE%\\AppData\\Roaming\\*         (CryptoLocker staging)\n   - %USERPROFILE%\\Downloads\\*               (web downloads)\n   - %TEMP%\\*                                (temporary extraction)\n   - %USERPROFILE%\\Desktop\\*                 (social engineering drops)\n\n2. ALLOW default rules:\n   - C:\\Windows\\* (signed by Microsoft)\n   - C:\\Program Files\\* and C:\\Program Files (x86)\\*\n   - Administrator group: all paths\n\n3. Enable Application Identity service:\n   Computer Configuration → Policies → Windows Settings →\n   Security Settings → System Services →\n   Application Identity → Automatic\n```\n\n### Step 2: Enable Controlled Folder Access\n\nProtect critical directories from unauthorized modification:\n\n```\nControlled Folder Access GPO Path:\n  Computer Configuration → Administrative Templates →\n  Windows Components → Microsoft Defender Antivirus →\n  Microsoft Defender Exploit Guard → Controlled Folder Access\n\nSettings:\n━━━━━━━━━\n1. Configure Controlled folder access: Enabled → Block mode\n2. Configure protected folders: Add custom paths\n   - \\\\fileserver\\shares\\finance\n   - \\\\fileserver\\shares\\hr\n   - C:\\Users\\*\\Documents\n   - C:\\Users\\*\\Desktop\n\n3. Configure allowed applications: Whitelist trusted apps\n   - C:\\Program Files\\Microsoft Office\\*\n   - C:\\Program Files\\Adobe\\*\n   - Line-of-business applications\n\nDefault protected folders (automatic):\n  Documents, Pictures, Videos, Music, Desktop, Favorites\n```\n\n### Step 3: Configure Attack Surface Reduction (ASR) Rules\n\nEnable ASR rules that target ransomware delivery mechanisms:\n\n```\nASR Rules GPO Path:\n  Computer Configuration → Administrative Templates →\n  Windows Components → Microsoft Defender Antivirus →\n  Microsoft Defender Exploit Guard → Attack Surface Reduction\n\nCritical ASR Rules for Ransomware Prevention:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nGUID                                    Rule\nBE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550   Block executable content from email\nD4F940AB-401B-4EFC-AADC-AD5F3C50688A   Block Office apps from creating child processes\n3B576869-A4EC-4529-8536-B80A7769E899   Block Office apps from creating executable content\n75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84   Block Office apps from injecting into processes\nD3E037E1-3EB8-44C8-A917-57927947596D   Block JavaScript\u002FVBScript from launching downloads\n5BEB7EFE-FD9A-4556-801D-275E5FFC04CC   Block execution of obfuscated scripts\n92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B   Block Win32 API calls from Office macros\n01443614-CD74-433A-B99E-2ECDC07BFC25   Block executable files unless they meet prevalence criteria\n\nSet each rule to: Block (1) or Audit (2) for initial testing\n```\n\n### Step 4: Restrict Lateral Movement Vectors\n\nLock down SMB, RDP, and WMI to limit ransomware propagation:\n\n```\nNetwork Restrictions:\n━━━━━━━━━━━━━━━━━━━━\n1. Disable SMBv1:\n   Computer Configuration → Administrative Templates →\n   Network → Lanman Workstation → Enable insecure guest logons: Disabled\n\n   Computer Configuration → Administrative Templates →\n   MS Security Guide → Configure SMBv1 server: Disabled\n\n2. Restrict Remote Desktop:\n   Computer Configuration → Administrative Templates →\n   Windows Components → Remote Desktop Services →\n   Remote Desktop Session Host → Connections →\n   Allow users to connect remotely: Disabled (or restricted to specific groups)\n\n3. Disable remote WMI:\n   Windows Firewall → Inbound Rules →\n   Block Windows Management Instrumentation (WMI) inbound\n\n4. Disable AutoPlay\u002FAutoRun:\n   Computer Configuration → Administrative Templates →\n   Windows Components → AutoPlay Policies →\n   Turn off AutoPlay: Enabled (All drives)\n\n5. Disable PowerShell remoting for non-admin users:\n   Computer Configuration → Administrative Templates →\n   Windows Components → Windows PowerShell →\n   Turn on Script Execution: Allow only signed scripts\n```\n\n### Step 5: Audit and Validate GPO Compliance\n\nVerify that GPO settings are applied correctly across the domain:\n\n```powershell\n# Check GPO application on endpoint\ngpresult \u002Fr \u002Fscope:computer\n\n# Verify AppLocker rules\nGet-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections\n\n# Check Controlled Folder Access status\nGet-MpPreference | Select-Object EnableControlledFolderAccess\n\n# List protected folders\nGet-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessProtectedFolders\n\n# Check ASR rules\nGet-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids\nGet-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions\n```\n\n## Verification\n\n- Run `gpresult \u002Fr` on test endpoints to confirm GPO application\n- Attempt to run an executable from `%AppData%\\Temp` to verify AppLocker blocks it\n- Modify a file in a protected folder from an unlisted application to confirm CFA blocks it\n- Test ASR rules by opening a macro-enabled document and verifying child process blocking\n- Validate that legitimate applications in the allowlist still function correctly\n- Check Windows Event Log for AppLocker events (Event IDs 8003, 8004) and CFA events (1123, 1124)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **AppLocker** | Windows application control feature that restricts which executables, scripts, and DLLs users can run based on publisher, path, or hash rules |\n| **Controlled Folder Access** | Microsoft Defender feature that prevents untrusted applications from modifying files in protected directories |\n| **Attack Surface Reduction (ASR)** | Set of rules in Microsoft Defender Exploit Guard that block specific attack behaviors like Office macro child processes |\n| **Software Restriction Policies (SRP)** | Legacy Windows feature (deprecated in Win 11) for restricting executables; replaced by AppLocker and WDAC |\n| **WDAC** | Windows Defender Application Control; the successor to AppLocker with stronger enforcement using code integrity policies |\n\n## Tools & Systems\n\n- **Group Policy Management Console (GPMC)**: Primary tool for creating and managing GPOs in Active Directory\n- **AppLocker**: Built-in Windows application whitelisting and blacklisting engine\n- **Microsoft Defender Exploit Guard**: Suite including CFA, ASR rules, and Network Protection\n- **GPResult**: Command-line tool for verifying GPO application status on endpoints\n- **PowerShell Get-MpPreference**: Cmdlet for querying Microsoft Defender configuration including ASR and CFA status\n","# Implementing Anti-Ransomware Group Policy\n\n## When to Use\n\n- Hardening a Windows Active Directory environment against ransomware execution and propagation\n- Implementing defense-in-depth by blocking ransomware execution paths via Group Policy\n- Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories\n- Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications\n- Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain\n\n**Do not use** as a standalone ransomware defense. GPO settings complement but do not replace endpoint detection, backups, network segmentation, and user awareness training.\n\n## Prerequisites\n\n- Windows Server 2016+ Active Directory environment with Group Policy Management Console (GPMC)\n- Domain Admin or Group Policy Creator Owners privileges\n- Windows 10\u002F11 Enterprise or Education (required for AppLocker and WDAC)\n- Microsoft Defender Antivirus enabled (required for Controlled Folder Access and ASR rules)\n- Python 3.8+ for audit script that validates GPO compliance\n- Test OU for validating GPO settings before domain-wide deployment\n\n## Workflow\n\n### Step 1: Block Ransomware Execution Paths with AppLocker\n\nConfigure AppLocker to prevent executables from running in common ransomware staging locations:\n\n```\nAppLocker GPO Path:\n  Computer Configuration → Policies → Windows Settings →\n  Security Settings → Application Control Policies → AppLocker\n\nKey Rules:\n━━━━━━━━━\n1. DENY executable rules for user-writable paths:\n   - %USERPROFILE%\\AppData\\Local\\Temp\\*     (email attachment extraction)\n   - %USERPROFILE%\\AppData\\Roaming\\*         (CryptoLocker staging)\n   - %USERPROFILE%\\Downloads\\*               (web downloads)\n   - %TEMP%\\*                                (temporary extraction)\n   - %USERPROFILE%\\Desktop\\*                 (social engineering drops)\n\n2. ALLOW default rules:\n   - C:\\Windows\\* (signed by Microsoft)\n   - C:\\Program Files\\* and C:\\Program Files (x86)\\*\n   - Administrator group: all paths\n\n3. Enable Application Identity service:\n   Computer Configuration → Policies → Windows Settings →\n   Security Settings → System Services →\n   Application Identity → Automatic\n```\n\n### Step 2: Enable Controlled Folder Access\n\nProtect critical directories from unauthorized modification:\n\n```\nControlled Folder Access GPO Path:\n  Computer Configuration → Administrative Templates →\n  Windows Components → Microsoft Defender Antivirus →\n  Microsoft Defender Exploit Guard → Controlled Folder Access\n\nSettings:\n━━━━━━━━━\n1. Configure Controlled folder access: Enabled → Block mode\n2. Configure protected folders: Add custom paths\n   - \\\\fileserver\\shares\\finance\n   - \\\\fileserver\\shares\\hr\n   - C:\\Users\\*\\Documents\n   - C:\\Users\\*\\Desktop\n\n3. Configure allowed applications: Whitelist trusted apps\n   - C:\\Program Files\\Microsoft Office\\*\n   - C:\\Program Files\\Adobe\\*\n   - Line-of-business applications\n\nDefault protected folders (automatic):\n  Documents, Pictures, Videos, Music, Desktop, Favorites\n```\n\n### Step 3: Configure Attack Surface Reduction (ASR) Rules\n\nEnable ASR rules that target ransomware delivery mechanisms:\n\n```\nASR Rules GPO Path:\n  Computer Configuration → Administrative Templates →\n  Windows Components → Microsoft Defender Antivirus →\n  Microsoft Defender Exploit Guard → Attack Surface Reduction\n\nCritical ASR Rules for Ransomware Prevention:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nGUID                                    Rule\nBE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550   Block executable content from email\nD4F940AB-401B-4EFC-AADC-AD5F3C50688A   Block Office apps from creating child processes\n3B576869-A4EC-4529-8536-B80A7769E899   Block Office apps from creating executable content\n75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84   Block Office apps from injecting into processes\nD3E037E1-3EB8-44C8-A917-57927947596D   Block JavaScript\u002FVBScript from launching downloads\n5BEB7EFE-FD9A-4556-801D-275E5FFC04CC   Block execution of obfuscated scripts\n92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B   Block Win32 API calls from Office macros\n01443614-CD74-433A-B99E-2ECDC07BFC25   Block executable files unless they meet prevalence criteria\n\nSet each rule to: Block (1) or Audit (2) for initial testing\n```\n\n### Step 4: Restrict Lateral Movement Vectors\n\nLock down SMB, RDP, and WMI to limit ransomware propagation:\n\n```\nNetwork Restrictions:\n━━━━━━━━━━━━━━━━━━━━\n1. Disable SMBv1:\n   Computer Configuration → Administrative Templates →\n   Network → Lanman Workstation → Enable insecure guest logons: Disabled\n\n   Computer Configuration → Administrative Templates →\n   MS Security Guide → Configure SMBv1 server: Disabled\n\n2. Restrict Remote Desktop:\n   Computer Configuration → Administrative Templates →\n   Windows Components → Remote Desktop Services →\n   Remote Desktop Session Host → Connections →\n   Allow users to connect remotely: Disabled (or restricted to specific groups)\n\n3. Disable remote WMI:\n   Windows Firewall → Inbound Rules →\n   Block Windows Management Instrumentation (WMI) inbound\n\n4. Disable AutoPlay\u002FAutoRun:\n   Computer Configuration → Administrative Templates →\n   Windows Components → AutoPlay Policies →\n   Turn off AutoPlay: Enabled (All drives)\n\n5. Disable PowerShell remoting for non-admin users:\n   Computer Configuration → Administrative Templates →\n   Windows Components → Windows PowerShell →\n   Turn on Script Execution: Allow only signed scripts\n```\n\n### Step 5: Audit and Validate GPO Compliance\n\nVerify that GPO settings are applied correctly across the domain:\n\n```powershell\n# Check GPO application on endpoint\ngpresult \u002Fr \u002Fscope:computer\n\n# Verify AppLocker rules\nGet-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections\n\n# Check Controlled Folder Access status\nGet-MpPreference | Select-Object EnableControlledFolderAccess\n\n# List protected folders\nGet-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessProtectedFolders\n\n# Check ASR rules\nGet-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids\nGet-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions\n```\n\n## Verification\n\n- Run `gpresult \u002Fr` on test endpoints to confirm GPO application\n- Attempt to run an executable from `%AppData%\\Temp` to verify AppLocker blocks it\n- Modify a file in a protected folder from an unlisted application to confirm CFA blocks it\n- Test ASR rules by opening a macro-enabled document and verifying child process blocking\n- Validate that legitimate applications in the allowlist still function correctly\n- Check Windows Event Log for AppLocker events (Event IDs 8003, 8004) and CFA events (1123, 1124)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **AppLocker** | Windows application control feature that restricts which executables, scripts, and DLLs users can run based on publisher, path, or hash rules |\n| **Controlled Folder Access** | Microsoft Defender feature that prevents untrusted applications from modifying files in protected directories |\n| **Attack Surface Reduction (ASR)** | Set of rules in Microsoft Defender Exploit Guard that block specific attack behaviors like Office macro child processes |\n| **Software Restriction Policies (SRP)** | Legacy Windows feature (deprecated in Win 11) for restricting executables; replaced by AppLocker and WDAC |\n| **WDAC** | Windows Defender Application Control; the successor to AppLocker with stronger enforcement using code integrity policies |\n\n## Tools & Systems\n\n- **Group Policy Management Console (GPMC)**: Primary tool for creating and managing GPOs in Active Directory\n- **AppLocker**: Built-in Windows application whitelisting and blacklisting engine\n- **Microsoft Defender Exploit Guard**: Suite including CFA, ASR rules, and Network Protection\n- **GPResult**: Command-line tool for verifying GPO application status on endpoints\n- **PowerShell Get-MpPreference**: Cmdlet for querying Microsoft Defender configuration including ASR and CFA status\n",{"name":5,"tags":49,"author":51,"domain":43,"license":15,"version":52,"mitre_f3":53,"nist_csf":73,"subdomain":78,"description":7,"mitre_attack":79},[25,30,42,29,50,28],"hardening","mahipal","1.0.0",{"tactics":54,"version":57,"techniques":58},[31,55,56],"positioning","monetization","1.1",[59,63,66,69],{"id":60,"name":61,"source":62,"tactic":31},"T1660","Phishing","attack",{"id":64,"name":65,"source":62,"tactic":55},"T1219","Remote Access Tools",{"id":67,"name":68,"source":62,"tactic":55},"T1531","Account Access Removal",{"id":70,"name":71,"source":72,"tactic":56},"F1018","Convert to Cryptocurrency","f3",[74,75,76,77],"PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01","ransomware-defense",[80,81,82,83,84],"T1078","T1190","T1059","T1486","T1490","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-anti-ransomware-group-policy",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":96,"prompt":106,"zipAvailable":107},[97,100,103],{"tool":98,"command":99},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-anti-ransomware-group-policy",{"tool":101,"command":102},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-anti-ransomware-group-policy",{"tool":104,"command":105},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-anti-ransomware-group-policy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-anti-ransomware-group-policy\u002FSKILL.md",true,[109,114,120],{"path":110,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-anti-ransomware-group-policy\u002FLICENSE",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fapi-reference.md","REFERENCE","参考文档",3986,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-anti-ransomware-group-policy\u002Freferences\u002Fapi-reference.md",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fagent.py","SCRIPT","脚本",12246,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-anti-ransomware-group-policy\u002Fscripts\u002Fagent.py",[127,153,175,199,224,251],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,136,137,138,139,43,140,141,41,142,143,144,145,146,147,148,149,150,151,152],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[159],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[161,149,162,163,139,26,43,41,164,165,166,35,167,168,169,170,171,172,173,174],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[181,184],{"categoryNo":182,"categoryName":183,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[169,186,187,188,189,43,190,191,164,192,193,194,25,38,195,27,32,196,197,198],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","detection","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,207,208,43,209,210,211,212,213,214,215,216,217,218,219,220,35,221,222,223],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[230],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[232,233,234,43,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,259,43,260,261,262,263,264,265,266,267,27,34,32,268,269,270,271,272,273],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]