[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGCPF3H0TDCABRFP5WRHB6":3,"skill-same:01M6AGCPF3H0TDCABRFP5WRHB6":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":94,"commitSha":95,"skillDirectory":96,"forksCount":97,"repositoryHtmlUrl":98,"repositoryHomepageUrl":99,"ownerHtmlUrl":100,"ownerBlogUrl":101,"ownerDescription":102,"updatedAt":103,"install":104,"resources":117},"01M6AGCPF3H0TDCABRFP5WRHB6","tracking-threat-actor-infrastructure",null,"Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transparency logs, Shodan\u002FCensys scans, WHOIS records, and network fingerprints (JARM\u002FJA3S). Use when tracking threat actor infrastructure, expanding a known IOC into related assets, or producing STIX-based threat intelligence during a CTI investigation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"tracking threat actor infrastructure","infrastructure","mitre-attack","certificate","t1566","seo","jarm","network","dns","cti","threat-intelligence","cybersecurity","server","logs","website","search","capabilities","create","development","threat intelligence","2026-11-10 10:12:30",false,"---\nname: tracking-threat-actor-infrastructure\ndescription: Discovers and maps adversary-controlled infrastructure (C2 servers,\n  phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive\n  DNS, certificate transparency logs, Shodan\u002FCensys scans, WHOIS records, and network\n  fingerprints (JARM\u002FJA3S). Use when tracking threat actor infrastructure, expanding\n  a known IOC into related assets, or producing STIX-based threat intelligence during\n  a CTI investigation.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- threat-intelligence\n- cti\n- ioc\n- mitre-attack\n- stix\n- infrastructure-tracking\n- shodan\n- censys\n- passive-dns\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1566\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - resource-development\n  techniques:\n  - id: T1593\n    name: Search Open Websites\u002FDomains\n    tactic: reconnaissance\n    source: attack\n  - id: T1583.001\n    name: 'Acquire Infrastructure: Domains'\n    tactic: resource-development\n    source: attack\n  - id: T1583.008\n    name: 'Acquire Infrastructure: Malvertising'\n    tactic: resource-development\n    source: attack\n  - id: T1583.003\n    name: 'Acquire Infrastructure: Virtual Private Network or Server'\n    tactic: resource-development\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1608.006\n    name: 'Stage Capabilities: SEO Poisoning'\n    tactic: resource-development\n    source: attack\n---\n# Tracking Threat Actor Infrastructure\n\n## Overview\n\nThreat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, and staging servers. This skill covers using passive DNS, certificate transparency logs, Shodan\u002FCensys scanning, WHOIS analysis, and network fingerprinting to discover, track, and pivot across threat actor infrastructure over time.\n\n\n## When to Use\n\n- When managing security operations that require tracking threat actor infrastructure\n- When improving security program maturity and operational processes\n- When establishing standardized procedures for security team workflows\n- When integrating threat intelligence or vulnerability data into operations\n\n## Prerequisites\n\n- Python 3.9+ with `shodan`, `censys`, `requests`, `stix2` libraries\n- API keys: Shodan, Censys, VirusTotal, SecurityTrails, PassiveTotal\n- Understanding of DNS, TLS\u002FSSL certificates, IP allocation, ASN structure\n- Familiarity with passive DNS and certificate transparency concepts\n- Access to domain registration (WHOIS) lookup services\n\n## Key Concepts\n\n### Infrastructure Pivoting\nPivoting is the technique of using one known indicator to discover related infrastructure. Starting from a known C2 IP address, analysts can pivot via: passive DNS (find domains), reverse WHOIS (find related registrations), SSL certificates (find shared certs), SSH key fingerprints, HTTP response fingerprints, JARM\u002FJA3S hashes, and WHOIS registrant data.\n\n### Passive DNS\nPassive DNS databases record DNS query\u002Fresponse data observed at recursive resolvers. This allows analysts to find historical domain-to-IP mappings, discover domains hosted on a known C2 IP, and identify fast-flux or domain generation algorithm (DGA) behavior.\n\n### Certificate Transparency\nCertificate Transparency (CT) logs publicly record all SSL\u002FTLS certificates issued by CAs. Monitoring CT logs reveals new certificates registered for suspicious domains, helping identify phishing sites and C2 infrastructure before they become active.\n\n### Network Fingerprinting\n- **JARM**: Active TLS server fingerprint (hash of TLS handshake responses)\n- **JA3S**: Passive TLS server fingerprint (hash of Server Hello)\n- **HTTP Headers**: Server banners, custom headers, response patterns\n- **Favicon Hash**: Hash of HTTP favicon for server identification\n\n## Workflow\n\n### Step 1: Shodan Infrastructure Discovery\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\ndef discover_infrastructure(ip_address):\n    \"\"\"Discover services and metadata for a target IP.\"\"\"\n    try:\n        host = api.host(ip_address)\n        return {\n            \"ip\": host[\"ip_str\"],\n            \"org\": host.get(\"org\", \"\"),\n            \"asn\": host.get(\"asn\", \"\"),\n            \"isp\": host.get(\"isp\", \"\"),\n            \"country\": host.get(\"country_name\", \"\"),\n            \"city\": host.get(\"city\", \"\"),\n            \"os\": host.get(\"os\"),\n            \"ports\": host.get(\"ports\", []),\n            \"vulns\": host.get(\"vulns\", []),\n            \"hostnames\": host.get(\"hostnames\", []),\n            \"domains\": host.get(\"domains\", []),\n            \"tags\": host.get(\"tags\", []),\n            \"services\": [\n                {\n                    \"port\": svc.get(\"port\"),\n                    \"transport\": svc.get(\"transport\"),\n                    \"product\": svc.get(\"product\", \"\"),\n                    \"version\": svc.get(\"version\", \"\"),\n                    \"ssl_cert\": svc.get(\"ssl\", {}).get(\"cert\", {}).get(\"subject\", {}),\n                    \"jarm\": svc.get(\"ssl\", {}).get(\"jarm\", \"\"),\n                }\n                for svc in host.get(\"data\", [])\n            ],\n        }\n    except shodan.APIError as e:\n        print(f\"[-] Shodan error: {e}\")\n        return None\n\ndef search_c2_framework(framework_name):\n    \"\"\"Search Shodan for known C2 framework signatures.\"\"\"\n    c2_queries = {\n        \"cobalt-strike\": 'product:\"Cobalt Strike Beacon\"',\n        \"metasploit\": 'product:\"Metasploit\"',\n        \"covenant\": 'http.html:\"Covenant\" http.title:\"Covenant\"',\n        \"sliver\": 'ssl.cert.subject.cn:\"multiplayer\" ssl.cert.issuer.cn:\"operators\"',\n        \"havoc\": 'http.html_hash:-1472705893',\n    }\n\n    query = c2_queries.get(framework_name.lower(), framework_name)\n    results = api.search(query, limit=100)\n\n    hosts = []\n    for match in results.get(\"matches\", []):\n        hosts.append({\n            \"ip\": match[\"ip_str\"],\n            \"port\": match[\"port\"],\n            \"org\": match.get(\"org\", \"\"),\n            \"country\": match.get(\"location\", {}).get(\"country_name\", \"\"),\n            \"asn\": match.get(\"asn\", \"\"),\n            \"timestamp\": match.get(\"timestamp\", \"\"),\n        })\n\n    return hosts\n```\n\n### Step 2: Passive DNS Pivoting\n\n```python\nimport requests\n\ndef passive_dns_lookup(indicator, api_key, indicator_type=\"ip\"):\n    \"\"\"Query SecurityTrails for passive DNS records.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\"\n    headers = {\"APIKEY\": api_key, \"Accept\": \"application\u002Fjson\"}\n\n    if indicator_type == \"ip\":\n        url = f\"{base_url}\u002Fsearch\u002Flist\"\n        payload = {\n            \"filter\": {\"ipv4\": indicator}\n        }\n        resp = requests.post(url, json=payload, headers=headers, timeout=30)\n    else:\n        url = f\"{base_url}\u002Fdomain\u002F{indicator}\u002Fsubdomains\"\n        resp = requests.get(url, headers=headers, timeout=30)\n\n    if resp.status_code == 200:\n        return resp.json()\n    return None\n\n\ndef query_passive_total(indicator, user, api_key):\n    \"\"\"Query PassiveTotal for passive DNS and WHOIS data.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.passivetotal.org\u002Fv2\"\n    auth = (user, api_key)\n\n    # Passive DNS\n    pdns_resp = requests.get(\n        f\"{base_url}\u002Fdns\u002Fpassive\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    # WHOIS\n    whois_resp = requests.get(\n        f\"{base_url}\u002Fwhois\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    results = {}\n    if pdns_resp.status_code == 200:\n        results[\"passive_dns\"] = pdns_resp.json().get(\"results\", [])\n    if whois_resp.status_code == 200:\n        results[\"whois\"] = whois_resp.json()\n\n    return results\n```\n\n### Step 3: Certificate Transparency Monitoring\n\n```python\nimport requests\n\ndef search_ct_logs(domain):\n    \"\"\"Search Certificate Transparency logs via crt.sh.\"\"\"\n    resp = requests.get(\n        f\"https:\u002F\u002Fcrt.sh\u002F?q=%.{domain}&output=json\",\n        timeout=30,\n    )\n\n    if resp.status_code == 200:\n        certs = resp.json()\n        unique_domains = set()\n        cert_info = []\n\n        for cert in certs:\n            name_value = cert.get(\"name_value\", \"\")\n            for name in name_value.split(\"\\n\"):\n                unique_domains.add(name.strip())\n\n            cert_info.append({\n                \"id\": cert.get(\"id\"),\n                \"issuer\": cert.get(\"issuer_name\", \"\"),\n                \"common_name\": cert.get(\"common_name\", \"\"),\n                \"name_value\": name_value,\n                \"not_before\": cert.get(\"not_before\", \"\"),\n                \"not_after\": cert.get(\"not_after\", \"\"),\n                \"serial_number\": cert.get(\"serial_number\", \"\"),\n            })\n\n        return {\n            \"domain\": domain,\n            \"total_certificates\": len(certs),\n            \"unique_domains\": sorted(unique_domains),\n            \"certificates\": cert_info[:50],\n        }\n    return None\n\n\ndef monitor_new_certs(domains, interval_hours=1):\n    \"\"\"Monitor for newly issued certificates for a list of domains.\"\"\"\n    from datetime import datetime, timedelta\n\n    cutoff = (datetime.utcnow() - timedelta(hours=interval_hours)).isoformat()\n    new_certs = []\n\n    for domain in domains:\n        result = search_ct_logs(domain)\n        if result:\n            for cert in result.get(\"certificates\", []):\n                if cert.get(\"not_before\", \"\") > cutoff:\n                    new_certs.append({\n                        \"domain\": domain,\n                        \"cert\": cert,\n                    })\n\n    return new_certs\n```\n\n### Step 4: Infrastructure Correlation and Timeline\n\n```python\nfrom datetime import datetime\n\ndef build_infrastructure_timeline(indicators):\n    \"\"\"Build a timeline of infrastructure changes.\"\"\"\n    timeline = []\n\n    for ind in indicators:\n        if \"passive_dns\" in ind:\n            for record in ind[\"passive_dns\"]:\n                timeline.append({\n                    \"timestamp\": record.get(\"firstSeen\", \"\"),\n                    \"event\": \"dns_resolution\",\n                    \"source\": record.get(\"resolve\", \"\"),\n                    \"target\": record.get(\"value\", \"\"),\n                    \"record_type\": record.get(\"recordType\", \"\"),\n                })\n\n        if \"certificates\" in ind:\n            for cert in ind[\"certificates\"]:\n                timeline.append({\n                    \"timestamp\": cert.get(\"not_before\", \"\"),\n                    \"event\": \"certificate_issued\",\n                    \"domain\": cert.get(\"common_name\", \"\"),\n                    \"issuer\": cert.get(\"issuer\", \"\"),\n                })\n\n    timeline.sort(key=lambda x: x.get(\"timestamp\", \"\"))\n    return timeline\n```\n\n## Validation Criteria\n\n- Shodan\u002FCensys queries return infrastructure details for target IPs\n- Passive DNS reveals historical domain-IP mappings\n- Certificate transparency search finds associated domains\n- Infrastructure pivoting discovers new related indicators\n- Timeline shows infrastructure evolution over time\n- Results are exportable as STIX 2.1 Infrastructure objects\n\n## References\n\n- [Shodan API Documentation](https:\u002F\u002Fdeveloper.shodan.io\u002Fapi)\n- [Censys Search API](https:\u002F\u002Fsearch.censys.io\u002Fapi)\n- [SecurityTrails API](https:\u002F\u002Fsecuritytrails.com\u002Fcorp\u002Fapi)\n- [crt.sh Certificate Transparency](https:\u002F\u002Fcrt.sh\u002F)\n- [PassiveTotal API](https:\u002F\u002Fapi.passivetotal.org\u002Fapi\u002Fdocs\u002F)\n- [JARM Fingerprinting](https:\u002F\u002Fgithub.com\u002Fsalesforce\u002Fjarm)\n","# Tracking Threat Actor Infrastructure\n\n## Overview\n\nThreat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, and staging servers. This skill covers using passive DNS, certificate transparency logs, Shodan\u002FCensys scanning, WHOIS analysis, and network fingerprinting to discover, track, and pivot across threat actor infrastructure over time.\n\n\n## When to Use\n\n- When managing security operations that require tracking threat actor infrastructure\n- When improving security program maturity and operational processes\n- When establishing standardized procedures for security team workflows\n- When integrating threat intelligence or vulnerability data into operations\n\n## Prerequisites\n\n- Python 3.9+ with `shodan`, `censys`, `requests`, `stix2` libraries\n- API keys: Shodan, Censys, VirusTotal, SecurityTrails, PassiveTotal\n- Understanding of DNS, TLS\u002FSSL certificates, IP allocation, ASN structure\n- Familiarity with passive DNS and certificate transparency concepts\n- Access to domain registration (WHOIS) lookup services\n\n## Key Concepts\n\n### Infrastructure Pivoting\nPivoting is the technique of using one known indicator to discover related infrastructure. Starting from a known C2 IP address, analysts can pivot via: passive DNS (find domains), reverse WHOIS (find related registrations), SSL certificates (find shared certs), SSH key fingerprints, HTTP response fingerprints, JARM\u002FJA3S hashes, and WHOIS registrant data.\n\n### Passive DNS\nPassive DNS databases record DNS query\u002Fresponse data observed at recursive resolvers. This allows analysts to find historical domain-to-IP mappings, discover domains hosted on a known C2 IP, and identify fast-flux or domain generation algorithm (DGA) behavior.\n\n### Certificate Transparency\nCertificate Transparency (CT) logs publicly record all SSL\u002FTLS certificates issued by CAs. Monitoring CT logs reveals new certificates registered for suspicious domains, helping identify phishing sites and C2 infrastructure before they become active.\n\n### Network Fingerprinting\n- **JARM**: Active TLS server fingerprint (hash of TLS handshake responses)\n- **JA3S**: Passive TLS server fingerprint (hash of Server Hello)\n- **HTTP Headers**: Server banners, custom headers, response patterns\n- **Favicon Hash**: Hash of HTTP favicon for server identification\n\n## Workflow\n\n### Step 1: Shodan Infrastructure Discovery\n\n```python\nimport shodan\n\napi = shodan.Shodan(\"YOUR_SHODAN_API_KEY\")\n\ndef discover_infrastructure(ip_address):\n    \"\"\"Discover services and metadata for a target IP.\"\"\"\n    try:\n        host = api.host(ip_address)\n        return {\n            \"ip\": host[\"ip_str\"],\n            \"org\": host.get(\"org\", \"\"),\n            \"asn\": host.get(\"asn\", \"\"),\n            \"isp\": host.get(\"isp\", \"\"),\n            \"country\": host.get(\"country_name\", \"\"),\n            \"city\": host.get(\"city\", \"\"),\n            \"os\": host.get(\"os\"),\n            \"ports\": host.get(\"ports\", []),\n            \"vulns\": host.get(\"vulns\", []),\n            \"hostnames\": host.get(\"hostnames\", []),\n            \"domains\": host.get(\"domains\", []),\n            \"tags\": host.get(\"tags\", []),\n            \"services\": [\n                {\n                    \"port\": svc.get(\"port\"),\n                    \"transport\": svc.get(\"transport\"),\n                    \"product\": svc.get(\"product\", \"\"),\n                    \"version\": svc.get(\"version\", \"\"),\n                    \"ssl_cert\": svc.get(\"ssl\", {}).get(\"cert\", {}).get(\"subject\", {}),\n                    \"jarm\": svc.get(\"ssl\", {}).get(\"jarm\", \"\"),\n                }\n                for svc in host.get(\"data\", [])\n            ],\n        }\n    except shodan.APIError as e:\n        print(f\"[-] Shodan error: {e}\")\n        return None\n\ndef search_c2_framework(framework_name):\n    \"\"\"Search Shodan for known C2 framework signatures.\"\"\"\n    c2_queries = {\n        \"cobalt-strike\": 'product:\"Cobalt Strike Beacon\"',\n        \"metasploit\": 'product:\"Metasploit\"',\n        \"covenant\": 'http.html:\"Covenant\" http.title:\"Covenant\"',\n        \"sliver\": 'ssl.cert.subject.cn:\"multiplayer\" ssl.cert.issuer.cn:\"operators\"',\n        \"havoc\": 'http.html_hash:-1472705893',\n    }\n\n    query = c2_queries.get(framework_name.lower(), framework_name)\n    results = api.search(query, limit=100)\n\n    hosts = []\n    for match in results.get(\"matches\", []):\n        hosts.append({\n            \"ip\": match[\"ip_str\"],\n            \"port\": match[\"port\"],\n            \"org\": match.get(\"org\", \"\"),\n            \"country\": match.get(\"location\", {}).get(\"country_name\", \"\"),\n            \"asn\": match.get(\"asn\", \"\"),\n            \"timestamp\": match.get(\"timestamp\", \"\"),\n        })\n\n    return hosts\n```\n\n### Step 2: Passive DNS Pivoting\n\n```python\nimport requests\n\ndef passive_dns_lookup(indicator, api_key, indicator_type=\"ip\"):\n    \"\"\"Query SecurityTrails for passive DNS records.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.securitytrails.com\u002Fv1\"\n    headers = {\"APIKEY\": api_key, \"Accept\": \"application\u002Fjson\"}\n\n    if indicator_type == \"ip\":\n        url = f\"{base_url}\u002Fsearch\u002Flist\"\n        payload = {\n            \"filter\": {\"ipv4\": indicator}\n        }\n        resp = requests.post(url, json=payload, headers=headers, timeout=30)\n    else:\n        url = f\"{base_url}\u002Fdomain\u002F{indicator}\u002Fsubdomains\"\n        resp = requests.get(url, headers=headers, timeout=30)\n\n    if resp.status_code == 200:\n        return resp.json()\n    return None\n\n\ndef query_passive_total(indicator, user, api_key):\n    \"\"\"Query PassiveTotal for passive DNS and WHOIS data.\"\"\"\n    base_url = \"https:\u002F\u002Fapi.passivetotal.org\u002Fv2\"\n    auth = (user, api_key)\n\n    # Passive DNS\n    pdns_resp = requests.get(\n        f\"{base_url}\u002Fdns\u002Fpassive\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    # WHOIS\n    whois_resp = requests.get(\n        f\"{base_url}\u002Fwhois\",\n        params={\"query\": indicator},\n        auth=auth,\n        timeout=30,\n    )\n\n    results = {}\n    if pdns_resp.status_code == 200:\n        results[\"passive_dns\"] = pdns_resp.json().get(\"results\", [])\n    if whois_resp.status_code == 200:\n        results[\"whois\"] = whois_resp.json()\n\n    return results\n```\n\n### Step 3: Certificate Transparency Monitoring\n\n```python\nimport requests\n\ndef search_ct_logs(domain):\n    \"\"\"Search Certificate Transparency logs via crt.sh.\"\"\"\n    resp = requests.get(\n        f\"https:\u002F\u002Fcrt.sh\u002F?q=%.{domain}&output=json\",\n        timeout=30,\n    )\n\n    if resp.status_code == 200:\n        certs = resp.json()\n        unique_domains = set()\n        cert_info = []\n\n        for cert in certs:\n            name_value = cert.get(\"name_value\", \"\")\n            for name in name_value.split(\"\\n\"):\n                unique_domains.add(name.strip())\n\n            cert_info.append({\n                \"id\": cert.get(\"id\"),\n                \"issuer\": cert.get(\"issuer_name\", \"\"),\n                \"common_name\": cert.get(\"common_name\", \"\"),\n                \"name_value\": name_value,\n                \"not_before\": cert.get(\"not_before\", \"\"),\n                \"not_after\": cert.get(\"not_after\", \"\"),\n                \"serial_number\": cert.get(\"serial_number\", \"\"),\n            })\n\n        return {\n            \"domain\": domain,\n            \"total_certificates\": len(certs),\n            \"unique_domains\": sorted(unique_domains),\n            \"certificates\": cert_info[:50],\n        }\n    return None\n\n\ndef monitor_new_certs(domains, interval_hours=1):\n    \"\"\"Monitor for newly issued certificates for a list of domains.\"\"\"\n    from datetime import datetime, timedelta\n\n    cutoff = (datetime.utcnow() - timedelta(hours=interval_hours)).isoformat()\n    new_certs = []\n\n    for domain in domains:\n        result = search_ct_logs(domain)\n        if result:\n            for cert in result.get(\"certificates\", []):\n                if cert.get(\"not_before\", \"\") > cutoff:\n                    new_certs.append({\n                        \"domain\": domain,\n                        \"cert\": cert,\n                    })\n\n    return new_certs\n```\n\n### Step 4: Infrastructure Correlation and Timeline\n\n```python\nfrom datetime import datetime\n\ndef build_infrastructure_timeline(indicators):\n    \"\"\"Build a timeline of infrastructure changes.\"\"\"\n    timeline = []\n\n    for ind in indicators:\n        if \"passive_dns\" in ind:\n            for record in ind[\"passive_dns\"]:\n                timeline.append({\n                    \"timestamp\": record.get(\"firstSeen\", \"\"),\n                    \"event\": \"dns_resolution\",\n                    \"source\": record.get(\"resolve\", \"\"),\n                    \"target\": record.get(\"value\", \"\"),\n                    \"record_type\": record.get(\"recordType\", \"\"),\n                })\n\n        if \"certificates\" in ind:\n            for cert in ind[\"certificates\"]:\n                timeline.append({\n                    \"timestamp\": cert.get(\"not_before\", \"\"),\n                    \"event\": \"certificate_issued\",\n                    \"domain\": cert.get(\"common_name\", \"\"),\n                    \"issuer\": cert.get(\"issuer\", \"\"),\n                })\n\n    timeline.sort(key=lambda x: x.get(\"timestamp\", \"\"))\n    return timeline\n```\n\n## Validation Criteria\n\n- Shodan\u002FCensys queries return infrastructure details for target IPs\n- Passive DNS reveals historical domain-IP mappings\n- Certificate transparency search finds associated domains\n- Infrastructure pivoting discovers new related indicators\n- Timeline shows infrastructure evolution over time\n- Results are exportable as STIX 2.1 Infrastructure objects\n\n## References\n\n- [Shodan API Documentation](https:\u002F\u002Fdeveloper.shodan.io\u002Fapi)\n- [Censys Search API](https:\u002F\u002Fsearch.censys.io\u002Fapi)\n- [SecurityTrails API](https:\u002F\u002Fsecuritytrails.com\u002Fcorp\u002Fapi)\n- [crt.sh Certificate Transparency](https:\u002F\u002Fcrt.sh\u002F)\n- [PassiveTotal API](https:\u002F\u002Fapi.passivetotal.org\u002Fapi\u002Fdocs\u002F)\n- [JARM Fingerprinting](https:\u002F\u002Fgithub.com\u002Fsalesforce\u002Fjarm)\n",{"name":5,"tags":49,"author":56,"domain":35,"license":15,"version":57,"mitre_f3":58,"nist_csf":84,"subdomain":34,"description":7,"mitre_attack":89},[34,33,50,26,51,52,53,54,55],"ioc","stix","infrastructure-tracking","shodan","censys","passive-dns","mahipal","1.0",{"tactics":59,"version":62,"techniques":63},[60,61],"reconnaissance","resource-development","1.1",[64,68,71,74,77,81],{"id":65,"name":66,"source":67,"tactic":60},"T1593","Search Open Websites\u002FDomains","attack",{"id":69,"name":70,"source":67,"tactic":61},"T1583.001","Acquire Infrastructure: Domains",{"id":72,"name":73,"source":67,"tactic":61},"T1583.008","Acquire Infrastructure: Malvertising",{"id":75,"name":76,"source":67,"tactic":61},"T1583.003","Acquire Infrastructure: Virtual Private Network or Server",{"id":78,"name":79,"source":80,"tactic":61},"F1020.002","Create Fake Materials: Fake Website","f3",{"id":82,"name":83,"source":67,"tactic":61},"T1608.006","Stage Capabilities: SEO Poisoning",[85,86,87,88],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[90,91,65,92,93],"T1591","T1592","T1589","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftracking-threat-actor-infrastructure",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":105,"prompt":115,"zipAvailable":116},[106,109,112],{"tool":107,"command":108},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill tracking-threat-actor-infrastructure",{"tool":110,"command":111},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill tracking-threat-actor-infrastructure",{"tool":113,"command":114},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill tracking-threat-actor-infrastructure","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",true,[118,124,129,135,139,143,149],{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"assets\u002Ftemplate.md","ASSET","资产文件",1357,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002Fassets\u002Ftemplate.md",{"path":125,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002FLICENSE",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fapi-reference.md","REFERENCE","参考文档",1892,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002Freferences\u002Fapi-reference.md",{"path":136,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fstandards.md",1661,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002Freferences\u002Fstandards.md",{"path":140,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fworkflows.md",2422,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002Freferences\u002Fworkflows.md",{"path":144,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Fagent.py","SCRIPT","脚本",7800,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002Fscripts\u002Fagent.py",{"path":150,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Fprocess.py",11104,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftracking-threat-actor-infrastructure\u002Fscripts\u002Fprocess.py",[154,181,205,232,257,284],{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,163,164,165,166,35,167,168,169,170,171,172,173,174,175,176,177,178,179,180],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,177,190,191,166,192,35,169,193,194,195,196,197,198,199,200,201,202,203,204],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":215,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[211,214],{"categoryNo":212,"categoryName":213,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[199,216,217,218,219,35,25,220,193,221,222,223,224,225,226,227,228,229,230,231],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,35,243,244,37,245,246,247,248,249,250,251,252,253,196,254,255,256],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":258,"name":259,"nameZh":6,"description":260,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":261,"categories":262,"keywords":264,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[263],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[265,266,267,35,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":285,"name":286,"nameZh":6,"description":287,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":288,"categories":289,"keywords":291,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[290],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,292,35,293,294,50,295,296,297,298,299,227,300,228,301,302,303,304,305,306],"triaging security incident","siem","file","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]