[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGCEYZTY5JYWHN3T2H708A":3,"skill-same:01M6AGCEYZTY5JYWHN3T2H708A":145},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":89,"repositoryHtmlUrl":90,"repositoryHomepageUrl":91,"ownerHtmlUrl":92,"ownerBlogUrl":93,"ownerDescription":94,"updatedAt":95,"install":96,"resources":109},"01M6AGCEYZTY5JYWHN3T2H708A","testing-ransomware-recovery-procedures",null,"Tests and validates ransomware recovery procedures - backup restore operations (e.g. with Restic), RTO\u002FRPO target verification, recovery sequencing, and clean-restore validation - to confirm organizational resilience against destructive ransomware attacks. Use when validating that recovery plans work under realistic conditions, measuring RTO\u002FRPO against business requirements, or testing restore integrity after simulated encryption.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-ransomware-recovery-procedures\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing ransomware recovery procedures","recovery","ransomware","testing","t1078","rpo","rto","disaster-recovery","backup","restic","integrity","t1490","cryptocurrency","encryption","incident-response","transfer","verification","validation","resilience","cybersecurity","2026-11-10 10:12:30",false,"---\nname: testing-ransomware-recovery-procedures\ndescription: Tests and validates ransomware recovery procedures - backup restore operations\n  (e.g. with Restic), RTO\u002FRPO target verification, recovery sequencing, and clean-restore\n  validation - to confirm organizational resilience against destructive ransomware attacks.\n  Use when validating that recovery plans work under realistic conditions, measuring\n  RTO\u002FRPO against business requirements, or testing restore integrity after simulated encryption.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- incident-response\n- ransomware\n- disaster-recovery\n- backup\n- rto\n- rpo\n- resilience\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\n- T1489\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - positioning\n  - monetization\n  techniques:\n  - id: T1531\n    name: Account Access Removal\n    tactic: positioning\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1047\n    name: Transfer of funds\n    tactic: monetization\n    source: f3\n  - id: F1017.001\n    name: 'Conversion to Physical Monetary Instruments: Cash'\n    tactic: monetization\n    source: f3\n---\n# Testing Ransomware Recovery Procedures\n\n## When to Use\n\nUse this skill when:\n- Validating that ransomware recovery plans actually work under realistic conditions\n- Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements\n- Testing backup restore operations to confirm data integrity and completeness after simulated encryption\n- Conducting tabletop exercises or live recovery drills for ransomware scenarios\n- Auditing disaster recovery readiness as part of compliance or cyber insurance requirements\n\n**Do not use** for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.\n\n## Prerequisites\n\n- Isolated recovery test environment (air-gapped or network-segmented lab)\n- Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)\n- Documented RTO\u002FRPO targets per application tier from business impact analysis\n- Backup copies available for restore testing (production replicas or test snapshots)\n- Recovery runbooks with step-by-step procedures for each critical system\n\n## Workflow\n\n### Step 1: Define Recovery Test Scope\n\nIdentify critical systems and their tiered recovery targets:\n\n| Tier | System Type | RTO Target | RPO Target | Example |\n|------|------------|------------|------------|---------|\n| Tier 1 | Mission-critical | \u003C 1 hour | \u003C 15 min | Active Directory, core database |\n| Tier 2 | Business-critical | \u003C 4 hours | \u003C 1 hour | ERP, email, CRM |\n| Tier 3 | Business-operational | \u003C 24 hours | \u003C 4 hours | File shares, internal apps |\n| Tier 4 | Non-critical | \u003C 72 hours | \u003C 24 hours | Dev\u002Ftest, analytics |\n\n### Step 2: Prepare Test Environment\n\n```bash\n# Verify isolated recovery network is segmented\n# No routes to production should exist\nip route show | grep -v \"192.168.100.0\u002F24\"  # recovery VLAN only\n\n# Verify backup catalog is accessible\nrestic snapshots --repo s3:s3.amazonaws.com\u002Fbackup-bucket --password-file \u002Fetc\u002Frestic\u002Fpw\n# Or for Veeam:\n# Get-VBRBackup | Where-Object {$_.JobType -eq \"Backup\"} | Select Name, LastPointCreationTime\n```\n\n### Step 3: Execute Restore and Measure RTO\n\nFor each tiered system, measure the full recovery timeline:\n\n1. **Detection to Decision** - Time from simulated alert to restore decision\n2. **Backup Locate** - Time to identify and select the correct clean restore point\n3. **Restore Execution** - Time to restore data\u002FVM\u002Fapplication from backup\n4. **Validation** - Time to verify data integrity and application functionality\n5. **Service Restoration** - Time until the system is fully operational\n\n```\nRecovery Timeline Measurement:\n  T0: Incident declared (simulated ransomware detection)\n  T1: Recovery team assembled and backup identified\n  T2: Restore initiated from clean backup\n  T3: Restore completed, integrity checks passed\n  T4: Application validated and service restored\n\n  Actual RTO = T4 - T0\n  Actual RPO = T0 - backup_timestamp\n```\n\n### Step 4: Validate Data Integrity Post-Restore\n\n```bash\n# Compare file counts between backup manifest and restored data\nfind \u002Frestored\u002Fdata -type f | wc -l\n# Compare against pre-backup manifest\n\n# Verify database consistency after restore\npg_isready -h localhost -p 5432\npsql -c \"SELECT count(*) FROM critical_table;\" -d restored_db\n\n# Hash verification of critical files\nsha256sum \u002Frestored\u002Fdata\u002Fcritical_config.xml\n# Compare against known-good hash from backup manifest\n```\n\n### Step 5: Test Credential Rotation and Security Hardening\n\nAfter restore, validate that security controls are re-established:\n\n1. Rotate all service account passwords and API keys\n2. Verify MFA is enabled on all administrative accounts\n3. Confirm EDR\u002FAV agents are running and reporting to management console\n4. Validate firewall rules block known C2 indicators\n5. Check that restored systems have latest security patches\n\n### Step 6: Document Results and Calculate Gap\n\n```\nRecovery Test Report:\n  System: [Name]\n  Tier: [1-4]\n  RTO Target: [target]    Actual RTO: [measured]    Gap: [delta]\n  RPO Target: [target]    Actual RPO: [measured]    Gap: [delta]\n  Data Integrity: [PASS\u002FFAIL]\n  Application Validation: [PASS\u002FFAIL]\n  Security Controls Restored: [PASS\u002FFAIL]\n\n  Status: [MEETS TARGET \u002F EXCEEDS TARGET \u002F FAILS TARGET]\n  Remediation Required: [description if FAILS]\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **RTO** | Recovery Time Objective: maximum acceptable downtime for a system after a disaster |\n| **RPO** | Recovery Point Objective: maximum acceptable data loss measured in time |\n| **WRT** | Work Recovery Time: time to verify system integrity after restore completes |\n| **MTD** | Maximum Tolerable Downtime: absolute limit before unacceptable business impact |\n| **Clean Restore Point** | A backup verified to be free of ransomware artifacts or encryption |\n| **Recovery Sequencing** | The order in which interdependent systems must be restored |\n| **Air-Gapped Backup** | Backup stored on media physically disconnected from the network |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Veeam Backup & Replication | VM and physical server backup and restore |\n| Commvault | Enterprise data protection and recovery orchestration |\n| Rubrik | Cloud-native backup with ransomware recovery SLA |\n| AWS Backup | Centralized backup for AWS services |\n| Azure Backup | Microsoft cloud backup with immutable vault |\n| Restic | Open-source encrypted backup tool |\n| Velero | Kubernetes cluster backup and restore |\n\n## Common Pitfalls\n\n- **Not testing restores regularly**: Backups that are never tested often fail when needed. Test quarterly at minimum.\n- **Ignoring recovery sequencing**: Restoring an application before its database dependency causes cascading failures.\n- **Skipping credential rotation**: Restored systems may contain compromised credentials that allow re-infection.\n- **Using production network for testing**: Recovery tests on production networks risk spreading simulated or real infections.\n- **Measuring RTO without WRT**: Restore completion is not recovery completion. Include validation and hardening time.\n- **No immutable backups**: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.\n\n## References\n\n- NIST SP 800-184: Guide for Cybersecurity Event Recovery\n- CISA Ransomware Guide: https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\n- Veeam RTO\u002FRPO Best Practices: https:\u002F\u002Fwww.veeam.com\u002Fblog\u002Frecovery-time-recovery-point-objectives.html\n- NIST CSF 2.0 RC.RP (Recovery Planning)\n","# Testing Ransomware Recovery Procedures\n\n## When to Use\n\nUse this skill when:\n- Validating that ransomware recovery plans actually work under realistic conditions\n- Measuring RTO (Recovery Time Objective) and RPO (Recovery Point Objective) against business requirements\n- Testing backup restore operations to confirm data integrity and completeness after simulated encryption\n- Conducting tabletop exercises or live recovery drills for ransomware scenarios\n- Auditing disaster recovery readiness as part of compliance or cyber insurance requirements\n\n**Do not use** for active incident response during a live ransomware attack. Use dedicated IR playbooks instead.\n\n## Prerequisites\n\n- Isolated recovery test environment (air-gapped or network-segmented lab)\n- Access to backup infrastructure (Veeam, Commvault, Rubrik, AWS Backup, Azure Backup)\n- Documented RTO\u002FRPO targets per application tier from business impact analysis\n- Backup copies available for restore testing (production replicas or test snapshots)\n- Recovery runbooks with step-by-step procedures for each critical system\n\n## Workflow\n\n### Step 1: Define Recovery Test Scope\n\nIdentify critical systems and their tiered recovery targets:\n\n| Tier | System Type | RTO Target | RPO Target | Example |\n|------|------------|------------|------------|---------|\n| Tier 1 | Mission-critical | \u003C 1 hour | \u003C 15 min | Active Directory, core database |\n| Tier 2 | Business-critical | \u003C 4 hours | \u003C 1 hour | ERP, email, CRM |\n| Tier 3 | Business-operational | \u003C 24 hours | \u003C 4 hours | File shares, internal apps |\n| Tier 4 | Non-critical | \u003C 72 hours | \u003C 24 hours | Dev\u002Ftest, analytics |\n\n### Step 2: Prepare Test Environment\n\n```bash\n# Verify isolated recovery network is segmented\n# No routes to production should exist\nip route show | grep -v \"192.168.100.0\u002F24\"  # recovery VLAN only\n\n# Verify backup catalog is accessible\nrestic snapshots --repo s3:s3.amazonaws.com\u002Fbackup-bucket --password-file \u002Fetc\u002Frestic\u002Fpw\n# Or for Veeam:\n# Get-VBRBackup | Where-Object {$_.JobType -eq \"Backup\"} | Select Name, LastPointCreationTime\n```\n\n### Step 3: Execute Restore and Measure RTO\n\nFor each tiered system, measure the full recovery timeline:\n\n1. **Detection to Decision** - Time from simulated alert to restore decision\n2. **Backup Locate** - Time to identify and select the correct clean restore point\n3. **Restore Execution** - Time to restore data\u002FVM\u002Fapplication from backup\n4. **Validation** - Time to verify data integrity and application functionality\n5. **Service Restoration** - Time until the system is fully operational\n\n```\nRecovery Timeline Measurement:\n  T0: Incident declared (simulated ransomware detection)\n  T1: Recovery team assembled and backup identified\n  T2: Restore initiated from clean backup\n  T3: Restore completed, integrity checks passed\n  T4: Application validated and service restored\n\n  Actual RTO = T4 - T0\n  Actual RPO = T0 - backup_timestamp\n```\n\n### Step 4: Validate Data Integrity Post-Restore\n\n```bash\n# Compare file counts between backup manifest and restored data\nfind \u002Frestored\u002Fdata -type f | wc -l\n# Compare against pre-backup manifest\n\n# Verify database consistency after restore\npg_isready -h localhost -p 5432\npsql -c \"SELECT count(*) FROM critical_table;\" -d restored_db\n\n# Hash verification of critical files\nsha256sum \u002Frestored\u002Fdata\u002Fcritical_config.xml\n# Compare against known-good hash from backup manifest\n```\n\n### Step 5: Test Credential Rotation and Security Hardening\n\nAfter restore, validate that security controls are re-established:\n\n1. Rotate all service account passwords and API keys\n2. Verify MFA is enabled on all administrative accounts\n3. Confirm EDR\u002FAV agents are running and reporting to management console\n4. Validate firewall rules block known C2 indicators\n5. Check that restored systems have latest security patches\n\n### Step 6: Document Results and Calculate Gap\n\n```\nRecovery Test Report:\n  System: [Name]\n  Tier: [1-4]\n  RTO Target: [target]    Actual RTO: [measured]    Gap: [delta]\n  RPO Target: [target]    Actual RPO: [measured]    Gap: [delta]\n  Data Integrity: [PASS\u002FFAIL]\n  Application Validation: [PASS\u002FFAIL]\n  Security Controls Restored: [PASS\u002FFAIL]\n\n  Status: [MEETS TARGET \u002F EXCEEDS TARGET \u002F FAILS TARGET]\n  Remediation Required: [description if FAILS]\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **RTO** | Recovery Time Objective: maximum acceptable downtime for a system after a disaster |\n| **RPO** | Recovery Point Objective: maximum acceptable data loss measured in time |\n| **WRT** | Work Recovery Time: time to verify system integrity after restore completes |\n| **MTD** | Maximum Tolerable Downtime: absolute limit before unacceptable business impact |\n| **Clean Restore Point** | A backup verified to be free of ransomware artifacts or encryption |\n| **Recovery Sequencing** | The order in which interdependent systems must be restored |\n| **Air-Gapped Backup** | Backup stored on media physically disconnected from the network |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Veeam Backup & Replication | VM and physical server backup and restore |\n| Commvault | Enterprise data protection and recovery orchestration |\n| Rubrik | Cloud-native backup with ransomware recovery SLA |\n| AWS Backup | Centralized backup for AWS services |\n| Azure Backup | Microsoft cloud backup with immutable vault |\n| Restic | Open-source encrypted backup tool |\n| Velero | Kubernetes cluster backup and restore |\n\n## Common Pitfalls\n\n- **Not testing restores regularly**: Backups that are never tested often fail when needed. Test quarterly at minimum.\n- **Ignoring recovery sequencing**: Restoring an application before its database dependency causes cascading failures.\n- **Skipping credential rotation**: Restored systems may contain compromised credentials that allow re-infection.\n- **Using production network for testing**: Recovery tests on production networks risk spreading simulated or real infections.\n- **Measuring RTO without WRT**: Restore completion is not recovery completion. Include validation and hardening time.\n- **No immutable backups**: If ransomware can encrypt or delete backups, recovery is impossible. Use air-gapped or immutable storage.\n\n## References\n\n- NIST SP 800-184: Guide for Cybersecurity Event Recovery\n- CISA Ransomware Guide: https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\n- Veeam RTO\u002FRPO Best Practices: https:\u002F\u002Fwww.veeam.com\u002Fblog\u002Frecovery-time-recovery-point-objectives.html\n- NIST CSF 2.0 RC.RP (Recovery Planning)\n",{"name":5,"tags":52,"author":53,"domain":46,"license":15,"version":54,"mitre_f3":55,"nist_csf":75,"subdomain":41,"description":7,"mitre_attack":80},[41,29,34,35,33,32,45],"mahipal","1.0",{"tactics":56,"version":59,"techniques":60},[57,58],"positioning","monetization","1.1",[61,65,69,72],{"id":62,"name":63,"source":64,"tactic":57},"T1531","Account Access Removal","attack",{"id":66,"name":67,"source":68,"tactic":58},"F1018","Convert to Cryptocurrency","f3",{"id":70,"name":71,"source":68,"tactic":58},"F1047","Transfer of funds",{"id":73,"name":74,"source":68,"tactic":58},"F1017.001","Conversion to Physical Monetary Instruments: Cash",[76,77,78,79],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01",[81,82,83,84,85],"T1486","T1490","T1070","T1078","T1489","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-ransomware-recovery-procedures",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":97,"prompt":107,"zipAvailable":108},[98,101,104],{"tool":99,"command":100},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-ransomware-recovery-procedures",{"tool":102,"command":103},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-ransomware-recovery-procedures",{"tool":105,"command":106},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-ransomware-recovery-procedures","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-ransomware-recovery-procedures\u002FSKILL.md",true,[110,116,122,126,131,135,139],{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"agents\u002Fopenai.yaml","REFERENCE","参考文档",273,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fworkflow-automation\u002Fyeet\u002Fagents\u002Fopenai.yaml",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"assets\u002Fyeet-small.svg","ASSET","资产文件",967,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fworkflow-automation\u002Fyeet\u002Fassets\u002Fyeet-small.svg",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"assets\u002Fyeet.png",1262,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fworkflow-automation\u002Fyeet\u002Fassets\u002Fyeet.png",{"path":127,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":129,"sourceHtmlUrl":130},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-ransomware-recovery-procedures\u002FLICENSE",{"path":132,"resourceType":127,"resourceTypeDesc":128,"sizeBytes":133,"sourceHtmlUrl":134},"LICENSE.txt",10776,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fworkflow-automation\u002Fyeet\u002FLICENSE.txt",{"path":136,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fapi-reference.md",3900,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-ransomware-recovery-procedures\u002Freferences\u002Fapi-reference.md",{"path":140,"resourceType":141,"resourceTypeDesc":142,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Fagent.py","SCRIPT","脚本",11562,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-ransomware-recovery-procedures\u002Fscripts\u002Fagent.py",[146,173,195,211,237,264],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[152],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[154,155,156,157,158,46,159,160,161,162,163,164,165,166,167,168,169,170,171,172],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[179],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[181,169,182,183,158,184,46,161,43,185,186,187,188,189,37,190,191,192,193,194],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":203,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[201,202],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[37,35,28,204,30,46,205,44,43,206,207,41,29,39,208,31,38,209,34,210],"validating backup integrity for recovery","infrastructure","compliance","hash-verification","detection","immutable","restore-testing",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[217],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,46,222,223,224,225,226,227,228,229,230,231,232,233,187,234,235,236],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[243],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[245,246,247,46,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":265,"name":266,"nameZh":6,"description":267,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":268,"categories":269,"keywords":271,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[270],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[158,272,46,273,274,275,276,277,278,279,280,31,281,38,282,283,284,285,286,287],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]