[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF3MAZG7MGBZ887N1JS92J":3,"skill-same:01M6AF3MAZG7MGBZ887N1JS92J":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AF3MAZG7MGBZ887N1JS92J","implementing-disk-encryption-with-bitlocker",null,"Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"encryption","implementing disk encryption with bitlocker","REST","cybersecurity","TPM","BitLocker","data-at-rest","t1547","t1059","windows-security","endpoint","microsoft","security","endpoint-security","data","Enterprise","data protection","compliance","pr","windows","2026-11-10 10:12:30",false,"---\nname: implementing-disk-encryption-with-bitlocker\ndescription: 'Implements full disk encryption using Microsoft BitLocker on Windows\n  endpoints to protect data at rest from unauthorized access in case of device loss\n  or theft. Use when deploying encryption for compliance requirements, securing mobile\n  workstations, or implementing data protection controls across the enterprise. Activates\n  for requests involving BitLocker encryption, disk encryption, TPM configuration,\n  or data-at-rest protection.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- encryption\n- BitLocker\n- TPM\n- data-protection\n- windows-security\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n- T1573\n---\n# Implementing Disk Encryption with BitLocker\n\n## When to Use\n\nUse this skill when:\n- Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)\n- Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO\n- Configuring TPM-based encryption with PIN or USB startup key for enhanced security\n- Managing BitLocker recovery keys in Active Directory or Azure AD\n\n**Do not use** this skill for Linux disk encryption (use LUKS\u002Fdm-crypt) or macOS (use FileVault).\n\n## Prerequisites\n\n- Windows 10\u002F11 Pro, Enterprise, or Education edition\n- TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)\n- UEFI firmware with Secure Boot enabled (recommended)\n- Separate system partition (200 MB minimum, created automatically by Windows installer)\n- Active Directory or Azure AD for recovery key escrow\n\n## Workflow\n\n### Step 1: Verify TPM and System Requirements\n\n```powershell\n# Check TPM status\nGet-Tpm\n# ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled\n\n# Check TPM version (2.0 required for best compatibility)\n(Get-WmiObject -Namespace \"root\\cimv2\\security\\microsofttpm\" -Class Win32_Tpm).SpecVersion\n\n# Check UEFI\u002FSecure Boot\nConfirm-SecureBootUEFI\n# Returns True if Secure Boot is enabled\n\n# Check BitLocker readiness\n$vol = Get-BitLockerVolume -MountPoint \"C:\"\n$vol.VolumeStatus  # Should be \"FullyDecrypted\"\n$vol.ProtectionStatus  # Should be \"Off\"\n```\n\n### Step 2: Configure BitLocker GPO Settings\n\n```\nComputer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption\n\nOperating System Drives:\n  - Require additional authentication at startup: Enabled\n    - Allow BitLocker without compatible TPM: Disabled (enforce TPM)\n    - Configure TPM startup: Allow TPM\n    - Configure TPM startup PIN: Allow startup PIN with TPM\n    - Configure TPM startup key: Allow startup key with TPM\n\n  - Choose how BitLocker-protected OS drives can be recovered: Enabled\n    - Allow data recovery agent: True\n    - Configure storage of recovery information to AD DS: Enabled\n    - Save recovery info to AD DS for OS drives: Store recovery passwords and key packages\n    - Do not enable BitLocker until recovery information is stored: Enabled\n\n  - Choose drive encryption method and cipher strength:\n    - OS drives: XTS-AES 256-bit (Windows 10 1511+)\n    - Fixed drives: XTS-AES 256-bit\n    - Removable drives: AES-CBC 256-bit (for cross-platform compatibility)\n\nFixed Data Drives:\n  - Choose how BitLocker-protected fixed drives can be recovered: Enabled\n    - Store recovery passwords in AD DS: Enabled\n\nRemovable Data Drives:\n  - Control use of BitLocker on removable drives: Enabled\n  - Configure use of passwords for removable drives: Require complexity\n```\n\n### Step 3: Enable BitLocker - Command Line\n\n```powershell\n# Enable BitLocker with TPM-only protector (transparent to user)\nEnable-BitLocker -MountPoint \"C:\" -EncryptionMethod XtsAes256 `\n  -TpmProtector -SkipHardwareTest\n\n# Enable BitLocker with TPM + PIN (recommended for laptops)\n$pin = ConvertTo-SecureString \"123456\" -AsPlainText -Force\nEnable-BitLocker -MountPoint \"C:\" -EncryptionMethod XtsAes256 `\n  -TpmAndPinProtector -Pin $pin\n\n# Add recovery password protector\nAdd-BitLockerKeyProtector -MountPoint \"C:\" -RecoveryPasswordProtector\n\n# Backup recovery key to Active Directory\nBackup-BitLockerKeyProtector -MountPoint \"C:\" `\n  -KeyProtectorId (Get-BitLockerVolume -MountPoint \"C:\").KeyProtector[1].KeyProtectorId\n\n# Encrypt fixed data drives\nEnable-BitLocker -MountPoint \"D:\" -EncryptionMethod XtsAes256 `\n  -RecoveryPasswordProtector -AutoUnlockEnabled\n```\n\n### Step 4: Deploy via Intune (Enterprise)\n\n```\nIntune → Endpoint Security → Disk encryption → Create Profile\n\nPlatform: Windows 10 and later\nProfile: BitLocker\n\nSettings:\n  BitLocker base settings:\n    - Encryption for operating system drives: Require\n    - Encryption for fixed data drives: Require\n    - Encryption for removable data drives: Require\n\n  Operating system drive settings:\n    - Additional authentication at startup: Require\n    - TPM startup: Allowed\n    - TPM startup PIN: Required (for high-security endpoints)\n    - Encryption method: XTS-AES 256-bit\n    - Recovery: Escrow to Azure AD\n\n  Fixed drive settings:\n    - Encryption method: XTS-AES 256-bit\n    - Recovery: Escrow to Azure AD\n\n  Assign to: All managed Windows devices (or specific groups)\n```\n\n### Step 5: Manage Recovery Keys\n\n```powershell\n# View recovery key on local system\n(Get-BitLockerVolume -MountPoint \"C:\").KeyProtector |\n  Where-Object {$_.KeyProtectorType -eq \"RecoveryPassword\"} |\n  Select-Object KeyProtectorId, RecoveryPassword\n\n# Retrieve recovery key from Active Directory (requires RSAT)\nGet-ADObject -Filter {objectClass -eq \"msFVE-RecoveryInformation\"} `\n  -SearchBase \"CN=COMPUTER01,OU=Workstations,DC=corp,DC=example,DC=com\" `\n  -Properties msFVE-RecoveryPassword |\n  Select-Object -ExpandProperty msFVE-RecoveryPassword\n\n# Retrieve recovery key from Azure AD\n# Azure Portal → Azure AD → Devices → [device] → BitLocker keys\n# Or via Microsoft Graph API:\n# GET \u002Fdevices\u002F{id}\u002FbitlockerRecoveryKeys\n```\n\n### Step 6: Monitor Encryption Status\n\n```powershell\n# Check encryption status across fleet\nmanage-bde -status C:\n\n# Expected output for encrypted drive:\n#   Conversion Status: Fully Encrypted\n#   Percentage Encrypted: 100.0%\n#   Encryption Method: XTS-AES 256\n#   Protection Status: Protection On\n#   Key Protectors: TPM, Numerical Password\n\n# PowerShell compliance check\n$vol = Get-BitLockerVolume -MountPoint \"C:\"\nif ($vol.ProtectionStatus -eq \"On\" -and $vol.VolumeStatus -eq \"FullyEncrypted\") {\n    Write-Host \"COMPLIANT: BitLocker enabled and fully encrypted\"\n} else {\n    Write-Host \"NON-COMPLIANT: BitLocker status - Protection: $($vol.ProtectionStatus), Volume: $($vol.VolumeStatus)\"\n}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TPM (Trusted Platform Module)** | Hardware security chip that stores BitLocker encryption keys and provides measured boot integrity |\n| **XTS-AES 256** | Encryption cipher used by BitLocker; XTS mode provides better protection for disk encryption than CBC |\n| **Recovery Key** | 48-digit numerical password used to unlock BitLocker-encrypted drive when TPM authentication fails |\n| **Key Protector** | Method used to unlock BitLocker (TPM, TPM+PIN, recovery password, startup key, smart card) |\n| **Used Space Only Encryption** | Encrypts only sectors containing data; faster initial encryption but may leave remnant data in free space |\n| **Full Disk Encryption** | Encrypts entire volume including free space; slower but more secure for drives that previously contained data |\n\n## Tools & Systems\n\n- **BitLocker (built-in)**: Windows full disk encryption feature\n- **manage-bde.exe**: Command-line BitLocker management tool\n- **BitLocker Recovery Password Viewer**: RSAT tool for viewing recovery keys in Active Directory\n- **MBAM (Microsoft BitLocker Administration and Monitoring)**: Enterprise BitLocker management (legacy, replaced by Intune)\n- **Microsoft Intune**: Cloud-based BitLocker policy deployment and recovery key management\n\n## Common Pitfalls\n\n- **Not escrowing recovery keys before encryption**: If recovery keys are not saved to AD\u002FAzure AD before encryption, they may be permanently lost if the TPM fails.\n- **Using TPM-only without PIN**: TPM-only mode is transparent but vulnerable to cold boot attacks and evil maid attacks. Add a startup PIN for laptops leaving the office.\n- **Encrypting used space only on repurposed drives**: If a drive previously contained sensitive data, \"used space only\" encryption leaves deleted data unencrypted in free space. Use full disk encryption for repurposed drives.\n- **Forgetting removable drives**: USB drives and external disks are common data loss vectors. Enforce BitLocker To Go for removable media.\n- **No pre-provisioning for SCCM deployments**: Pre-provision BitLocker during OSD task sequence to encrypt before OS deployment, avoiding the lengthy post-deployment encryption process.\n","# Implementing Disk Encryption with BitLocker\n\n## When to Use\n\nUse this skill when:\n- Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)\n- Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO\n- Configuring TPM-based encryption with PIN or USB startup key for enhanced security\n- Managing BitLocker recovery keys in Active Directory or Azure AD\n\n**Do not use** this skill for Linux disk encryption (use LUKS\u002Fdm-crypt) or macOS (use FileVault).\n\n## Prerequisites\n\n- Windows 10\u002F11 Pro, Enterprise, or Education edition\n- TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)\n- UEFI firmware with Secure Boot enabled (recommended)\n- Separate system partition (200 MB minimum, created automatically by Windows installer)\n- Active Directory or Azure AD for recovery key escrow\n\n## Workflow\n\n### Step 1: Verify TPM and System Requirements\n\n```powershell\n# Check TPM status\nGet-Tpm\n# ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled\n\n# Check TPM version (2.0 required for best compatibility)\n(Get-WmiObject -Namespace \"root\\cimv2\\security\\microsofttpm\" -Class Win32_Tpm).SpecVersion\n\n# Check UEFI\u002FSecure Boot\nConfirm-SecureBootUEFI\n# Returns True if Secure Boot is enabled\n\n# Check BitLocker readiness\n$vol = Get-BitLockerVolume -MountPoint \"C:\"\n$vol.VolumeStatus  # Should be \"FullyDecrypted\"\n$vol.ProtectionStatus  # Should be \"Off\"\n```\n\n### Step 2: Configure BitLocker GPO Settings\n\n```\nComputer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption\n\nOperating System Drives:\n  - Require additional authentication at startup: Enabled\n    - Allow BitLocker without compatible TPM: Disabled (enforce TPM)\n    - Configure TPM startup: Allow TPM\n    - Configure TPM startup PIN: Allow startup PIN with TPM\n    - Configure TPM startup key: Allow startup key with TPM\n\n  - Choose how BitLocker-protected OS drives can be recovered: Enabled\n    - Allow data recovery agent: True\n    - Configure storage of recovery information to AD DS: Enabled\n    - Save recovery info to AD DS for OS drives: Store recovery passwords and key packages\n    - Do not enable BitLocker until recovery information is stored: Enabled\n\n  - Choose drive encryption method and cipher strength:\n    - OS drives: XTS-AES 256-bit (Windows 10 1511+)\n    - Fixed drives: XTS-AES 256-bit\n    - Removable drives: AES-CBC 256-bit (for cross-platform compatibility)\n\nFixed Data Drives:\n  - Choose how BitLocker-protected fixed drives can be recovered: Enabled\n    - Store recovery passwords in AD DS: Enabled\n\nRemovable Data Drives:\n  - Control use of BitLocker on removable drives: Enabled\n  - Configure use of passwords for removable drives: Require complexity\n```\n\n### Step 3: Enable BitLocker - Command Line\n\n```powershell\n# Enable BitLocker with TPM-only protector (transparent to user)\nEnable-BitLocker -MountPoint \"C:\" -EncryptionMethod XtsAes256 `\n  -TpmProtector -SkipHardwareTest\n\n# Enable BitLocker with TPM + PIN (recommended for laptops)\n$pin = ConvertTo-SecureString \"123456\" -AsPlainText -Force\nEnable-BitLocker -MountPoint \"C:\" -EncryptionMethod XtsAes256 `\n  -TpmAndPinProtector -Pin $pin\n\n# Add recovery password protector\nAdd-BitLockerKeyProtector -MountPoint \"C:\" -RecoveryPasswordProtector\n\n# Backup recovery key to Active Directory\nBackup-BitLockerKeyProtector -MountPoint \"C:\" `\n  -KeyProtectorId (Get-BitLockerVolume -MountPoint \"C:\").KeyProtector[1].KeyProtectorId\n\n# Encrypt fixed data drives\nEnable-BitLocker -MountPoint \"D:\" -EncryptionMethod XtsAes256 `\n  -RecoveryPasswordProtector -AutoUnlockEnabled\n```\n\n### Step 4: Deploy via Intune (Enterprise)\n\n```\nIntune → Endpoint Security → Disk encryption → Create Profile\n\nPlatform: Windows 10 and later\nProfile: BitLocker\n\nSettings:\n  BitLocker base settings:\n    - Encryption for operating system drives: Require\n    - Encryption for fixed data drives: Require\n    - Encryption for removable data drives: Require\n\n  Operating system drive settings:\n    - Additional authentication at startup: Require\n    - TPM startup: Allowed\n    - TPM startup PIN: Required (for high-security endpoints)\n    - Encryption method: XTS-AES 256-bit\n    - Recovery: Escrow to Azure AD\n\n  Fixed drive settings:\n    - Encryption method: XTS-AES 256-bit\n    - Recovery: Escrow to Azure AD\n\n  Assign to: All managed Windows devices (or specific groups)\n```\n\n### Step 5: Manage Recovery Keys\n\n```powershell\n# View recovery key on local system\n(Get-BitLockerVolume -MountPoint \"C:\").KeyProtector |\n  Where-Object {$_.KeyProtectorType -eq \"RecoveryPassword\"} |\n  Select-Object KeyProtectorId, RecoveryPassword\n\n# Retrieve recovery key from Active Directory (requires RSAT)\nGet-ADObject -Filter {objectClass -eq \"msFVE-RecoveryInformation\"} `\n  -SearchBase \"CN=COMPUTER01,OU=Workstations,DC=corp,DC=example,DC=com\" `\n  -Properties msFVE-RecoveryPassword |\n  Select-Object -ExpandProperty msFVE-RecoveryPassword\n\n# Retrieve recovery key from Azure AD\n# Azure Portal → Azure AD → Devices → [device] → BitLocker keys\n# Or via Microsoft Graph API:\n# GET \u002Fdevices\u002F{id}\u002FbitlockerRecoveryKeys\n```\n\n### Step 6: Monitor Encryption Status\n\n```powershell\n# Check encryption status across fleet\nmanage-bde -status C:\n\n# Expected output for encrypted drive:\n#   Conversion Status: Fully Encrypted\n#   Percentage Encrypted: 100.0%\n#   Encryption Method: XTS-AES 256\n#   Protection Status: Protection On\n#   Key Protectors: TPM, Numerical Password\n\n# PowerShell compliance check\n$vol = Get-BitLockerVolume -MountPoint \"C:\"\nif ($vol.ProtectionStatus -eq \"On\" -and $vol.VolumeStatus -eq \"FullyEncrypted\") {\n    Write-Host \"COMPLIANT: BitLocker enabled and fully encrypted\"\n} else {\n    Write-Host \"NON-COMPLIANT: BitLocker status - Protection: $($vol.ProtectionStatus), Volume: $($vol.VolumeStatus)\"\n}\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **TPM (Trusted Platform Module)** | Hardware security chip that stores BitLocker encryption keys and provides measured boot integrity |\n| **XTS-AES 256** | Encryption cipher used by BitLocker; XTS mode provides better protection for disk encryption than CBC |\n| **Recovery Key** | 48-digit numerical password used to unlock BitLocker-encrypted drive when TPM authentication fails |\n| **Key Protector** | Method used to unlock BitLocker (TPM, TPM+PIN, recovery password, startup key, smart card) |\n| **Used Space Only Encryption** | Encrypts only sectors containing data; faster initial encryption but may leave remnant data in free space |\n| **Full Disk Encryption** | Encrypts entire volume including free space; slower but more secure for drives that previously contained data |\n\n## Tools & Systems\n\n- **BitLocker (built-in)**: Windows full disk encryption feature\n- **manage-bde.exe**: Command-line BitLocker management tool\n- **BitLocker Recovery Password Viewer**: RSAT tool for viewing recovery keys in Active Directory\n- **MBAM (Microsoft BitLocker Administration and Monitoring)**: Enterprise BitLocker management (legacy, replaced by Intune)\n- **Microsoft Intune**: Cloud-based BitLocker policy deployment and recovery key management\n\n## Common Pitfalls\n\n- **Not escrowing recovery keys before encryption**: If recovery keys are not saved to AD\u002FAzure AD before encryption, they may be permanently lost if the TPM fails.\n- **Using TPM-only without PIN**: TPM-only mode is transparent but vulnerable to cold boot attacks and evil maid attacks. Add a startup PIN for laptops leaving the office.\n- **Encrypting used space only on repurposed drives**: If a drive previously contained sensitive data, \"used space only\" encryption leaves deleted data unencrypted in free space. Use full disk encryption for repurposed drives.\n- **Forgetting removable drives**: USB drives and external disks are common data loss vectors. Enforce BitLocker To Go for removable media.\n- **No pre-provisioning for SCCM deployments**: Pre-provision BitLocker during OSD task sequence to encrypt before OS deployment, avoiding the lengthy post-deployment encryption process.\n",{"name":5,"tags":49,"author":51,"domain":27,"license":15,"version":52,"nist_csf":53,"subdomain":37,"description":58,"mitre_attack":59},[34,24,29,28,50,33],"data-protection","mahipal","1.0.0",[54,55,56,57],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.\n",[60,61,62,63,64],"T1055","T1547","T1059","T1036","T1573","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-disk-encryption-with-bitlocker",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-disk-encryption-with-bitlocker",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-disk-encryption-with-bitlocker",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-disk-encryption-with-bitlocker","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",1256,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1676,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",1814,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",1966,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",6495,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",6329,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-disk-encryption-with-bitlocker\u002Fscripts\u002Fprocess.py",[125,150,173,200,224,251],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,135,136,36,27,137,138,42,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,28,159,36,160,27,42,161,162,163,164,165,166,167,168,169,170,171,172],"boot","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,27,188,189,161,41,190,191,192,193,194,195,196,197,198,199],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[206],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[43,208,209,27,210,211,212,213,214,215,216,38,217,218,219,220,164,221,222,223],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[230],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[232,233,234,27,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":258,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[257],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[36,259,27,260,261,262,263,264,265,266,267,195,268,196,269,270,271,272,273,274],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]