[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEZQ0JHH74HT31YHX2M5MG":3,"skill-same:01M6AEZQ0JHH74HT31YHX2M5MG":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6AEZQ0JHH74HT31YHX2M5MG","implementing-attack-path-analysis-with-xm-cyber",null,"Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward critical assets, identifying the small fraction of exposures sitting on converging \"choke points\". Use when mapping attack paths across an environment or prioritizing remediation within a continuous threat exposure management (CTEM) program.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37],"attack path analysis","implementing attack path analysis with xm cyber","cybersecurity","vulnerabilities","identity","vulnerability-management","remediation","attack-surface","xm-cyber","attack-path-analysis","exposure-management","ctem","choke-points","breach-simulation","2026-11-10 10:12:30",false,"---\nname: implementing-attack-path-analysis-with-xm-cyber\ndescription: Deploys XM Cyber's continuous exposure management platform to build\n  attack graphs that chain vulnerabilities, misconfigurations, identity risks, and\n  credential weaknesses toward critical assets, identifying the small fraction of\n  exposures sitting on converging \"choke points\". Use when mapping attack paths\n  across an environment or prioritizing remediation within a continuous threat exposure\n  management (CTEM) program.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- xm-cyber\n- attack-path-analysis\n- exposure-management\n- ctem\n- choke-points\n- breach-simulation\n- attack-surface\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n---\n# Implementing Attack Path Analysis with XM Cyber\n\n## Overview\nXM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on \"choke points\" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.\n\n\n## When to Use\n\n- When deploying or configuring implementing attack path analysis with xm cyber capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- XM Cyber platform license and tenant access\n- Network connectivity to monitored environments (on-premises, cloud, hybrid)\n- Administrative access for agent deployment or agentless integration\n- Cloud provider API access (AWS, Azure, GCP) for cloud attack path analysis\n- Active Directory read access for identity-based attack path modeling\n- CMDB or asset inventory defining critical business assets\n\n## Core Concepts\n\n### Attack Graph Analysis\nUnlike point-in-time vulnerability scanning, XM Cyber continuously models all possible attack paths across the entire environment:\n\n| Traditional Scanning | XM Cyber Attack Path Analysis |\n|---------------------|-------------------------------|\n| Lists individual vulnerabilities | Maps chained attack paths |\n| Scores by CVSS severity | Scores by reachability to critical assets |\n| Point-in-time assessment | Continuous real-time modeling |\n| No context of lateral movement | Models full lateral movement chains |\n| Treats each vuln independently | Shows how vulns chain together |\n\n### Key Metrics from XM Cyber Research (2024)\n\n| Finding | Statistic |\n|---------|-----------|\n| Average exposures per organization | ~15,000 |\n| CVE-based exposures | \u003C 1% of total |\n| Misconfiguration-based exposures | ~80% of total |\n| Exposures on critical choke points | 2% |\n| Orgs where attackers can pivot on-prem to cloud | 70% |\n| Cloud critical assets compromisable in 2 hops | 93% |\n| Critical asset exposures in cloud platforms | 56% |\n\n### Choke Point Concept\nA choke point is a single entity (host, identity, credential, misconfiguration) that sits at the intersection of multiple attack paths leading to critical assets. Fixing a choke point eliminates many attack paths simultaneously, providing maximum risk reduction per remediation effort.\n\n```\nAttack Path 1:  Web Server -> SQL Injection -> DB Admin Creds\n                                                    \\\nAttack Path 2:  VPN -> Stolen Creds -> File Server   -> Domain Controller\n                                                    \u002F     (Critical Asset)\nAttack Path 3:  Workstation -> Mimikatz -> Cached Creds\n                                    ^\n                              CHOKE POINT\n                     (Cached Domain Admin credential)\n```\n\n### Exposure Categories\n\n| Category | % of Exposures | Examples |\n|----------|---------------|----------|\n| Identity & Credentials | 40% | Cached credentials, over-privileged accounts, Kerberoastable SPNs |\n| Misconfigurations | 38% | Open shares, weak permissions, missing hardening |\n| Network Exposures | 12% | Open ports, flat networks, missing segmentation |\n| Software Vulnerabilities | 8% | Unpatched CVEs, outdated software |\n| Cloud Exposures | 2% | IAM misconfig, public storage, overly permissive roles |\n\n## Workflow\n\n### Step 1: Define Critical Assets (Business Context)\n\n```\nCritical Asset Definition:\n    Tier 1 - Crown Jewels:\n        - Domain Controllers (Active Directory)\n        - Database servers with PII\u002Ffinancial data\n        - ERP systems (SAP, Oracle)\n        - Certificate Authority servers\n        - Backup infrastructure (Veeam, Commvault)\n\n    Tier 2 - High Value:\n        - Email servers (Exchange)\n        - File servers with IP\u002Ftrade secrets\n        - CI\u002FCD pipeline servers\n        - Jump servers \u002F PAM vaults\n\n    Tier 3 - Supporting Infrastructure:\n        - DNS\u002FDHCP servers\n        - Monitoring systems\n        - Logging infrastructure\n```\n\n### Step 2: Deploy XM Cyber Sensors\n\n```\nDeployment Architecture:\n    On-Premises:\n        - Install XM Cyber sensor on management server\n        - Configure AD integration (read-only service account)\n        - Enable network discovery protocols\n        - Set scanning scope (IP ranges, AD OUs)\n\n    Cloud (AWS):\n        - Deploy XM Cyber CloudConnect via CloudFormation\n        - Configure IAM role with read-only permissions\n        - Enable cross-account scanning for multi-account orgs\n\n    Cloud (Azure):\n        - Deploy via Azure Marketplace\n        - Configure Entra ID (Azure AD) integration\n        - Grant Reader role on subscriptions\n\n    Hybrid:\n        - Configure cross-environment path analysis\n        - Map on-premises to cloud trust relationships\n        - Enable identity correlation across environments\n```\n\n### Step 3: Configure Attack Scenarios\n\n```\nScenario 1: External Attacker to Domain Admin\n    Starting Point:  Internet-facing assets\n    Target:          Domain Admin privileges\n    Attack Techniques: Exploit public CVEs, credential theft,\n                      lateral movement, privilege escalation\n\nScenario 2: Insider Threat to Financial Data\n    Starting Point:  Any corporate workstation\n    Target:          Financial database servers\n    Attack Techniques: Credential harvesting, share enumeration,\n                      privilege escalation, data access\n\nScenario 3: Cloud Account Takeover\n    Starting Point:  Compromised cloud IAM user\n    Target:          Production cloud infrastructure\n    Attack Techniques: IAM privilege escalation, cross-account\n                      pivot, storage access, compute compromise\n\nScenario 4: Ransomware Propagation\n    Starting Point:  Phished workstation\n    Target:          Maximum host compromise (lateral spread)\n    Attack Techniques: Credential reuse, SMB exploitation,\n                      PsExec\u002FWMI lateral movement\n```\n\n### Step 4: Analyze Attack Path Results\n\n```python\n# Interpreting XM Cyber attack path analysis results\ndef analyze_choke_points(attack_graph_results):\n    \"\"\"Analyze attack graph results for priority remediation.\"\"\"\n\n    choke_points = []\n    for entity in attack_graph_results.get(\"entities\", []):\n        if entity.get(\"is_choke_point\"):\n            choke_points.append({\n                \"entity_name\": entity[\"name\"],\n                \"entity_type\": entity[\"type\"],\n                \"attack_paths_blocked\": entity[\"paths_through\"],\n                \"critical_assets_protected\": entity[\"protects_assets\"],\n                \"remediation_complexity\": entity[\"fix_complexity\"],\n                \"exposure_type\": entity[\"exposure_category\"],\n            })\n\n    # Sort by impact (paths blocked * assets protected)\n    choke_points.sort(\n        key=lambda x: x[\"attack_paths_blocked\"] * len(x[\"critical_assets_protected\"]),\n        reverse=True\n    )\n\n    print(f\"Total choke points identified: {len(choke_points)}\")\n    print(f\"\\nTop 10 choke points for maximum risk reduction:\")\n    for i, cp in enumerate(choke_points[:10], 1):\n        print(f\"  {i}. {cp['entity_name']} ({cp['entity_type']})\")\n        print(f\"     Paths blocked: {cp['attack_paths_blocked']}\")\n        print(f\"     Assets protected: {len(cp['critical_assets_protected'])}\")\n        print(f\"     Exposure type: {cp['exposure_type']}\")\n        print(f\"     Fix complexity: {cp['remediation_complexity']}\")\n\n    return choke_points\n```\n\n### Step 5: Prioritize Remediation by Impact\n\n```\nRemediation Priority Matrix:\n\nPriority 1 (Immediate - 48h):\n    - Choke points on paths to Tier 1 assets\n    - Identity exposures (cached Domain Admin creds)\n    - Internet-facing vulnerabilities with attack paths\n\nPriority 2 (Urgent - 7 days):\n    - Choke points on paths to Tier 2 assets\n    - Cloud IAM misconfigurations with privilege escalation\n    - Network segmentation gaps enabling lateral movement\n\nPriority 3 (Important - 30 days):\n    - Remaining choke points\n    - Misconfigurations reducing defense depth\n    - Non-critical software vulnerabilities on attack paths\n\nPriority 4 (Standard - 90 days):\n    - Exposures NOT on any attack path to critical assets\n    - Informational findings\n    - Hardening recommendations\n```\n\n## Best Practices\n1. Define critical assets before deploying the platform; attack paths without target context are meaningless\n2. Focus remediation on choke points first; fixing 2% of exposures can eliminate the majority of risk\n3. Use attack path context to justify remediation urgency to IT teams (show the chain, not just the vuln)\n4. Re-run attack path analysis after each remediation to verify paths are truly eliminated\n5. Include cloud environments in analysis; 56% of critical asset exposures exist in cloud platforms\n6. Monitor for new attack paths created by infrastructure changes (new servers, permission changes)\n7. Integrate findings with ticketing systems for automated remediation tracking\n\n## Common Pitfalls\n- Focusing solely on CVEs when 80% of exposures come from misconfigurations\n- Not defining critical assets, leading to unfocused attack path analysis\n- Treating all exposures equally instead of focusing on choke points\n- Ignoring identity-based attack paths (cached credentials, Kerberoastable accounts)\n- Not correlating on-premises and cloud attack paths in hybrid environments\n- Running analysis once instead of continuously\n\n## Related Skills\n- implementing-continuous-security-validation-with-bas\n- performing-asset-criticality-scoring-for-vulns\n- detecting-lateral-movement-in-network\n- exploiting-active-directory-with-bloodhound\n","# Implementing Attack Path Analysis with XM Cyber\n\n## Overview\nXM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on \"choke points\" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.\n\n\n## When to Use\n\n- When deploying or configuring implementing attack path analysis with xm cyber capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- XM Cyber platform license and tenant access\n- Network connectivity to monitored environments (on-premises, cloud, hybrid)\n- Administrative access for agent deployment or agentless integration\n- Cloud provider API access (AWS, Azure, GCP) for cloud attack path analysis\n- Active Directory read access for identity-based attack path modeling\n- CMDB or asset inventory defining critical business assets\n\n## Core Concepts\n\n### Attack Graph Analysis\nUnlike point-in-time vulnerability scanning, XM Cyber continuously models all possible attack paths across the entire environment:\n\n| Traditional Scanning | XM Cyber Attack Path Analysis |\n|---------------------|-------------------------------|\n| Lists individual vulnerabilities | Maps chained attack paths |\n| Scores by CVSS severity | Scores by reachability to critical assets |\n| Point-in-time assessment | Continuous real-time modeling |\n| No context of lateral movement | Models full lateral movement chains |\n| Treats each vuln independently | Shows how vulns chain together |\n\n### Key Metrics from XM Cyber Research (2024)\n\n| Finding | Statistic |\n|---------|-----------|\n| Average exposures per organization | ~15,000 |\n| CVE-based exposures | \u003C 1% of total |\n| Misconfiguration-based exposures | ~80% of total |\n| Exposures on critical choke points | 2% |\n| Orgs where attackers can pivot on-prem to cloud | 70% |\n| Cloud critical assets compromisable in 2 hops | 93% |\n| Critical asset exposures in cloud platforms | 56% |\n\n### Choke Point Concept\nA choke point is a single entity (host, identity, credential, misconfiguration) that sits at the intersection of multiple attack paths leading to critical assets. Fixing a choke point eliminates many attack paths simultaneously, providing maximum risk reduction per remediation effort.\n\n```\nAttack Path 1:  Web Server -> SQL Injection -> DB Admin Creds\n                                                    \\\nAttack Path 2:  VPN -> Stolen Creds -> File Server   -> Domain Controller\n                                                    \u002F     (Critical Asset)\nAttack Path 3:  Workstation -> Mimikatz -> Cached Creds\n                                    ^\n                              CHOKE POINT\n                     (Cached Domain Admin credential)\n```\n\n### Exposure Categories\n\n| Category | % of Exposures | Examples |\n|----------|---------------|----------|\n| Identity & Credentials | 40% | Cached credentials, over-privileged accounts, Kerberoastable SPNs |\n| Misconfigurations | 38% | Open shares, weak permissions, missing hardening |\n| Network Exposures | 12% | Open ports, flat networks, missing segmentation |\n| Software Vulnerabilities | 8% | Unpatched CVEs, outdated software |\n| Cloud Exposures | 2% | IAM misconfig, public storage, overly permissive roles |\n\n## Workflow\n\n### Step 1: Define Critical Assets (Business Context)\n\n```\nCritical Asset Definition:\n    Tier 1 - Crown Jewels:\n        - Domain Controllers (Active Directory)\n        - Database servers with PII\u002Ffinancial data\n        - ERP systems (SAP, Oracle)\n        - Certificate Authority servers\n        - Backup infrastructure (Veeam, Commvault)\n\n    Tier 2 - High Value:\n        - Email servers (Exchange)\n        - File servers with IP\u002Ftrade secrets\n        - CI\u002FCD pipeline servers\n        - Jump servers \u002F PAM vaults\n\n    Tier 3 - Supporting Infrastructure:\n        - DNS\u002FDHCP servers\n        - Monitoring systems\n        - Logging infrastructure\n```\n\n### Step 2: Deploy XM Cyber Sensors\n\n```\nDeployment Architecture:\n    On-Premises:\n        - Install XM Cyber sensor on management server\n        - Configure AD integration (read-only service account)\n        - Enable network discovery protocols\n        - Set scanning scope (IP ranges, AD OUs)\n\n    Cloud (AWS):\n        - Deploy XM Cyber CloudConnect via CloudFormation\n        - Configure IAM role with read-only permissions\n        - Enable cross-account scanning for multi-account orgs\n\n    Cloud (Azure):\n        - Deploy via Azure Marketplace\n        - Configure Entra ID (Azure AD) integration\n        - Grant Reader role on subscriptions\n\n    Hybrid:\n        - Configure cross-environment path analysis\n        - Map on-premises to cloud trust relationships\n        - Enable identity correlation across environments\n```\n\n### Step 3: Configure Attack Scenarios\n\n```\nScenario 1: External Attacker to Domain Admin\n    Starting Point:  Internet-facing assets\n    Target:          Domain Admin privileges\n    Attack Techniques: Exploit public CVEs, credential theft,\n                      lateral movement, privilege escalation\n\nScenario 2: Insider Threat to Financial Data\n    Starting Point:  Any corporate workstation\n    Target:          Financial database servers\n    Attack Techniques: Credential harvesting, share enumeration,\n                      privilege escalation, data access\n\nScenario 3: Cloud Account Takeover\n    Starting Point:  Compromised cloud IAM user\n    Target:          Production cloud infrastructure\n    Attack Techniques: IAM privilege escalation, cross-account\n                      pivot, storage access, compute compromise\n\nScenario 4: Ransomware Propagation\n    Starting Point:  Phished workstation\n    Target:          Maximum host compromise (lateral spread)\n    Attack Techniques: Credential reuse, SMB exploitation,\n                      PsExec\u002FWMI lateral movement\n```\n\n### Step 4: Analyze Attack Path Results\n\n```python\n# Interpreting XM Cyber attack path analysis results\ndef analyze_choke_points(attack_graph_results):\n    \"\"\"Analyze attack graph results for priority remediation.\"\"\"\n\n    choke_points = []\n    for entity in attack_graph_results.get(\"entities\", []):\n        if entity.get(\"is_choke_point\"):\n            choke_points.append({\n                \"entity_name\": entity[\"name\"],\n                \"entity_type\": entity[\"type\"],\n                \"attack_paths_blocked\": entity[\"paths_through\"],\n                \"critical_assets_protected\": entity[\"protects_assets\"],\n                \"remediation_complexity\": entity[\"fix_complexity\"],\n                \"exposure_type\": entity[\"exposure_category\"],\n            })\n\n    # Sort by impact (paths blocked * assets protected)\n    choke_points.sort(\n        key=lambda x: x[\"attack_paths_blocked\"] * len(x[\"critical_assets_protected\"]),\n        reverse=True\n    )\n\n    print(f\"Total choke points identified: {len(choke_points)}\")\n    print(f\"\\nTop 10 choke points for maximum risk reduction:\")\n    for i, cp in enumerate(choke_points[:10], 1):\n        print(f\"  {i}. {cp['entity_name']} ({cp['entity_type']})\")\n        print(f\"     Paths blocked: {cp['attack_paths_blocked']}\")\n        print(f\"     Assets protected: {len(cp['critical_assets_protected'])}\")\n        print(f\"     Exposure type: {cp['exposure_type']}\")\n        print(f\"     Fix complexity: {cp['remediation_complexity']}\")\n\n    return choke_points\n```\n\n### Step 5: Prioritize Remediation by Impact\n\n```\nRemediation Priority Matrix:\n\nPriority 1 (Immediate - 48h):\n    - Choke points on paths to Tier 1 assets\n    - Identity exposures (cached Domain Admin creds)\n    - Internet-facing vulnerabilities with attack paths\n\nPriority 2 (Urgent - 7 days):\n    - Choke points on paths to Tier 2 assets\n    - Cloud IAM misconfigurations with privilege escalation\n    - Network segmentation gaps enabling lateral movement\n\nPriority 3 (Important - 30 days):\n    - Remaining choke points\n    - Misconfigurations reducing defense depth\n    - Non-critical software vulnerabilities on attack paths\n\nPriority 4 (Standard - 90 days):\n    - Exposures NOT on any attack path to critical assets\n    - Informational findings\n    - Hardening recommendations\n```\n\n## Best Practices\n1. Define critical assets before deploying the platform; attack paths without target context are meaningless\n2. Focus remediation on choke points first; fixing 2% of exposures can eliminate the majority of risk\n3. Use attack path context to justify remediation urgency to IT teams (show the chain, not just the vuln)\n4. Re-run attack path analysis after each remediation to verify paths are truly eliminated\n5. Include cloud environments in analysis; 56% of critical asset exposures exist in cloud platforms\n6. Monitor for new attack paths created by infrastructure changes (new servers, permission changes)\n7. Integrate findings with ticketing systems for automated remediation tracking\n\n## Common Pitfalls\n- Focusing solely on CVEs when 80% of exposures come from misconfigurations\n- Not defining critical assets, leading to unfocused attack path analysis\n- Treating all exposures equally instead of focusing on choke points\n- Ignoring identity-based attack paths (cached credentials, Kerberoastable accounts)\n- Not correlating on-premises and cloud attack paths in hybrid environments\n- Running analysis once instead of continuously\n\n## Related Skills\n- implementing-continuous-security-validation-with-bas\n- performing-asset-criticality-scoring-for-vulns\n- detecting-lateral-movement-in-network\n- exploiting-active-directory-with-bloodhound\n",{"name":5,"tags":43,"author":44,"domain":26,"license":15,"version":45,"nist_csf":46,"subdomain":29,"description":7,"mitre_attack":51},[32,33,34,35,36,37,31],"mahipal","1.0",[47,48,49,50],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[52,53,54],"T1190","T1203","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-attack-path-analysis-with-xm-cyber",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-attack-path-analysis-with-xm-cyber",{"tool":71,"command":72},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-attack-path-analysis-with-xm-cyber",{"tool":74,"command":75},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-attack-path-analysis-with-xm-cyber","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002FSKILL.md",true,[79,85,90,96,100,104,110],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"assets\u002Ftemplate.md","ASSET","资产文件",1241,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002Fassets\u002Ftemplate.md",{"path":86,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002FLICENSE",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md","REFERENCE","参考文档",1708,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fstandards.md",1324,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002Freferences\u002Fstandards.md",{"path":101,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fworkflows.md",2928,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002Freferences\u002Fworkflows.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",5714,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002Fscripts\u002Fagent.py",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fprocess.py",8848,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-attack-path-analysis-with-xm-cyber\u002Fscripts\u002Fprocess.py",[115,141,165,193,219,243],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":38},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,127,26,128,28,129,130,131,132,133,134,135,136,137,138,139,140],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":38},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,137,150,151,127,152,26,129,153,154,155,156,157,158,159,160,161,162,163,164],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":38},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,176,177,178,179,26,180,181,153,182,183,184,185,186,187,188,189,190,191,192],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":38},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[199],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[201,202,203,26,204,205,206,207,208,209,210,211,212,213,214,215,156,216,217,218],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":38},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[225],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,227,228,26,229,230,231,29,232,233,234,235,236,30,237,238,239,240,241,242],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":38},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,251,26,252,253,254,255,256,257,258,259,188,260,189,261,262,263,264,265,266],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]