[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFHENTGMYF7WX7S3VEHBJ1":3,"skill-same:01M6AFHENTGMYF7WX7S3VEHBJ1":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":80,"commitSha":81,"skillDirectory":82,"forksCount":83,"repositoryHtmlUrl":84,"repositoryHomepageUrl":85,"ownerHtmlUrl":86,"ownerBlogUrl":87,"ownerDescription":88,"updatedAt":89,"install":90,"resources":103},"01M6AFHENTGMYF7WX7S3VEHBJ1","mapping-mitre-attack-techniques",null,"Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"mapping mitre attack techniques","mitre attack","detection-engineering","ATT&CK-Navigator","analysis","TTP","d3fend","ATT&CK","ids","NIST","sigma","security","NIST-CSF","MITRE-ATT&CK","threat-intelligence","navigator","reporting","security alerts","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: mapping-mitre-attack-techniques\ndescription: 'Maps observed adversary behaviors, security alerts, and detection rules\n  to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and\n  guide control prioritization. Use when building an ATT&CK-based coverage heatmap,\n  tagging SIEM alerts with technique IDs, aligning security controls to adversary\n  playbooks, or reporting threat exposure to executives. Activates for requests involving\n  ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- MITRE-ATT&CK\n- ATT&CK-Navigator\n- Sigma\n- D3FEND\n- TTP\n- detection-engineering\n- NIST-CSF\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1685.002\n---\n# Mapping MITRE ATT&CK Techniques\n\n## When to Use\n\nUse this skill when:\n- Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses\n- Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting\n- Aligning your security program roadmap to specific adversary groups known to target your sector\n\n**Do not use** this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.\n\n## Prerequisites\n\n- Access to MITRE ATT&CK knowledge base (https:\u002F\u002Fattack.mitre.org) or local ATT&CK STIX data bundle\n- ATT&CK Navigator web app or local installation (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F)\n- Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage\n- ATT&CK Python library: `pip install mitreattack-python`\n\n## Workflow\n\n### Step 1: Obtain Current ATT&CK Data\n\nDownload the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):\n```bash\ncurl -o enterprise-attack.json \\\n  https:\u002F\u002Fraw.githubusercontent.com\u002Fmitre\u002Fcti\u002Fmaster\u002Fenterprise-attack\u002Fenterprise-attack.json\n```\n\nUse the mitreattack-python library to query techniques programmatically:\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nmitre = MitreAttackData(\"enterprise-attack.json\")\ntechniques = mitre.get_techniques(remove_revoked_deprecated=True)\nfor t in techniques[:5]:\n    print(t[\"external_references\"][0][\"external_id\"], t[\"name\"])\n```\n\n### Step 2: Map Existing Detections to Techniques\n\nFor each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging:\n```yaml\ntags:\n  - attack.execution\n  - attack.t1059.001  # PowerShell\n  - attack.t1059.003  # Windows Command Shell\n```\n\nCreate a coverage matrix: list each technique ID and mark as: Detected (alert fires), Logged (data present but no alert), Blind (no data source).\n\n### Step 3: Prioritize Coverage Gaps Using Threat Intelligence\n\nCross-reference coverage gaps with adversary groups targeting your sector. Use ATT&CK Groups data:\n```python\ngroups = mitre.get_groups()\napt29 = mitre.get_object_by_attack_id(\"G0016\", \"groups\")\napt29_techniques = mitre.get_techniques_used_by_group(apt29)\nfor t in apt29_techniques:\n    print(t[\"object\"][\"external_references\"][0][\"external_id\"])\n```\n\nPrioritize adding detection for techniques used by high-priority threat groups where your coverage is blind.\n\n### Step 4: Build Navigator Heatmap\n\nExport coverage scores as ATT&CK Navigator JSON layer:\n```python\nimport json\n\nlayer = {\n    \"name\": \"SOC Detection Coverage Q1 2025\",\n    \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"techniques\": [\n        {\"techniqueID\": \"T1059.001\", \"score\": 100, \"comment\": \"Splunk rule: PS_Encoded_Command\"},\n        {\"techniqueID\": \"T1071.001\", \"score\": 50, \"comment\": \"Logged only, no alert\"},\n        {\"techniqueID\": \"T1055\", \"score\": 0, \"comment\": \"No coverage — blind spot\"}\n    ],\n    \"gradient\": {\"colors\": [\"#ff6666\", \"#ffe766\", \"#8ec843\"], \"minValue\": 0, \"maxValue\": 100}\n}\nwith open(\"coverage_layer.json\", \"w\") as f:\n    json.dump(layer, f)\n```\n\nImport layer into ATT&CK Navigator (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F) for visualization.\n\n### Step 5: Generate Executive Coverage Report\n\nSummarize coverage by tactic category (Initial Access, Execution, Persistence, etc.) with counts and percentages. Provide a risk-ranked list of top 10 blind-spot techniques based on adversary group usage frequency. Recommend data source additions (e.g., \"Enable PowerShell Script Block Logging to address 12 Execution sub-technique gaps\").\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **ATT&CK Technique** | Specific adversary method identified by T-number (e.g., T1059 = Command and Scripting Interpreter) |\n| **Sub-technique** | More granular variant of a technique (e.g., T1059.001 = PowerShell, T1059.003 = Windows Command Shell) |\n| **Tactic** | Adversary goal category in ATT&CK: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C&C, Exfiltration, Impact |\n| **Data Source** | ATT&CK v10+ component identifying telemetry required to detect a technique (e.g., Process Creation, Network Traffic) |\n| **Coverage Score** | Numeric (0–100) representing detection completeness for a technique: 0=blind, 50=logged only, 100=alerted |\n| **MITRE D3FEND** | Defensive countermeasure ontology complementing ATT&CK — maps defensive techniques to attack techniques they mitigate |\n\n## Tools & Systems\n\n- **ATT&CK Navigator**: Browser-based heatmap visualization tool for layering coverage scores and annotations on the ATT&CK matrix\n- **mitreattack-python**: Official MITRE Python library for programmatic access to ATT&CK STIX data (techniques, groups, software, mitigations)\n- **Atomic Red Team**: MITRE-aligned test library providing atomic test cases to validate detection for each technique\n- **Sigma**: Detection rule format with ATT&CK tagging support; translatable to Splunk, Sentinel, QRadar, Elastic\n- **ATT&CK Workbench**: Self-hosted ATT&CK knowledge base for organizations maintaining custom technique extensions\n\n## Common Pitfalls\n\n- **Over-claiming coverage**: Logging a data source (e.g., process creation events) does not mean the associated technique is detected — a rule must actually fire on malicious patterns.\n- **Mapping at tactic level only**: Tagging a rule as \"attack.execution\" without a specific technique ID prevents granular gap analysis.\n- **Ignoring sub-techniques**: Many adversaries use specific sub-techniques. Coverage of T1059 (parent) doesn't imply coverage of T1059.005 (Visual Basic).\n- **Static mapping without updates**: ATT&CK releases major versions annually. Coverage maps go stale as techniques are added, revised, or deprecated.\n- **Not mapping to adversary groups**: Generic coverage maps don't distinguish between techniques used by APTs targeting your sector vs. commodity malware.\n","# Mapping MITRE ATT&CK Techniques\n\n## When to Use\n\nUse this skill when:\n- Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses\n- Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting\n- Aligning your security program roadmap to specific adversary groups known to target your sector\n\n**Do not use** this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.\n\n## Prerequisites\n\n- Access to MITRE ATT&CK knowledge base (https:\u002F\u002Fattack.mitre.org) or local ATT&CK STIX data bundle\n- ATT&CK Navigator web app or local installation (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F)\n- Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage\n- ATT&CK Python library: `pip install mitreattack-python`\n\n## Workflow\n\n### Step 1: Obtain Current ATT&CK Data\n\nDownload the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):\n```bash\ncurl -o enterprise-attack.json \\\n  https:\u002F\u002Fraw.githubusercontent.com\u002Fmitre\u002Fcti\u002Fmaster\u002Fenterprise-attack\u002Fenterprise-attack.json\n```\n\nUse the mitreattack-python library to query techniques programmatically:\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nmitre = MitreAttackData(\"enterprise-attack.json\")\ntechniques = mitre.get_techniques(remove_revoked_deprecated=True)\nfor t in techniques[:5]:\n    print(t[\"external_references\"][0][\"external_id\"], t[\"name\"])\n```\n\n### Step 2: Map Existing Detections to Techniques\n\nFor each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging:\n```yaml\ntags:\n  - attack.execution\n  - attack.t1059.001  # PowerShell\n  - attack.t1059.003  # Windows Command Shell\n```\n\nCreate a coverage matrix: list each technique ID and mark as: Detected (alert fires), Logged (data present but no alert), Blind (no data source).\n\n### Step 3: Prioritize Coverage Gaps Using Threat Intelligence\n\nCross-reference coverage gaps with adversary groups targeting your sector. Use ATT&CK Groups data:\n```python\ngroups = mitre.get_groups()\napt29 = mitre.get_object_by_attack_id(\"G0016\", \"groups\")\napt29_techniques = mitre.get_techniques_used_by_group(apt29)\nfor t in apt29_techniques:\n    print(t[\"object\"][\"external_references\"][0][\"external_id\"])\n```\n\nPrioritize adding detection for techniques used by high-priority threat groups where your coverage is blind.\n\n### Step 4: Build Navigator Heatmap\n\nExport coverage scores as ATT&CK Navigator JSON layer:\n```python\nimport json\n\nlayer = {\n    \"name\": \"SOC Detection Coverage Q1 2025\",\n    \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"techniques\": [\n        {\"techniqueID\": \"T1059.001\", \"score\": 100, \"comment\": \"Splunk rule: PS_Encoded_Command\"},\n        {\"techniqueID\": \"T1071.001\", \"score\": 50, \"comment\": \"Logged only, no alert\"},\n        {\"techniqueID\": \"T1055\", \"score\": 0, \"comment\": \"No coverage — blind spot\"}\n    ],\n    \"gradient\": {\"colors\": [\"#ff6666\", \"#ffe766\", \"#8ec843\"], \"minValue\": 0, \"maxValue\": 100}\n}\nwith open(\"coverage_layer.json\", \"w\") as f:\n    json.dump(layer, f)\n```\n\nImport layer into ATT&CK Navigator (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F) for visualization.\n\n### Step 5: Generate Executive Coverage Report\n\nSummarize coverage by tactic category (Initial Access, Execution, Persistence, etc.) with counts and percentages. Provide a risk-ranked list of top 10 blind-spot techniques based on adversary group usage frequency. Recommend data source additions (e.g., \"Enable PowerShell Script Block Logging to address 12 Execution sub-technique gaps\").\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **ATT&CK Technique** | Specific adversary method identified by T-number (e.g., T1059 = Command and Scripting Interpreter) |\n| **Sub-technique** | More granular variant of a technique (e.g., T1059.001 = PowerShell, T1059.003 = Windows Command Shell) |\n| **Tactic** | Adversary goal category in ATT&CK: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C&C, Exfiltration, Impact |\n| **Data Source** | ATT&CK v10+ component identifying telemetry required to detect a technique (e.g., Process Creation, Network Traffic) |\n| **Coverage Score** | Numeric (0–100) representing detection completeness for a technique: 0=blind, 50=logged only, 100=alerted |\n| **MITRE D3FEND** | Defensive countermeasure ontology complementing ATT&CK — maps defensive techniques to attack techniques they mitigate |\n\n## Tools & Systems\n\n- **ATT&CK Navigator**: Browser-based heatmap visualization tool for layering coverage scores and annotations on the ATT&CK matrix\n- **mitreattack-python**: Official MITRE Python library for programmatic access to ATT&CK STIX data (techniques, groups, software, mitigations)\n- **Atomic Red Team**: MITRE-aligned test library providing atomic test cases to validate detection for each technique\n- **Sigma**: Detection rule format with ATT&CK tagging support; translatable to Splunk, Sentinel, QRadar, Elastic\n- **ATT&CK Workbench**: Self-hosted ATT&CK knowledge base for organizations maintaining custom technique extensions\n\n## Common Pitfalls\n\n- **Over-claiming coverage**: Logging a data source (e.g., process creation events) does not mean the associated technique is detected — a rule must actually fire on malicious patterns.\n- **Mapping at tactic level only**: Tagging a rule as \"attack.execution\" without a specific technique ID prevents granular gap analysis.\n- **Ignoring sub-techniques**: Many adversaries use specific sub-techniques. Coverage of T1059 (parent) doesn't imply coverage of T1059.005 (Visual Basic).\n- **Static mapping without updates**: ATT&CK releases major versions annually. Coverage maps go stale as techniques are added, revised, or deprecated.\n- **Not mapping to adversary groups**: Generic coverage maps don't distinguish between techniques used by APTs targeting your sector vs. commodity malware.\n",{"name":5,"tags":49,"author":52,"domain":43,"license":15,"version":53,"nist_csf":54,"subdomain":38,"description":59,"nist_ai_rmf":60,"mitre_attack":64,"atlas_techniques":70,"d3fend_techniques":74},[37,27,50,51,29,26,36],"Sigma","D3FEND","mahipal","1.0.0",[55,56,57,58],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.\n",[61,62,63],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[65,66,67,68,69],"T1591","T1592","T1593","T1589","T1685.002",[71,72,73],"AML.T0070","AML.T0066","AML.T0082",[75,76,77,78,79],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fmapping-mitre-attack-techniques",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":91,"prompt":101,"zipAvailable":102},[92,95,98],{"tool":93,"command":94},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill mapping-mitre-attack-techniques",{"tool":96,"command":97},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill mapping-mitre-attack-techniques",{"tool":99,"command":100},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill mapping-mitre-attack-techniques","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FSKILL.md",true,[104,109,115],{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FLICENSE",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fapi-reference.md","REFERENCE","参考文档",2708,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-mitre-attack-techniques\u002Freferences\u002Fapi-reference.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",7754,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fmapping-mitre-attack-techniques\u002Fscripts\u002Fagent.py",[122,148,172,200,226,253],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,35,43,134,135,136,137,138,139,140,141,142,143,144,145,146,147],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":155,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[154],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[156,144,157,158,35,159,43,136,160,161,162,163,164,165,166,167,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,183,184,185,186,43,187,188,160,189,190,191,192,193,194,195,196,197,198,199],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[206],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,43,211,212,213,214,215,216,217,218,219,220,221,222,163,223,224,225],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":233,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[232],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[234,235,236,43,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[259],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,261,43,42,262,263,264,265,33,266,267,195,268,196,28,269,270,271,272,273],"triaging security incident","file","ioc","soc","NIST-800-61","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]