[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFK0RGA1CDNFPH196GMJ82":3,"skill-same:01M6AFK0RGA1CDNFPH196GMJ82":132},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AFK0RGA1CDNFPH196GMJ82","performing-active-directory-compromise-investigation",null,"Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing active directory compromise investigation","investigation","directory","analyzing","compromise-investigation","analysis","t1490","t1078","lateral-movement","golden-ticket","network","dfir","active-directory","server","monitoring","logs","authentication","identity","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: performing-active-directory-compromise-investigation\ndescription: Investigate Active Directory compromise by analyzing authentication logs,\n  replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify\n  attacker persistence and lateral movement paths.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- active-directory\n- compromise-investigation\n- identity-forensics\n- kerberos\n- lateral-movement\n- dfir\n- ntds-dit\n- golden-ticket\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\n- T1021\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Platform Monitoring\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Performing Active Directory Compromise Investigation\n\n## Overview\n\nActive Directory (AD) compromise investigation is a critical incident response capability that focuses on identifying how attackers gained access to domain services, what persistence mechanisms they established, and the scope of credential compromise. Since 88% of breaches involve compromised credentials (Verizon 2025 DBIR), AD is the primary target for enterprise-wide attacks. Investigators must analyze NTDS.dit database integrity, Kerberos ticket-granting activity, Group Policy modifications, replication metadata, and privileged group membership changes to reconstruct the attack chain and determine full compromise scope.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory compromise investigation\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Key Investigation Areas\n\n### 1. NTDS.dit Database Analysis\n\nThe NTDS.dit file is the core Active Directory credential database containing all password hashes for domain accounts. Attackers commonly exfiltrate this file using tools like ntdsutil, secretsdump.py, or DCSync attacks via Mimikatz.\n\n**Detection indicators:**\n- Event ID 4662: Access to directory service objects with replication permissions\n- Event ID 4742: Computer account modifications on domain controllers\n- Volume Shadow Copy creation on domain controllers (Event ID 8222)\n- Unusual ntdsutil.exe or vssadmin.exe execution\n- Replication traffic from non-DC sources (DCSync detection)\n\n### 2. Kerberos Attack Detection\n\n**Golden Ticket indicators:**\n- TGT tickets with abnormally long lifetimes (default is 10 hours)\n- Event ID 4769 with encryption type 0x17 (RC4) instead of AES\n- TGT issued without corresponding Event ID 4768 (AS-REQ)\n- Kerberos tickets referencing non-existent or disabled accounts\n\n**Silver Ticket indicators:**\n- Service tickets without corresponding TGT requests\n- Event ID 4769 with unusual service names\n- Tickets with forged PAC data\n\n**Kerberoasting indicators:**\n- High volume of Event ID 4769 for service accounts\n- RC4 encryption requests for accounts that support AES\n- Requests from workstations not normally accessing those services\n\n### 3. Group Policy Abuse\n\n- GPO modifications granting new privileges (Event ID 5136)\n- Scheduled task deployment via GPO\n- Software installation policies added to domain\n- Login script modifications\n- Registry-based policy changes for persistence\n\n### 4. Privileged Group Enumeration\n\nTrack modifications to these critical groups:\n- Domain Admins, Enterprise Admins, Schema Admins\n- Account Operators, Backup Operators\n- DnsAdmins (can execute arbitrary DLLs on DCs)\n- Group Policy Creator Owners\n- Protected Users group membership changes\n\n### 5. Trust Relationship Analysis\n\n- New forest\u002Fdomain trusts created (Event ID 4706)\n- SID History injection for privilege escalation\n- Trust ticket forgery indicators\n- Cross-domain authentication anomalies\n\n## Investigation Methodology\n\n### Phase 1: Scoping and Evidence Collection\n```\n1. Identify potentially compromised domain controllers\n2. Collect Security, System, Directory Service event logs\n3. Extract AD replication metadata using repadmin\n4. Capture ntdsutil snapshots for offline analysis\n5. Collect DNS server logs and zone transfer records\n6. Export Group Policy Object configurations\n7. Document current privileged group memberships\n```\n\n### Phase 2: Authentication Log Analysis\n```\n1. Parse Event ID 4624\u002F4625 for logon patterns\n2. Identify pass-the-hash indicators (Event ID 4624 Type 3 with NTLM)\n3. Analyze Event ID 4768\u002F4769\u002F4771 for Kerberos anomalies\n4. Review Event ID 4776 for NTLM authentication failures\n5. Cross-reference logon events with known compromised accounts\n6. Map lateral movement paths through authentication chains\n```\n\n### Phase 3: Persistence and Backdoor Detection\n```\n1. Enumerate AdminSDHolder ACL modifications\n2. Check for SID History abuse on accounts\n3. Verify krbtgt account password age\n4. Audit DSRM password configuration\n5. Check for skeleton key malware indicators\n6. Review AD Certificate Services for rogue certificates\n7. Validate DNS records for poisoning\n```\n\n### Phase 4: Remediation Planning\n```\n1. Double-rotate krbtgt password (wait replication between rotations)\n2. Reset all compromised account passwords\n3. Remove unauthorized privileged group members\n4. Revoke rogue certificates if AD CS compromised\n5. Rebuild domain controllers from clean media if needed\n6. Implement tiered administration model\n7. Enable Protected Users group for privileged accounts\n```\n\n## Critical Event IDs for AD Investigation\n\n| Event ID | Source | Description |\n|----------|--------|-------------|\n| 4624 | Security | Successful logon |\n| 4625 | Security | Failed logon |\n| 4648 | Security | Explicit credential logon |\n| 4662 | Security | Operation on AD object |\n| 4768 | Security | Kerberos TGT requested |\n| 4769 | Security | Kerberos service ticket requested |\n| 4771 | Security | Kerberos pre-authentication failed |\n| 4776 | Security | NTLM credential validation |\n| 5136 | Security | Directory object modified |\n| 5137 | Security | Directory object created |\n| 4706 | Security | Trust created |\n| 4707 | Security | Trust removed |\n| 4742 | Security | Computer account changed |\n| 8222 | System | Shadow copy created |\n\n## Tools for AD Investigation\n\n| Tool | Purpose |\n|------|---------|\n| **BloodHound** | Attack path mapping and privilege escalation analysis |\n| **Pingcastle** | AD security assessment and risk scoring |\n| **Purple Knight** | AD vulnerability scanning by Semperis |\n| **ADRecon** | Active Directory data gathering |\n| **Mimikatz** | Credential extraction and Kerberos analysis |\n| **Impacket** | DCSync detection and NTLM relay analysis |\n| **Velociraptor** | Remote forensic artifact collection |\n| **Timeline Explorer** | Event log timeline analysis |\n\n## MITRE ATT&CK Mapping\n\n| Technique | ID | Relevance |\n|-----------|----|-----------|\n| DCSync | T1003.006 | NTDS.dit credential extraction |\n| Golden Ticket | T1558.001 | Kerberos TGT forgery |\n| Silver Ticket | T1558.002 | Service ticket forgery |\n| Kerberoasting | T1558.003 | Service account hash extraction |\n| Pass-the-Hash | T1550.002 | NTLM hash reuse |\n| Group Policy Modification | T1484.001 | Persistence via GPO |\n| Account Manipulation | T1098 | Privileged group changes |\n| SID-History Injection | T1134.005 | Privilege escalation |\n\n## References\n\n- [CISA: Detecting and Mitigating Active Directory Compromises](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fdetecting-and-mitigating-active-directory-compromises)\n- [Microsoft: Total Identity Compromise IR Lessons](https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftsecurityexperts\u002Ftotal-identity-compromise-microsoft-incident-response-lessons-on-securing-active\u002F3753391)\n- [Semperis: Top 10 Active Directory Risks](https:\u002F\u002Fwww.semperis.com\u002Fblog\u002F10-ad-risks-caught-by-identity-forensics-and-incident-response\u002F)\n- [Fidelis: Active Directory Compromise Response](https:\u002F\u002Ffidelissecurity.com\u002Fthreatgeek\u002Factive-directory-security\u002Frespond-after-an-active-directory-compromise\u002F)\n","# Performing Active Directory Compromise Investigation\n\n## Overview\n\nActive Directory (AD) compromise investigation is a critical incident response capability that focuses on identifying how attackers gained access to domain services, what persistence mechanisms they established, and the scope of credential compromise. Since 88% of breaches involve compromised credentials (Verizon 2025 DBIR), AD is the primary target for enterprise-wide attacks. Investigators must analyze NTDS.dit database integrity, Kerberos ticket-granting activity, Group Policy modifications, replication metadata, and privileged group membership changes to reconstruct the attack chain and determine full compromise scope.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing active directory compromise investigation\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Key Investigation Areas\n\n### 1. NTDS.dit Database Analysis\n\nThe NTDS.dit file is the core Active Directory credential database containing all password hashes for domain accounts. Attackers commonly exfiltrate this file using tools like ntdsutil, secretsdump.py, or DCSync attacks via Mimikatz.\n\n**Detection indicators:**\n- Event ID 4662: Access to directory service objects with replication permissions\n- Event ID 4742: Computer account modifications on domain controllers\n- Volume Shadow Copy creation on domain controllers (Event ID 8222)\n- Unusual ntdsutil.exe or vssadmin.exe execution\n- Replication traffic from non-DC sources (DCSync detection)\n\n### 2. Kerberos Attack Detection\n\n**Golden Ticket indicators:**\n- TGT tickets with abnormally long lifetimes (default is 10 hours)\n- Event ID 4769 with encryption type 0x17 (RC4) instead of AES\n- TGT issued without corresponding Event ID 4768 (AS-REQ)\n- Kerberos tickets referencing non-existent or disabled accounts\n\n**Silver Ticket indicators:**\n- Service tickets without corresponding TGT requests\n- Event ID 4769 with unusual service names\n- Tickets with forged PAC data\n\n**Kerberoasting indicators:**\n- High volume of Event ID 4769 for service accounts\n- RC4 encryption requests for accounts that support AES\n- Requests from workstations not normally accessing those services\n\n### 3. Group Policy Abuse\n\n- GPO modifications granting new privileges (Event ID 5136)\n- Scheduled task deployment via GPO\n- Software installation policies added to domain\n- Login script modifications\n- Registry-based policy changes for persistence\n\n### 4. Privileged Group Enumeration\n\nTrack modifications to these critical groups:\n- Domain Admins, Enterprise Admins, Schema Admins\n- Account Operators, Backup Operators\n- DnsAdmins (can execute arbitrary DLLs on DCs)\n- Group Policy Creator Owners\n- Protected Users group membership changes\n\n### 5. Trust Relationship Analysis\n\n- New forest\u002Fdomain trusts created (Event ID 4706)\n- SID History injection for privilege escalation\n- Trust ticket forgery indicators\n- Cross-domain authentication anomalies\n\n## Investigation Methodology\n\n### Phase 1: Scoping and Evidence Collection\n```\n1. Identify potentially compromised domain controllers\n2. Collect Security, System, Directory Service event logs\n3. Extract AD replication metadata using repadmin\n4. Capture ntdsutil snapshots for offline analysis\n5. Collect DNS server logs and zone transfer records\n6. Export Group Policy Object configurations\n7. Document current privileged group memberships\n```\n\n### Phase 2: Authentication Log Analysis\n```\n1. Parse Event ID 4624\u002F4625 for logon patterns\n2. Identify pass-the-hash indicators (Event ID 4624 Type 3 with NTLM)\n3. Analyze Event ID 4768\u002F4769\u002F4771 for Kerberos anomalies\n4. Review Event ID 4776 for NTLM authentication failures\n5. Cross-reference logon events with known compromised accounts\n6. Map lateral movement paths through authentication chains\n```\n\n### Phase 3: Persistence and Backdoor Detection\n```\n1. Enumerate AdminSDHolder ACL modifications\n2. Check for SID History abuse on accounts\n3. Verify krbtgt account password age\n4. Audit DSRM password configuration\n5. Check for skeleton key malware indicators\n6. Review AD Certificate Services for rogue certificates\n7. Validate DNS records for poisoning\n```\n\n### Phase 4: Remediation Planning\n```\n1. Double-rotate krbtgt password (wait replication between rotations)\n2. Reset all compromised account passwords\n3. Remove unauthorized privileged group members\n4. Revoke rogue certificates if AD CS compromised\n5. Rebuild domain controllers from clean media if needed\n6. Implement tiered administration model\n7. Enable Protected Users group for privileged accounts\n```\n\n## Critical Event IDs for AD Investigation\n\n| Event ID | Source | Description |\n|----------|--------|-------------|\n| 4624 | Security | Successful logon |\n| 4625 | Security | Failed logon |\n| 4648 | Security | Explicit credential logon |\n| 4662 | Security | Operation on AD object |\n| 4768 | Security | Kerberos TGT requested |\n| 4769 | Security | Kerberos service ticket requested |\n| 4771 | Security | Kerberos pre-authentication failed |\n| 4776 | Security | NTLM credential validation |\n| 5136 | Security | Directory object modified |\n| 5137 | Security | Directory object created |\n| 4706 | Security | Trust created |\n| 4707 | Security | Trust removed |\n| 4742 | Security | Computer account changed |\n| 8222 | System | Shadow copy created |\n\n## Tools for AD Investigation\n\n| Tool | Purpose |\n|------|---------|\n| **BloodHound** | Attack path mapping and privilege escalation analysis |\n| **Pingcastle** | AD security assessment and risk scoring |\n| **Purple Knight** | AD vulnerability scanning by Semperis |\n| **ADRecon** | Active Directory data gathering |\n| **Mimikatz** | Credential extraction and Kerberos analysis |\n| **Impacket** | DCSync detection and NTLM relay analysis |\n| **Velociraptor** | Remote forensic artifact collection |\n| **Timeline Explorer** | Event log timeline analysis |\n\n## MITRE ATT&CK Mapping\n\n| Technique | ID | Relevance |\n|-----------|----|-----------|\n| DCSync | T1003.006 | NTDS.dit credential extraction |\n| Golden Ticket | T1558.001 | Kerberos TGT forgery |\n| Silver Ticket | T1558.002 | Service ticket forgery |\n| Kerberoasting | T1558.003 | Service account hash extraction |\n| Pass-the-Hash | T1550.002 | NTLM hash reuse |\n| Group Policy Modification | T1484.001 | Persistence via GPO |\n| Account Manipulation | T1098 | Privileged group changes |\n| SID-History Injection | T1134.005 | Privilege escalation |\n\n## References\n\n- [CISA: Detecting and Mitigating Active Directory Compromises](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fdetecting-and-mitigating-active-directory-compromises)\n- [Microsoft: Total Identity Compromise IR Lessons](https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftsecurityexperts\u002Ftotal-identity-compromise-microsoft-incident-response-lessons-on-securing-active\u002F3753391)\n- [Semperis: Top 10 Active Directory Risks](https:\u002F\u002Fwww.semperis.com\u002Fblog\u002F10-ad-risks-caught-by-identity-forensics-and-incident-response\u002F)\n- [Fidelis: Active Directory Compromise Response](https:\u002F\u002Ffidelissecurity.com\u002Fthreatgeek\u002Factive-directory-security\u002Frespond-after-an-active-directory-compromise\u002F)\n",{"name":5,"tags":49,"author":53,"domain":42,"license":15,"version":54,"nist_csf":55,"subdomain":60,"description":7,"mitre_attack":61,"d3fend_techniques":67},[36,28,50,51,32,35,52,33],"identity-forensics","kerberos","ntds-dit","mahipal","1.0",[56,57,58,59],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response",[62,63,64,65,66],"T1486","T1490","T1070","T1078","T1021",[68,69,70,71,72],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-active-directory-compromise-investigation",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-compromise-investigation",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-compromise-investigation",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-active-directory-compromise-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002FSKILL.md",true,[97,103,108,114,118,122,128],{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"assets\u002Ftemplate.md","ASSET","资产文件",3816,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002Fassets\u002Ftemplate.md",{"path":104,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002FLICENSE",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fapi-reference.md","REFERENCE","参考文档",2646,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002Freferences\u002Fapi-reference.md",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fstandards.md",2659,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002Freferences\u002Fstandards.md",{"path":119,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fworkflows.md",4096,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002Freferences\u002Fworkflows.md",{"path":123,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fagent.py","SCRIPT","脚本",9075,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002Fscripts\u002Fagent.py",{"path":129,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fprocess.py",22805,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-active-directory-compromise-investigation\u002Fscripts\u002Fprocess.py",[133,161,184,209,233,260],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":142,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[139],{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[143,144,145,146,147,42,148,41,149,150,151,152,153,154,155,156,157,158,159,160],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[167],{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[169,157,170,171,147,43,42,149,172,173,174,175,176,177,178,179,180,181,182,183],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":194,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[190,193],{"categoryNo":191,"categoryName":192,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[178,195,196,197,198,42,199,200,172,201,202,60,203,204,205,31,30,206,207,208],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","immutable","disaster-recovery","restore-testing",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[215],{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,42,220,221,39,222,35,223,224,225,226,227,228,229,175,230,231,232],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[239],{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[241,242,243,42,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[266],{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},[147,268,42,269,270,271,272,273,274,275,276,31,277,30,29,278,279,280,281,282],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]