[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF835TRYWY58SCSBHDE093":3,"skill-same:01M6AF835TRYWY58SCSBHDE093":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AF835TRYWY58SCSBHDE093","implementing-memory-protection-with-dep-aslr",null,"Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"memory","implementing memory protection with dep aslr","injection","security","CFG","exploit-mitigation","ASLR","DEP","memory-protection","prevention","t1547","cybersecurity","t1059","execution","hardening","endpoint-security","data","flow","code","pr","2026-11-10 10:12:30",false,"---\nname: implementing-memory-protection-with-dep-aslr\ndescription: 'Implements memory protection mechanisms including DEP (Data Execution\n  Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard),\n  and other exploit mitigations to prevent memory corruption attacks. Use when hardening\n  endpoints against buffer overflow exploits, ROP chains, and code injection. Activates\n  for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG\n  configuration.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- memory-protection\n- DEP\n- ASLR\n- exploit-mitigation\n- CFG\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n- T1190\n---\n# Implementing Memory Protection with DEP and ASLR\n\n## When to Use\n\nUse this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.\n\n## Prerequisites\n\n- Windows 10\u002F11 or Windows Server 2016+ with administrative privileges\n- Group Policy management access for enterprise-wide deployment\n- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)\n- Test environment for validating application compatibility with exploit mitigations\n\n## Workflow\n\n### Step 1: Configure System-Level Mitigations\n\n```powershell\n# Enable system-wide DEP (Data Execution Prevention)\n# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn\nbcdedit \u002Fset nx AlwaysOn\n\n# Verify ASLR status (enabled by default on modern Windows)\nGet-ProcessMitigation -System\n# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON\n\n# Enable all system-level mitigations\nSet-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy\n```\n\n### Step 2: Configure Per-Application Mitigations\n\n```powershell\n# Harden high-risk applications (browsers, Office, PDF readers)\nSet-ProcessMitigation -Name \"WINWORD.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"EXCEL.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"AcroRd32.exe\" -Enable DEP,SEHOP,ForceRelocateImages,CFG\nSet-ProcessMitigation -Name \"chrome.exe\" -Enable DEP,CFG,ForceRelocateImages\nSet-ProcessMitigation -Name \"msedge.exe\" -Enable DEP,CFG,ForceRelocateImages\n\n# Export configuration for deployment\nGet-ProcessMitigation -RegistryConfigFilePath \"C:\\exploit_protection.xml\"\n# Deploy via Intune or GPO\n```\n\n### Step 3: Deploy via Intune\u002FGPO\n\n```\nIntune: Endpoint Security → Attack Surface Reduction → Exploit Protection\n  Import exploit_protection.xml template\n\nGPO: Computer Configuration → Admin Templates → Windows Components\n  → Windows Defender Exploit Guard → Exploit Protection\n  → \"Use a common set of exploit protection settings\" → Enabled\n  → Point to XML file on network share\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DEP** | Marks memory pages as non-executable to prevent shellcode execution in data regions |\n| **ASLR** | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |\n| **CFG** | Validates indirect call targets at runtime to prevent control flow hijacking |\n| **SEHOP** | Validates SEH chain integrity to prevent SEH-based exploitation |\n\n## Tools & Systems\n- **Windows Exploit Protection**: Built-in per-process mitigation management\n- **EMET (legacy)**: Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)\n- **ProcessMitigations PowerShell**: Get\u002FSet-ProcessMitigation cmdlets\n\n## Common Pitfalls\n- **DEP compatibility**: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.\n- **Mandatory ASLR breaking apps**: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.\n- **CFG limited to compiled-in support**: CFG only works for applications compiled with \u002Fguard:cf. Cannot be retroactively applied.\n","# Implementing Memory Protection with DEP and ASLR\n\n## When to Use\n\nUse this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.\n\n## Prerequisites\n\n- Windows 10\u002F11 or Windows Server 2016+ with administrative privileges\n- Group Policy management access for enterprise-wide deployment\n- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)\n- Test environment for validating application compatibility with exploit mitigations\n\n## Workflow\n\n### Step 1: Configure System-Level Mitigations\n\n```powershell\n# Enable system-wide DEP (Data Execution Prevention)\n# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn\nbcdedit \u002Fset nx AlwaysOn\n\n# Verify ASLR status (enabled by default on modern Windows)\nGet-ProcessMitigation -System\n# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON\n\n# Enable all system-level mitigations\nSet-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy\n```\n\n### Step 2: Configure Per-Application Mitigations\n\n```powershell\n# Harden high-risk applications (browsers, Office, PDF readers)\nSet-ProcessMitigation -Name \"WINWORD.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"EXCEL.EXE\" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle\nSet-ProcessMitigation -Name \"AcroRd32.exe\" -Enable DEP,SEHOP,ForceRelocateImages,CFG\nSet-ProcessMitigation -Name \"chrome.exe\" -Enable DEP,CFG,ForceRelocateImages\nSet-ProcessMitigation -Name \"msedge.exe\" -Enable DEP,CFG,ForceRelocateImages\n\n# Export configuration for deployment\nGet-ProcessMitigation -RegistryConfigFilePath \"C:\\exploit_protection.xml\"\n# Deploy via Intune or GPO\n```\n\n### Step 3: Deploy via Intune\u002FGPO\n\n```\nIntune: Endpoint Security → Attack Surface Reduction → Exploit Protection\n  Import exploit_protection.xml template\n\nGPO: Computer Configuration → Admin Templates → Windows Components\n  → Windows Defender Exploit Guard → Exploit Protection\n  → \"Use a common set of exploit protection settings\" → Enabled\n  → Point to XML file on network share\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **DEP** | Marks memory pages as non-executable to prevent shellcode execution in data regions |\n| **ASLR** | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |\n| **CFG** | Validates indirect call targets at runtime to prevent control flow hijacking |\n| **SEHOP** | Validates SEH chain integrity to prevent SEH-based exploitation |\n\n## Tools & Systems\n- **Windows Exploit Protection**: Built-in per-process mitigation management\n- **EMET (legacy)**: Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)\n- **ProcessMitigations PowerShell**: Get\u002FSet-ProcessMitigation cmdlets\n\n## Common Pitfalls\n- **DEP compatibility**: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.\n- **Mandatory ASLR breaking apps**: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.\n- **CFG limited to compiled-in support**: CFG only works for applications compiled with \u002Fguard:cf. Cannot be retroactively applied.\n",{"name":5,"tags":49,"author":51,"domain":35,"license":15,"version":52,"nist_csf":53,"subdomain":39,"description":58,"mitre_attack":59},[50,32,31,30,29,28],"endpoint","mahipal","1.0.0",[54,55,56,57],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.\n",[60,61,62,63,64],"T1055","T1547","T1059","T1036","T1190","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-memory-protection-with-dep-aslr",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-memory-protection-with-dep-aslr",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-memory-protection-with-dep-aslr",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-memory-protection-with-dep-aslr","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002FSKILL.md",true,[89,95,100,106,110,114,120],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",553,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1863,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fstandards.md",316,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002Freferences\u002Fstandards.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflows.md",374,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002Freferences\u002Fworkflows.md",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fagent.py","SCRIPT","脚本",6560,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002Fscripts\u002Fagent.py",{"path":121,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fprocess.py",1160,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-memory-protection-with-dep-aslr\u002Fscripts\u002Fprocess.py",[125,149,173,201,226,253],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,135,136,27,35,137,138,43,42,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,27,160,35,43,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,35,188,189,161,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,35,212,213,214,215,216,217,218,40,219,220,221,222,164,223,224,225],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":233,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[232],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[234,235,236,35,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[259],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,261,35,262,263,264,265,266,267,268,269,196,37,197,270,271,272,273,274,275],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]