[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFPF0RETMB8CDRV1EV19VY":3,"skill-same:01M6AFPF0RETMB8CDRV1EV19VY":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AFPF0RETMB8CDRV1EV19VY","performing-cloud-log-forensics-with-athena",null,"Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-log-forensics-with-athena\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"performing cloud log forensics with athena","cloud","forensics","exfiltration","alb","vpc-flow-logs","athena","vpc","t1078","escalation","data","flow","security","cloud-security","logs","create","pr","sql","workflows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-cloud-log-forensics-with-athena\ndescription: 'Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs,\n  and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition\n  projection, forensic SQL queries for detecting unauthorized access, data exfiltration,\n  lateral movement, and privilege escalation. Use when investigating AWS security\n  incidents or building cloud-native forensic workflows at scale.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud\n- forensics\n- athena\n- aws\n- cloudtrail\n- vpc-flow-logs\n- s3\n- alb\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1021\n---\n\n# Performing Cloud Log Forensics with AWS Athena\n\n## When to Use\n\n- When investigating AWS security incidents that require querying massive volumes of cloud logs\n- When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs\n- When building reusable Athena tables with partition projection for ongoing incident response\n- When hunting for indicators of compromise across multiple AWS log sources simultaneously\n- When creating evidence-grade SQL queries for compliance audits or legal proceedings\n\n## Prerequisites\n\n- AWS account with Athena, S3, and Glue permissions\n- CloudTrail configured to deliver logs to an S3 bucket\n- VPC Flow Logs enabled and publishing to S3\n- S3 server access logging enabled on target buckets\n- ALB access logging enabled and publishing to S3\n- Python 3.8+ with boto3 installed\n- Appropriate IAM permissions for Athena queries and S3 access\n\n## Instructions\n\n### Phase 1: Create Athena Database and CloudTrail Table\n\nCreate a dedicated forensics database and CloudTrail table using partition projection\nto automatically discover partitions without manual ALTER TABLE statements.\n\n```sql\nCREATE DATABASE IF NOT EXISTS cloud_forensics;\n\nCREATE EXTERNAL TABLE cloud_forensics.cloudtrail_logs (\n    eventVersion STRING,\n    userIdentity STRUCT\u003C\n        type: STRING,\n        principalId: STRING,\n        arn: STRING,\n        accountId: STRING,\n        invokedBy: STRING,\n        accessKeyId: STRING,\n        userName: STRING,\n        sessionContext: STRUCT\u003C\n            attributes: STRUCT\u003C\n                mfaAuthenticated: STRING,\n                creationDate: STRING>,\n            sessionIssuer: STRUCT\u003C\n                type: STRING,\n                principalId: STRING,\n                arn: STRING,\n                accountId: STRING,\n                userName: STRING>,\n            ec2RoleDelivery: STRING,\n            webIdFederationData: STRUCT\u003C\n                federatedProvider: STRING,\n                attributes: MAP\u003CSTRING, STRING>>>>,\n    eventTime STRING,\n    eventSource STRING,\n    eventName STRING,\n    awsRegion STRING,\n    sourceIPAddress STRING,\n    userAgent STRING,\n    errorCode STRING,\n    errorMessage STRING,\n    requestParameters STRING,\n    responseElements STRING,\n    additionalEventData STRING,\n    requestId STRING,\n    eventId STRING,\n    readOnly STRING,\n    resources ARRAY\u003CSTRUCT\u003C\n        arn: STRING,\n        accountId: STRING,\n        type: STRING>>,\n    eventType STRING,\n    apiVersion STRING,\n    recipientAccountId STRING,\n    serviceEventDetails STRING,\n    sharedEventID STRING,\n    vpcEndpointId STRING,\n    tlsDetails STRUCT\u003C\n        tlsVersion: STRING,\n        cipherSuite: STRING,\n        clientProvidedHostHeader: STRING>\n)\nCOMMENT 'CloudTrail logs with partition projection for forensic analysis'\nPARTITIONED BY (\n    `account` STRING,\n    `region` STRING,\n    `timestamp` STRING\n)\nROW FORMAT SERDE 'org.apache.hive.hcatalog.data.JsonSerDe'\nSTORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.account.type' = 'enum',\n    'projection.account.values' = 'YOUR_ACCOUNT_ID',\n    'projection.region.type' = 'enum',\n    'projection.region.values' = 'us-east-1,us-west-2,eu-west-1',\n    'projection.timestamp.type' = 'date',\n    'projection.timestamp.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.timestamp.range' = '2023\u002F01\u002F01,NOW',\n    'projection.timestamp.interval' = '1',\n    'projection.timestamp.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F${account}\u002FCloudTrail\u002F${region}\u002F${timestamp}'\n);\n```\n\n### Phase 2: Create VPC Flow Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.vpc_flow_logs (\n    version INT,\n    account_id STRING,\n    interface_id STRING,\n    srcaddr STRING,\n    dstaddr STRING,\n    srcport INT,\n    dstport INT,\n    protocol BIGINT,\n    packets BIGINT,\n    bytes BIGINT,\n    start BIGINT,\n    `end` BIGINT,\n    action STRING,\n    log_status STRING,\n    vpc_id STRING,\n    subnet_id STRING,\n    az_id STRING,\n    sublocation_type STRING,\n    sublocation_id STRING,\n    pkt_srcaddr STRING,\n    pkt_dstaddr STRING,\n    region STRING,\n    pkt_src_aws_service STRING,\n    pkt_dst_aws_service STRING,\n    flow_direction STRING,\n    traffic_path INT\n)\nPARTITIONED BY (\n    `date` STRING\n)\nROW FORMAT DELIMITED\nFIELDS TERMINATED BY ' '\nLOCATION 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002F'\nTBLPROPERTIES (\n    'skip.header.line.count' = '1',\n    'projection.enabled' = 'true',\n    'projection.date.type' = 'date',\n    'projection.date.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.date.range' = '2023\u002F01\u002F01,NOW',\n    'projection.date.interval' = '1',\n    'projection.date.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002Fus-east-1\u002F${date}'\n);\n```\n\n### Phase 3: Create S3 Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.s3_access_logs (\n    bucket_owner STRING,\n    bucket_name STRING,\n    request_datetime STRING,\n    remote_ip STRING,\n    requester STRING,\n    request_id STRING,\n    operation STRING,\n    key STRING,\n    request_uri STRING,\n    http_status INT,\n    error_code STRING,\n    bytes_sent BIGINT,\n    object_size BIGINT,\n    total_time INT,\n    turn_around_time INT,\n    referrer STRING,\n    user_agent STRING,\n    version_id STRING,\n    host_id STRING,\n    signature_version STRING,\n    cipher_suite STRING,\n    authentication_type STRING,\n    host_header STRING,\n    tls_version STRING,\n    access_point_arn STRING,\n    acl_required STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) \\\\[(.*?)\\\\] ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) (-|[0-9]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*)'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-S3-ACCESS-LOGS-BUCKET\u002Flogs\u002F';\n```\n\n### Phase 4: Create ALB Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.alb_access_logs (\n    type STRING,\n    time STRING,\n    elb STRING,\n    client_ip STRING,\n    client_port INT,\n    target_ip STRING,\n    target_port INT,\n    request_processing_time DOUBLE,\n    target_processing_time DOUBLE,\n    response_processing_time DOUBLE,\n    elb_status_code INT,\n    target_status_code STRING,\n    received_bytes BIGINT,\n    sent_bytes BIGINT,\n    request_verb STRING,\n    request_url STRING,\n    request_proto STRING,\n    user_agent STRING,\n    ssl_cipher STRING,\n    ssl_protocol STRING,\n    target_group_arn STRING,\n    trace_id STRING,\n    domain_name STRING,\n    chosen_cert_arn STRING,\n    matched_rule_priority STRING,\n    request_creation_time STRING,\n    actions_executed STRING,\n    redirect_url STRING,\n    lambda_error_reason STRING,\n    target_port_list STRING,\n    target_status_code_list STRING,\n    classification STRING,\n    classification_reason STRING,\n    conn_trace_id STRING\n)\nPARTITIONED BY (\n    `day` STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*):([0-9]*) ([^ ]*)[:-]([0-9]*) ([-.0-9]*) ([-.0-9]*) ([-.0-9]*) (|[0-9]*) (-|[0-9]*) ([-0-9]*) ([-0-9]*) \\\"([^ ]*) (.*) (- |[^ ]*)\\\" \\\"([^\\\"]*)\\\" ([A-Z0-9-_]+) ([A-Za-z0-9.-]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" ([-.0-9]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\"'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.day.type' = 'date',\n    'projection.day.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.day.range' = '2023\u002F01\u002F01,NOW',\n    'projection.day.interval' = '1',\n    'projection.day.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F${day}'\n);\n```\n\n### Phase 5: Forensic Investigation Queries\n\n#### Detect Unauthorized API Calls\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS caller_arn,\n    useridentity.accountid AS account,\n    eventsource,\n    eventname,\n    errorcode,\n    errormessage,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE errorcode IN ('AccessDenied', 'UnauthorizedAccess', 'Client.UnauthorizedAccess')\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC\nLIMIT 1000;\n```\n\n#### Detect Privilege Escalation Attempts\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    eventsource,\n    json_extract_scalar(requestparameters, '$.policyArn') AS policy_arn,\n    json_extract_scalar(requestparameters, '$.roleName') AS role_name,\n    json_extract_scalar(requestparameters, '$.userName') AS target_user,\n    sourceipaddress\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventname IN (\n    'AttachUserPolicy', 'AttachRolePolicy', 'AttachGroupPolicy',\n    'PutUserPolicy', 'PutRolePolicy', 'PutGroupPolicy',\n    'CreatePolicyVersion', 'SetDefaultPolicyVersion',\n    'AddUserToGroup', 'UpdateAssumeRolePolicy',\n    'CreateAccessKey', 'CreateLoginProfile',\n    'UpdateLoginProfile', 'AssumeRole'\n)\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Data Exfiltration via S3\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    json_extract_scalar(requestparameters, '$.bucketName') AS bucket,\n    json_extract_scalar(requestparameters, '$.key') AS object_key,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventsource = 's3.amazonaws.com'\n    AND eventname IN ('GetObject', 'CopyObject', 'PutBucketPolicy',\n                      'PutBucketAcl', 'PutObjectAcl', 'SelectObjectContent')\n    AND sourceipaddress NOT LIKE '10.%'\n    AND sourceipaddress NOT LIKE '172.%'\n    AND sourceipaddress NOT LIKE '192.168.%'\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Lateral Movement via VPC Flow Logs\n\n```sql\nSELECT\n    srcaddr,\n    dstaddr,\n    dstport,\n    protocol,\n    SUM(packets) AS total_packets,\n    SUM(bytes) AS total_bytes,\n    COUNT(*) AS connection_count,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'ACCEPT'\n    AND srcaddr LIKE '10.%'\n    AND dstport IN (22, 3389, 5985, 5986, 445, 135, 139)\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr, dstaddr, dstport, protocol\nHAVING COUNT(*) > 100\nORDER BY connection_count DESC;\n```\n\n#### Detect Port Scanning Activity\n\n```sql\nSELECT\n    srcaddr,\n    COUNT(DISTINCT dstport) AS unique_ports_scanned,\n    COUNT(DISTINCT dstaddr) AS unique_targets,\n    SUM(packets) AS total_packets,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'REJECT'\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr\nHAVING COUNT(DISTINCT dstport) > 25\nORDER BY unique_ports_scanned DESC;\n```\n\n#### Detect Suspicious S3 Bulk Downloads\n\n```sql\nSELECT\n    remote_ip,\n    requester,\n    bucket_name,\n    COUNT(*) AS request_count,\n    SUM(bytes_sent) AS total_bytes_downloaded,\n    COUNT(DISTINCT key) AS unique_objects,\n    MIN(request_datetime) AS first_request,\n    MAX(request_datetime) AS last_request\nFROM cloud_forensics.s3_access_logs\nWHERE operation LIKE '%GET%'\n    AND http_status = 200\nGROUP BY remote_ip, requester, bucket_name\nHAVING COUNT(*) > 500\nORDER BY total_bytes_downloaded DESC;\n```\n\n#### Detect ALB-Level Injection Attempts\n\n```sql\nSELECT\n    time,\n    client_ip,\n    request_verb,\n    request_url,\n    elb_status_code,\n    target_status_code,\n    user_agent\nFROM cloud_forensics.alb_access_logs\nWHERE (\n    request_url LIKE '%UNION%SELECT%'\n    OR request_url LIKE '%\u003Cscript%'\n    OR request_url LIKE '%..\u002F..\u002F..\u002F%'\n    OR request_url LIKE '%\u002Fetc\u002Fpasswd%'\n    OR request_url LIKE '%cmd.exe%'\n    OR request_url LIKE '%\u002Fproc\u002Fself%'\n    OR request_url LIKE '%SLEEP(%'\n    OR request_url LIKE '%WAITFOR%'\n)\n    AND day BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nORDER BY time DESC;\n```\n\n### Phase 6: Cross-Log Correlation\n\nCorrelate findings across log sources for comprehensive incident timelines.\n\n```sql\n-- Correlate suspicious CloudTrail actor with VPC Flow Logs\nWITH suspicious_ips AS (\n    SELECT DISTINCT sourceipaddress AS ip\n    FROM cloud_forensics.cloudtrail_logs\n    WHERE errorcode = 'AccessDenied'\n        AND timestamp BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\n)\nSELECT\n    v.srcaddr,\n    v.dstaddr,\n    v.dstport,\n    v.protocol,\n    SUM(v.bytes) AS total_bytes,\n    COUNT(*) AS flow_count\nFROM cloud_forensics.vpc_flow_logs v\nJOIN suspicious_ips s ON v.srcaddr = s.ip\nWHERE v.date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY v.srcaddr, v.dstaddr, v.dstport, v.protocol\nORDER BY total_bytes DESC;\n```\n\n## Examples\n\n```python\n# Quick-start: run the forensics agent for a full investigation\npython agent.py \\\n    --action full_investigation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-01 \\\n    --end-date 2024-06-30 \\\n    --output forensics_report.json\n\n# Run specific queries only\npython agent.py \\\n    --action privilege_escalation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-15 \\\n    --end-date 2024-06-16\n\n# Create all forensic tables from scratch\npython agent.py \\\n    --action setup_tables \\\n    --cloudtrail-bucket my-cloudtrail-logs \\\n    --vpc-flow-bucket my-vpc-flow-logs \\\n    --s3-access-bucket my-s3-access-logs \\\n    --alb-bucket my-alb-logs \\\n    --account-id 123456789012 \\\n    --regions us-east-1,us-west-2\n```\n","# Performing Cloud Log Forensics with AWS Athena\n\n## When to Use\n\n- When investigating AWS security incidents that require querying massive volumes of cloud logs\n- When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs\n- When building reusable Athena tables with partition projection for ongoing incident response\n- When hunting for indicators of compromise across multiple AWS log sources simultaneously\n- When creating evidence-grade SQL queries for compliance audits or legal proceedings\n\n## Prerequisites\n\n- AWS account with Athena, S3, and Glue permissions\n- CloudTrail configured to deliver logs to an S3 bucket\n- VPC Flow Logs enabled and publishing to S3\n- S3 server access logging enabled on target buckets\n- ALB access logging enabled and publishing to S3\n- Python 3.8+ with boto3 installed\n- Appropriate IAM permissions for Athena queries and S3 access\n\n## Instructions\n\n### Phase 1: Create Athena Database and CloudTrail Table\n\nCreate a dedicated forensics database and CloudTrail table using partition projection\nto automatically discover partitions without manual ALTER TABLE statements.\n\n```sql\nCREATE DATABASE IF NOT EXISTS cloud_forensics;\n\nCREATE EXTERNAL TABLE cloud_forensics.cloudtrail_logs (\n    eventVersion STRING,\n    userIdentity STRUCT\u003C\n        type: STRING,\n        principalId: STRING,\n        arn: STRING,\n        accountId: STRING,\n        invokedBy: STRING,\n        accessKeyId: STRING,\n        userName: STRING,\n        sessionContext: STRUCT\u003C\n            attributes: STRUCT\u003C\n                mfaAuthenticated: STRING,\n                creationDate: STRING>,\n            sessionIssuer: STRUCT\u003C\n                type: STRING,\n                principalId: STRING,\n                arn: STRING,\n                accountId: STRING,\n                userName: STRING>,\n            ec2RoleDelivery: STRING,\n            webIdFederationData: STRUCT\u003C\n                federatedProvider: STRING,\n                attributes: MAP\u003CSTRING, STRING>>>>,\n    eventTime STRING,\n    eventSource STRING,\n    eventName STRING,\n    awsRegion STRING,\n    sourceIPAddress STRING,\n    userAgent STRING,\n    errorCode STRING,\n    errorMessage STRING,\n    requestParameters STRING,\n    responseElements STRING,\n    additionalEventData STRING,\n    requestId STRING,\n    eventId STRING,\n    readOnly STRING,\n    resources ARRAY\u003CSTRUCT\u003C\n        arn: STRING,\n        accountId: STRING,\n        type: STRING>>,\n    eventType STRING,\n    apiVersion STRING,\n    recipientAccountId STRING,\n    serviceEventDetails STRING,\n    sharedEventID STRING,\n    vpcEndpointId STRING,\n    tlsDetails STRUCT\u003C\n        tlsVersion: STRING,\n        cipherSuite: STRING,\n        clientProvidedHostHeader: STRING>\n)\nCOMMENT 'CloudTrail logs with partition projection for forensic analysis'\nPARTITIONED BY (\n    `account` STRING,\n    `region` STRING,\n    `timestamp` STRING\n)\nROW FORMAT SERDE 'org.apache.hive.hcatalog.data.JsonSerDe'\nSTORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.account.type' = 'enum',\n    'projection.account.values' = 'YOUR_ACCOUNT_ID',\n    'projection.region.type' = 'enum',\n    'projection.region.values' = 'us-east-1,us-west-2,eu-west-1',\n    'projection.timestamp.type' = 'date',\n    'projection.timestamp.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.timestamp.range' = '2023\u002F01\u002F01,NOW',\n    'projection.timestamp.interval' = '1',\n    'projection.timestamp.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-CLOUDTRAIL-BUCKET\u002FAWSLogs\u002F${account}\u002FCloudTrail\u002F${region}\u002F${timestamp}'\n);\n```\n\n### Phase 2: Create VPC Flow Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.vpc_flow_logs (\n    version INT,\n    account_id STRING,\n    interface_id STRING,\n    srcaddr STRING,\n    dstaddr STRING,\n    srcport INT,\n    dstport INT,\n    protocol BIGINT,\n    packets BIGINT,\n    bytes BIGINT,\n    start BIGINT,\n    `end` BIGINT,\n    action STRING,\n    log_status STRING,\n    vpc_id STRING,\n    subnet_id STRING,\n    az_id STRING,\n    sublocation_type STRING,\n    sublocation_id STRING,\n    pkt_srcaddr STRING,\n    pkt_dstaddr STRING,\n    region STRING,\n    pkt_src_aws_service STRING,\n    pkt_dst_aws_service STRING,\n    flow_direction STRING,\n    traffic_path INT\n)\nPARTITIONED BY (\n    `date` STRING\n)\nROW FORMAT DELIMITED\nFIELDS TERMINATED BY ' '\nLOCATION 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002F'\nTBLPROPERTIES (\n    'skip.header.line.count' = '1',\n    'projection.enabled' = 'true',\n    'projection.date.type' = 'date',\n    'projection.date.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.date.range' = '2023\u002F01\u002F01,NOW',\n    'projection.date.interval' = '1',\n    'projection.date.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-VPC-FLOW-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Fvpcflowlogs\u002Fus-east-1\u002F${date}'\n);\n```\n\n### Phase 3: Create S3 Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.s3_access_logs (\n    bucket_owner STRING,\n    bucket_name STRING,\n    request_datetime STRING,\n    remote_ip STRING,\n    requester STRING,\n    request_id STRING,\n    operation STRING,\n    key STRING,\n    request_uri STRING,\n    http_status INT,\n    error_code STRING,\n    bytes_sent BIGINT,\n    object_size BIGINT,\n    total_time INT,\n    turn_around_time INT,\n    referrer STRING,\n    user_agent STRING,\n    version_id STRING,\n    host_id STRING,\n    signature_version STRING,\n    cipher_suite STRING,\n    authentication_type STRING,\n    host_header STRING,\n    tls_version STRING,\n    access_point_arn STRING,\n    acl_required STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) \\\\[(.*?)\\\\] ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) (-|[0-9]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) (\\\"[^\\\"]*\\\"|-) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*)'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-S3-ACCESS-LOGS-BUCKET\u002Flogs\u002F';\n```\n\n### Phase 4: Create ALB Access Logs Table\n\n```sql\nCREATE EXTERNAL TABLE cloud_forensics.alb_access_logs (\n    type STRING,\n    time STRING,\n    elb STRING,\n    client_ip STRING,\n    client_port INT,\n    target_ip STRING,\n    target_port INT,\n    request_processing_time DOUBLE,\n    target_processing_time DOUBLE,\n    response_processing_time DOUBLE,\n    elb_status_code INT,\n    target_status_code STRING,\n    received_bytes BIGINT,\n    sent_bytes BIGINT,\n    request_verb STRING,\n    request_url STRING,\n    request_proto STRING,\n    user_agent STRING,\n    ssl_cipher STRING,\n    ssl_protocol STRING,\n    target_group_arn STRING,\n    trace_id STRING,\n    domain_name STRING,\n    chosen_cert_arn STRING,\n    matched_rule_priority STRING,\n    request_creation_time STRING,\n    actions_executed STRING,\n    redirect_url STRING,\n    lambda_error_reason STRING,\n    target_port_list STRING,\n    target_status_code_list STRING,\n    classification STRING,\n    classification_reason STRING,\n    conn_trace_id STRING\n)\nPARTITIONED BY (\n    `day` STRING\n)\nROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'\nWITH SERDEPROPERTIES (\n    'serialization.format' = '1',\n    'input.regex' = '([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*):([0-9]*) ([^ ]*)[:-]([0-9]*) ([-.0-9]*) ([-.0-9]*) ([-.0-9]*) (|[0-9]*) (-|[0-9]*) ([-0-9]*) ([-0-9]*) \\\"([^ ]*) (.*) (- |[^ ]*)\\\" \\\"([^\\\"]*)\\\" ([A-Z0-9-_]+) ([A-Za-z0-9.-]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" ([-.0-9]*) ([^ ]*) \\\"([^\\\"]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^\\\"]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\" \\\"([^ ]*)\\\"'\n)\nSTORED AS INPUTFORMAT 'org.apache.hadoop.mapred.TextInputFormat'\nOUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'\nLOCATION 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F'\nTBLPROPERTIES (\n    'projection.enabled' = 'true',\n    'projection.day.type' = 'date',\n    'projection.day.format' = 'yyyy\u002FMM\u002Fdd',\n    'projection.day.range' = '2023\u002F01\u002F01,NOW',\n    'projection.day.interval' = '1',\n    'projection.day.interval.unit' = 'DAYS',\n    'storage.location.template' = 's3:\u002F\u002FYOUR-ALB-LOGS-BUCKET\u002FAWSLogs\u002FYOUR_ACCOUNT_ID\u002Felasticloadbalancing\u002Fus-east-1\u002F${day}'\n);\n```\n\n### Phase 5: Forensic Investigation Queries\n\n#### Detect Unauthorized API Calls\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS caller_arn,\n    useridentity.accountid AS account,\n    eventsource,\n    eventname,\n    errorcode,\n    errormessage,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE errorcode IN ('AccessDenied', 'UnauthorizedAccess', 'Client.UnauthorizedAccess')\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC\nLIMIT 1000;\n```\n\n#### Detect Privilege Escalation Attempts\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    eventsource,\n    json_extract_scalar(requestparameters, '$.policyArn') AS policy_arn,\n    json_extract_scalar(requestparameters, '$.roleName') AS role_name,\n    json_extract_scalar(requestparameters, '$.userName') AS target_user,\n    sourceipaddress\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventname IN (\n    'AttachUserPolicy', 'AttachRolePolicy', 'AttachGroupPolicy',\n    'PutUserPolicy', 'PutRolePolicy', 'PutGroupPolicy',\n    'CreatePolicyVersion', 'SetDefaultPolicyVersion',\n    'AddUserToGroup', 'UpdateAssumeRolePolicy',\n    'CreateAccessKey', 'CreateLoginProfile',\n    'UpdateLoginProfile', 'AssumeRole'\n)\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Data Exfiltration via S3\n\n```sql\nSELECT\n    eventtime,\n    useridentity.arn AS actor,\n    eventname,\n    json_extract_scalar(requestparameters, '$.bucketName') AS bucket,\n    json_extract_scalar(requestparameters, '$.key') AS object_key,\n    sourceipaddress,\n    useragent\nFROM cloud_forensics.cloudtrail_logs\nWHERE eventsource = 's3.amazonaws.com'\n    AND eventname IN ('GetObject', 'CopyObject', 'PutBucketPolicy',\n                      'PutBucketAcl', 'PutObjectAcl', 'SelectObjectContent')\n    AND sourceipaddress NOT LIKE '10.%'\n    AND sourceipaddress NOT LIKE '172.%'\n    AND sourceipaddress NOT LIKE '192.168.%'\n    AND timestamp BETWEEN '2024\u002F01\u002F01' AND '2024\u002F12\u002F31'\nORDER BY eventtime DESC;\n```\n\n#### Detect Lateral Movement via VPC Flow Logs\n\n```sql\nSELECT\n    srcaddr,\n    dstaddr,\n    dstport,\n    protocol,\n    SUM(packets) AS total_packets,\n    SUM(bytes) AS total_bytes,\n    COUNT(*) AS connection_count,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'ACCEPT'\n    AND srcaddr LIKE '10.%'\n    AND dstport IN (22, 3389, 5985, 5986, 445, 135, 139)\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr, dstaddr, dstport, protocol\nHAVING COUNT(*) > 100\nORDER BY connection_count DESC;\n```\n\n#### Detect Port Scanning Activity\n\n```sql\nSELECT\n    srcaddr,\n    COUNT(DISTINCT dstport) AS unique_ports_scanned,\n    COUNT(DISTINCT dstaddr) AS unique_targets,\n    SUM(packets) AS total_packets,\n    MIN(from_unixtime(start)) AS first_seen,\n    MAX(from_unixtime(\"end\")) AS last_seen\nFROM cloud_forensics.vpc_flow_logs\nWHERE action = 'REJECT'\n    AND date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY srcaddr\nHAVING COUNT(DISTINCT dstport) > 25\nORDER BY unique_ports_scanned DESC;\n```\n\n#### Detect Suspicious S3 Bulk Downloads\n\n```sql\nSELECT\n    remote_ip,\n    requester,\n    bucket_name,\n    COUNT(*) AS request_count,\n    SUM(bytes_sent) AS total_bytes_downloaded,\n    COUNT(DISTINCT key) AS unique_objects,\n    MIN(request_datetime) AS first_request,\n    MAX(request_datetime) AS last_request\nFROM cloud_forensics.s3_access_logs\nWHERE operation LIKE '%GET%'\n    AND http_status = 200\nGROUP BY remote_ip, requester, bucket_name\nHAVING COUNT(*) > 500\nORDER BY total_bytes_downloaded DESC;\n```\n\n#### Detect ALB-Level Injection Attempts\n\n```sql\nSELECT\n    time,\n    client_ip,\n    request_verb,\n    request_url,\n    elb_status_code,\n    target_status_code,\n    user_agent\nFROM cloud_forensics.alb_access_logs\nWHERE (\n    request_url LIKE '%UNION%SELECT%'\n    OR request_url LIKE '%\u003Cscript%'\n    OR request_url LIKE '%..\u002F..\u002F..\u002F%'\n    OR request_url LIKE '%\u002Fetc\u002Fpasswd%'\n    OR request_url LIKE '%cmd.exe%'\n    OR request_url LIKE '%\u002Fproc\u002Fself%'\n    OR request_url LIKE '%SLEEP(%'\n    OR request_url LIKE '%WAITFOR%'\n)\n    AND day BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nORDER BY time DESC;\n```\n\n### Phase 6: Cross-Log Correlation\n\nCorrelate findings across log sources for comprehensive incident timelines.\n\n```sql\n-- Correlate suspicious CloudTrail actor with VPC Flow Logs\nWITH suspicious_ips AS (\n    SELECT DISTINCT sourceipaddress AS ip\n    FROM cloud_forensics.cloudtrail_logs\n    WHERE errorcode = 'AccessDenied'\n        AND timestamp BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\n)\nSELECT\n    v.srcaddr,\n    v.dstaddr,\n    v.dstport,\n    v.protocol,\n    SUM(v.bytes) AS total_bytes,\n    COUNT(*) AS flow_count\nFROM cloud_forensics.vpc_flow_logs v\nJOIN suspicious_ips s ON v.srcaddr = s.ip\nWHERE v.date BETWEEN '2024\u002F06\u002F01' AND '2024\u002F06\u002F30'\nGROUP BY v.srcaddr, v.dstaddr, v.dstport, v.protocol\nORDER BY total_bytes DESC;\n```\n\n## Examples\n\n```python\n# Quick-start: run the forensics agent for a full investigation\npython agent.py \\\n    --action full_investigation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-01 \\\n    --end-date 2024-06-30 \\\n    --output forensics_report.json\n\n# Run specific queries only\npython agent.py \\\n    --action privilege_escalation \\\n    --database cloud_forensics \\\n    --start-date 2024-06-15 \\\n    --end-date 2024-06-16\n\n# Create all forensic tables from scratch\npython agent.py \\\n    --action setup_tables \\\n    --cloudtrail-bucket my-cloudtrail-logs \\\n    --vpc-flow-bucket my-vpc-flow-logs \\\n    --s3-access-bucket my-s3-access-logs \\\n    --alb-bucket my-alb-logs \\\n    --account-id 123456789012 \\\n    --regions us-east-1,us-west-2\n```\n",{"name":5,"tags":54,"author":9,"domain":48,"license":15,"version":58,"nist_csf":59,"subdomain":42,"description":64,"mitre_attack":65},[30,31,35,55,56,34,57,33],"aws","cloudtrail","s3","1.0",[60,61,62,63],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.\n",[66,67,68,69,70],"T1078.004","T1530","T1537","T1580","T1021","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-cloud-log-forensics-with-athena",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-log-forensics-with-athena",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-log-forensics-with-athena",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-log-forensics-with-athena","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-log-forensics-with-athena\u002FSKILL.md",true,[95,100,106,110],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",802,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-log-forensics-with-athena\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",9210,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-log-forensics-with-athena\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fathena-forensics-reference.md",5080,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-log-forensics-with-athena\u002Freferences\u002Fathena-forensics-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",29600,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-log-forensics-with-athena\u002Fscripts\u002Fagent.py",[117,144,168,195,219,246],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":126,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[123],{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[127,128,129,130,41,48,131,132,45,133,134,135,136,137,138,139,140,141,142,143],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":151,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[150],{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},[152,140,153,154,41,155,48,45,156,157,158,159,160,161,162,163,164,165,166,167],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":178,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[174,177],{"categoryNo":175,"categoryName":176,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},[162,179,180,181,182,48,183,184,156,185,186,187,188,189,190,37,191,192,193,194],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[201],{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},[203,204,205,48,206,207,43,208,209,210,211,39,212,213,214,215,159,216,217,218],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[225],{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,48,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":247,"name":248,"nameZh":6,"description":249,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":250,"categories":251,"keywords":253,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[252],{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},[41,254,48,255,256,257,258,259,260,261,262,37,263,191,264,265,266,267,268,269],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]