[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFXWBWZGQY9DRDPS9ZBNMS":3,"skill-same:01M6AFXWBWZGQY9DRDPS9ZBNMS":120},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":64,"repositoryHtmlUrl":65,"repositoryHomepageUrl":66,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AFXWBWZGQY9DRDPS9ZBNMS","performing-network-packet-capture-analysis",null,"Perform forensic analysis of network packet captures (PCAP\u002FPCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"performing network packet capture analysis","analysis","network","data","network-evidence","pcapng","packet-capture","tcpdump","tshark","t1074","Wireshark","malicious","network-forensics","exfiltration","protocol-analysis","command-and-control","forensics","file","protocol","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-network-packet-capture-analysis\ndescription: Perform forensic analysis of network packet captures (PCAP\u002FPCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- pcap\n- wireshark\n- tshark\n- tcpdump\n- network-forensics\n- packet-capture\n- protocol-analysis\n- traffic-analysis\n- pcapng\n- network-evidence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1048\n---\n\n# Performing Network Packet Capture Analysis\n\n## Overview\n\nNetwork packet captures (PCAP\u002FPCAPNG files) represent the ultimate source of truth about network activity and provide irrefutable evidence of communications between hosts. PCAP files log every packet transmitted over a network segment, making them vital for forensic investigations involving data exfiltration, command-and-control communications, lateral movement, malware delivery, and unauthorized access. Wireshark is the primary tool for interactive analysis, while tshark provides command-line capabilities for automated processing and scripting. Modern PCAPNG format supports additional metadata including interface descriptions, capture comments, precise timestamps, and per-packet annotations.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network packet capture analysis\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Wireshark 4.x with protocol dissectors\n- tshark command-line tool (included with Wireshark)\n- tcpdump for capture and basic filtering\n- Python 3.8+ with scapy and pyshark libraries\n- Sufficient disk space for PCAP files (can be multi-GB)\n\n## Capture Techniques\n\n### tcpdump\n\n```bash\n# Capture all traffic on interface eth0\ntcpdump -i eth0 -w capture.pcap\n\n# Capture with rotation (100MB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d_%H%M%S.pcap -C 100 -W 10\n\n# Capture specific host traffic\ntcpdump -i eth0 host 192.168.1.100 -w host_traffic.pcap\n\n# Capture specific port traffic\ntcpdump -i eth0 port 443 -w https_traffic.pcap\n\n# Capture with BPF filter for suspicious ports\ntcpdump -i eth0 'port 4444 or port 8080 or port 1337' -w suspicious.pcap\n```\n\n### Wireshark Display Filters\n\n```\n# HTTP traffic\nhttp\n\n# DNS queries\ndns\n\n# SMB file transfers\nsmb2\n\n# Specific IP communication\nip.addr == 192.168.1.100\n\n# Failed TCP connections\ntcp.flags.syn == 1 && tcp.flags.ack == 0\n\n# Large data transfers (potential exfiltration)\ntcp.len > 1000\n\n# Specific protocol by port\ntcp.port == 4444\n\n# TLS handshakes (SNI extraction)\ntls.handshake.type == 1\n\n# HTTP POST requests\nhttp.request.method == \"POST\"\n\n# DNS queries to suspicious TLDs\ndns.qry.name contains \".xyz\" or dns.qry.name contains \".top\"\n\n# Beaconing detection (regular intervals)\nframe.time_delta_displayed > 55 && frame.time_delta_displayed \u003C 65\n```\n\n### tshark Analysis Commands\n\n```bash\n# Extract HTTP URLs from capture\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.host -e http.request.uri\n\n# Extract DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e dns.qry.name | sort -u\n\n# Extract file transfers (HTTP objects)\ntshark -r capture.pcap --export-objects http,exported_files\u002F\n\n# Extract SMB file transfers\ntshark -r capture.pcap --export-objects smb,smb_files\u002F\n\n# Protocol hierarchy statistics\ntshark -r capture.pcap -z io,phs\n\n# Conversation statistics\ntshark -r capture.pcap -z conv,tcp\n\n# Extract TLS SNI (Server Name Indication)\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" -T fields -e tls.handshake.extensions_server_name\n\n# Top talkers by bytes\ntshark -r capture.pcap -z endpoints,ip -q\n\n# Extract credentials (FTP, HTTP Basic)\ntshark -r capture.pcap -Y \"ftp.request.command == USER || ftp.request.command == PASS || http.authorization\" -T fields -e ftp.request.arg -e http.authorization\n```\n\n## Python PCAP Analysis\n\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR, Raw\nimport os\nimport sys\nimport json\nfrom collections import defaultdict, Counter\nfrom datetime import datetime\n\n\nclass PCAPForensicAnalyzer:\n    \"\"\"Forensic analysis of PCAP files using Scapy.\"\"\"\n\n    def __init__(self, pcap_path: str, output_dir: str):\n        self.pcap_path = pcap_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.packets = rdpcap(pcap_path)\n\n    def get_conversations(self) -> list:\n        \"\"\"Extract unique IP conversations with byte counts.\"\"\"\n        convos = defaultdict(lambda: {\"packets\": 0, \"bytes\": 0})\n        for pkt in self.packets:\n            if IP in pkt:\n                key = tuple(sorted([pkt[IP].src, pkt[IP].dst]))\n                convos[key][\"packets\"] += 1\n                convos[key][\"bytes\"] += len(pkt)\n\n        return [\n            {\"src\": k[0], \"dst\": k[1], \"packets\": v[\"packets\"], \"bytes\": v[\"bytes\"]}\n            for k, v in sorted(convos.items(), key=lambda x: x[1][\"bytes\"], reverse=True)\n        ]\n\n    def extract_dns_queries(self) -> list:\n        \"\"\"Extract all DNS queries from the capture.\"\"\"\n        queries = []\n        for pkt in self.packets:\n            if DNS in pkt and pkt[DNS].qr == 0 and DNSQR in pkt:\n                queries.append({\n                    \"query\": pkt[DNSQR].qname.decode(errors=\"replace\").rstrip(\".\"),\n                    \"type\": pkt[DNSQR].qtype,\n                    \"src\": pkt[IP].src if IP in pkt else \"unknown\"\n                })\n        return queries\n\n    def detect_beaconing(self, threshold_seconds: float = 5.0) -> list:\n        \"\"\"Detect potential beaconing activity based on regular intervals.\"\"\"\n        ip_timestamps = defaultdict(list)\n        for pkt in self.packets:\n            if IP in pkt and TCP in pkt:\n                key = (pkt[IP].src, pkt[IP].dst, pkt[TCP].dport)\n                ip_timestamps[key].append(float(pkt.time))\n\n        beacons = []\n        for key, times in ip_timestamps.items():\n            if len(times) \u003C 5:\n                continue\n            deltas = [times[i+1] - times[i] for i in range(len(times)-1)]\n            if deltas:\n                avg_delta = sum(deltas) \u002F len(deltas)\n                variance = sum((d - avg_delta) ** 2 for d in deltas) \u002F len(deltas)\n                if variance \u003C threshold_seconds and avg_delta > 1:\n                    beacons.append({\n                        \"src\": key[0], \"dst\": key[1], \"port\": key[2],\n                        \"avg_interval\": round(avg_delta, 2),\n                        \"variance\": round(variance, 4),\n                        \"connection_count\": len(times)\n                    })\n        return sorted(beacons, key=lambda x: x[\"variance\"])\n\n    def get_protocol_distribution(self) -> dict:\n        \"\"\"Get protocol distribution statistics.\"\"\"\n        protocols = Counter()\n        for pkt in self.packets:\n            if TCP in pkt:\n                protocols[f\"TCP\u002F{pkt[TCP].dport}\"] += 1\n            elif UDP in pkt:\n                protocols[f\"UDP\u002F{pkt[UDP].dport}\"] += 1\n        return dict(protocols.most_common(50))\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PCAP analysis report.\"\"\"\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pcap_file\": self.pcap_path,\n            \"total_packets\": len(self.packets),\n            \"conversations\": self.get_conversations()[:50],\n            \"dns_queries\": self.extract_dns_queries()[:200],\n            \"potential_beacons\": self.detect_beaconing(),\n            \"protocol_distribution\": self.get_protocol_distribution()\n        }\n\n        report_path = os.path.join(self.output_dir, \"pcap_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2)\n\n        print(f\"[*] Total packets: {report['total_packets']}\")\n        print(f\"[*] Conversations: {len(report['conversations'])}\")\n        print(f\"[*] DNS queries: {len(report['dns_queries'])}\")\n        print(f\"[*] Potential beacons: {len(report['potential_beacons'])}\")\n        return report_path\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpcap_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PCAPForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Wireshark Documentation: https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002F\n- PCAP Analysis Mastery: https:\u002F\u002Finsanecyber.com\u002Fmastering-pcap-review\u002F\n- SANS Network Forensics: https:\u002F\u002Fwww.sans.org\u002Fcyber-security-courses\u002Fnetwork-forensics\u002F\n- Public PCAPs for Practice: https:\u002F\u002Fwww.netresec.com\u002F?page=PcapFiles\n","# Performing Network Packet Capture Analysis\n\n## Overview\n\nNetwork packet captures (PCAP\u002FPCAPNG files) represent the ultimate source of truth about network activity and provide irrefutable evidence of communications between hosts. PCAP files log every packet transmitted over a network segment, making them vital for forensic investigations involving data exfiltration, command-and-control communications, lateral movement, malware delivery, and unauthorized access. Wireshark is the primary tool for interactive analysis, while tshark provides command-line capabilities for automated processing and scripting. Modern PCAPNG format supports additional metadata including interface descriptions, capture comments, precise timestamps, and per-packet annotations.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing network packet capture analysis\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Wireshark 4.x with protocol dissectors\n- tshark command-line tool (included with Wireshark)\n- tcpdump for capture and basic filtering\n- Python 3.8+ with scapy and pyshark libraries\n- Sufficient disk space for PCAP files (can be multi-GB)\n\n## Capture Techniques\n\n### tcpdump\n\n```bash\n# Capture all traffic on interface eth0\ntcpdump -i eth0 -w capture.pcap\n\n# Capture with rotation (100MB files, keep 10)\ntcpdump -i eth0 -w capture_%Y%m%d_%H%M%S.pcap -C 100 -W 10\n\n# Capture specific host traffic\ntcpdump -i eth0 host 192.168.1.100 -w host_traffic.pcap\n\n# Capture specific port traffic\ntcpdump -i eth0 port 443 -w https_traffic.pcap\n\n# Capture with BPF filter for suspicious ports\ntcpdump -i eth0 'port 4444 or port 8080 or port 1337' -w suspicious.pcap\n```\n\n### Wireshark Display Filters\n\n```\n# HTTP traffic\nhttp\n\n# DNS queries\ndns\n\n# SMB file transfers\nsmb2\n\n# Specific IP communication\nip.addr == 192.168.1.100\n\n# Failed TCP connections\ntcp.flags.syn == 1 && tcp.flags.ack == 0\n\n# Large data transfers (potential exfiltration)\ntcp.len > 1000\n\n# Specific protocol by port\ntcp.port == 4444\n\n# TLS handshakes (SNI extraction)\ntls.handshake.type == 1\n\n# HTTP POST requests\nhttp.request.method == \"POST\"\n\n# DNS queries to suspicious TLDs\ndns.qry.name contains \".xyz\" or dns.qry.name contains \".top\"\n\n# Beaconing detection (regular intervals)\nframe.time_delta_displayed > 55 && frame.time_delta_displayed \u003C 65\n```\n\n### tshark Analysis Commands\n\n```bash\n# Extract HTTP URLs from capture\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.host -e http.request.uri\n\n# Extract DNS queries\ntshark -r capture.pcap -Y \"dns.flags.response == 0\" -T fields -e dns.qry.name | sort -u\n\n# Extract file transfers (HTTP objects)\ntshark -r capture.pcap --export-objects http,exported_files\u002F\n\n# Extract SMB file transfers\ntshark -r capture.pcap --export-objects smb,smb_files\u002F\n\n# Protocol hierarchy statistics\ntshark -r capture.pcap -z io,phs\n\n# Conversation statistics\ntshark -r capture.pcap -z conv,tcp\n\n# Extract TLS SNI (Server Name Indication)\ntshark -r capture.pcap -Y \"tls.handshake.type == 1\" -T fields -e tls.handshake.extensions_server_name\n\n# Top talkers by bytes\ntshark -r capture.pcap -z endpoints,ip -q\n\n# Extract credentials (FTP, HTTP Basic)\ntshark -r capture.pcap -Y \"ftp.request.command == USER || ftp.request.command == PASS || http.authorization\" -T fields -e ftp.request.arg -e http.authorization\n```\n\n## Python PCAP Analysis\n\n```python\nfrom scapy.all import rdpcap, IP, TCP, UDP, DNS, DNSQR, Raw\nimport os\nimport sys\nimport json\nfrom collections import defaultdict, Counter\nfrom datetime import datetime\n\n\nclass PCAPForensicAnalyzer:\n    \"\"\"Forensic analysis of PCAP files using Scapy.\"\"\"\n\n    def __init__(self, pcap_path: str, output_dir: str):\n        self.pcap_path = pcap_path\n        self.output_dir = output_dir\n        os.makedirs(output_dir, exist_ok=True)\n        self.packets = rdpcap(pcap_path)\n\n    def get_conversations(self) -> list:\n        \"\"\"Extract unique IP conversations with byte counts.\"\"\"\n        convos = defaultdict(lambda: {\"packets\": 0, \"bytes\": 0})\n        for pkt in self.packets:\n            if IP in pkt:\n                key = tuple(sorted([pkt[IP].src, pkt[IP].dst]))\n                convos[key][\"packets\"] += 1\n                convos[key][\"bytes\"] += len(pkt)\n\n        return [\n            {\"src\": k[0], \"dst\": k[1], \"packets\": v[\"packets\"], \"bytes\": v[\"bytes\"]}\n            for k, v in sorted(convos.items(), key=lambda x: x[1][\"bytes\"], reverse=True)\n        ]\n\n    def extract_dns_queries(self) -> list:\n        \"\"\"Extract all DNS queries from the capture.\"\"\"\n        queries = []\n        for pkt in self.packets:\n            if DNS in pkt and pkt[DNS].qr == 0 and DNSQR in pkt:\n                queries.append({\n                    \"query\": pkt[DNSQR].qname.decode(errors=\"replace\").rstrip(\".\"),\n                    \"type\": pkt[DNSQR].qtype,\n                    \"src\": pkt[IP].src if IP in pkt else \"unknown\"\n                })\n        return queries\n\n    def detect_beaconing(self, threshold_seconds: float = 5.0) -> list:\n        \"\"\"Detect potential beaconing activity based on regular intervals.\"\"\"\n        ip_timestamps = defaultdict(list)\n        for pkt in self.packets:\n            if IP in pkt and TCP in pkt:\n                key = (pkt[IP].src, pkt[IP].dst, pkt[TCP].dport)\n                ip_timestamps[key].append(float(pkt.time))\n\n        beacons = []\n        for key, times in ip_timestamps.items():\n            if len(times) \u003C 5:\n                continue\n            deltas = [times[i+1] - times[i] for i in range(len(times)-1)]\n            if deltas:\n                avg_delta = sum(deltas) \u002F len(deltas)\n                variance = sum((d - avg_delta) ** 2 for d in deltas) \u002F len(deltas)\n                if variance \u003C threshold_seconds and avg_delta > 1:\n                    beacons.append({\n                        \"src\": key[0], \"dst\": key[1], \"port\": key[2],\n                        \"avg_interval\": round(avg_delta, 2),\n                        \"variance\": round(variance, 4),\n                        \"connection_count\": len(times)\n                    })\n        return sorted(beacons, key=lambda x: x[\"variance\"])\n\n    def get_protocol_distribution(self) -> dict:\n        \"\"\"Get protocol distribution statistics.\"\"\"\n        protocols = Counter()\n        for pkt in self.packets:\n            if TCP in pkt:\n                protocols[f\"TCP\u002F{pkt[TCP].dport}\"] += 1\n            elif UDP in pkt:\n                protocols[f\"UDP\u002F{pkt[UDP].dport}\"] += 1\n        return dict(protocols.most_common(50))\n\n    def generate_report(self) -> str:\n        \"\"\"Generate comprehensive PCAP analysis report.\"\"\"\n        report = {\n            \"analysis_timestamp\": datetime.now().isoformat(),\n            \"pcap_file\": self.pcap_path,\n            \"total_packets\": len(self.packets),\n            \"conversations\": self.get_conversations()[:50],\n            \"dns_queries\": self.extract_dns_queries()[:200],\n            \"potential_beacons\": self.detect_beaconing(),\n            \"protocol_distribution\": self.get_protocol_distribution()\n        }\n\n        report_path = os.path.join(self.output_dir, \"pcap_forensic_report.json\")\n        with open(report_path, \"w\") as f:\n            json.dump(report, f, indent=2)\n\n        print(f\"[*] Total packets: {report['total_packets']}\")\n        print(f\"[*] Conversations: {len(report['conversations'])}\")\n        print(f\"[*] DNS queries: {len(report['dns_queries'])}\")\n        print(f\"[*] Potential beacons: {len(report['potential_beacons'])}\")\n        return report_path\n\n\ndef main():\n    if len(sys.argv) \u003C 3:\n        print(\"Usage: python process.py \u003Cpcap_file> \u003Coutput_dir>\")\n        sys.exit(1)\n    analyzer = PCAPForensicAnalyzer(sys.argv[1], sys.argv[2])\n    analyzer.generate_report()\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- Wireshark Documentation: https:\u002F\u002Fwww.wireshark.org\u002Fdocs\u002F\n- PCAP Analysis Mastery: https:\u002F\u002Finsanecyber.com\u002Fmastering-pcap-review\u002F\n- SANS Network Forensics: https:\u002F\u002Fwww.sans.org\u002Fcyber-security-courses\u002Fnetwork-forensics\u002F\n- Public PCAPs for Practice: https:\u002F\u002Fwww.netresec.com\u002F?page=PcapFiles\n",{"name":5,"tags":44,"author":48,"domain":38,"license":15,"version":49,"nist_csf":50,"subdomain":54,"description":7,"mitre_attack":55},[45,46,27,26,31,25,33,47,24,23],"pcap","wireshark","traffic-analysis","mahipal","1.0",[51,52,53],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[56,57,58,59,60],"T1005","T1074","T1119","T1070","T1048","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-network-packet-capture-analysis",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-network-packet-capture-analysis",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-network-packet-capture-analysis",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-network-packet-capture-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002FSKILL.md",true,[85,91,96,102,106,110,116],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",458,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1607,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fstandards.md",527,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002Freferences\u002Fstandards.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflows.md",469,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002Freferences\u002Fworkflows.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",6137,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002Fscripts\u002Fagent.py",{"path":117,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",1823,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-network-packet-capture-analysis\u002Fscripts\u002Fprocess.py",[121,152,176,204,228,255],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":132,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[127],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[133,134,135,136,137,38,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[158],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[160,148,161,162,137,163,38,140,164,165,166,167,168,169,170,171,172,173,174,175],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":186,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[182,185],{"categoryNo":183,"categoryName":184,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[170,187,188,189,190,38,191,192,164,193,194,195,196,197,198,199,200,201,202,203],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[212,213,214,38,215,216,217,218,219,220,221,22,222,223,54,224,167,225,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[236,237,238,38,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[137,263,38,264,36,265,266,267,268,269,270,199,271,200,20,272,273,274,275,276],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]