[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGDGBPWYVZ2F11GFKJ4HZ9":3,"skill-same:01M6AGDGBPWYVZ2F11GFKJ4HZ9":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation",null,"Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"attestation","validating tpm measured boot attestation","TPM","boot","pr","verification","ZeRO","firmware","Tools","measured-boot","security","PCR","integrity","cybersecurity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing","policy","2026-11-10 10:12:30",false,"---\nname: validating-tpm-measured-boot-attestation\ndescription: Verifies TPM 2.0 measured-boot integrity and remote attestation with\n  tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating\n  and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to\n  a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero\n  Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value\n  baseline for fleet attestation.\ndomain: cybersecurity\nsubdomain: hardware-firmware-security\ntags:\n- hardware-firmware-security\n- tpm\n- measured-boot\n- remote-attestation\n- pcr\n- tpm2-tools\n- integrity-verification\n- trusted-computing\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\nmitre_attack:\n- T1542\n---\n# Validating TPM Measured Boot and Attestation\n\n> **Legal Notice:** Perform TPM operations only on systems you own or are authorized to assess. Some operations (clearing the TPM, taking ownership, defining NV indices) are destructive or can lock the device. This skill is for defensive integrity verification and authorized assessment.\n\n## Overview\n\nA Trusted Platform Module (TPM 2.0) is a hardware root of trust that supports **measured boot**: each stage of the boot chain hashes (\"measures\") the next stage and *extends* that measurement into a Platform Configuration Register (PCR) before handing off control. PCRs cannot be set arbitrarily — they can only be extended (`new = hash(old || measurement)`), so the final PCR value is a tamper-evident summary of everything that executed. The TCG firmware profile assigns specific meanings: UEFI firmware code\u002Fconfig measure into **PCR 0–7** (PCR 7 specifically captures Secure Boot policy), bootloaders measure the kernel into **PCR 8–9**, and Linux IMA measures executables into **PCR 10**.\n\nTwo complementary verifications matter. **Local validation** reads current PCRs (`tpm2_pcrread`) and replays the TPM event log (`tpm2_eventlog` on `\u002Fsys\u002Fkernel\u002Fsecurity\u002Ftpm0\u002Fbinary_bios_measurements`) to confirm the recorded measurements reproduce the live PCR values — proving the log is authentic and revealing exactly *what* changed if a value drifts from baseline. **Remote attestation** has the TPM produce a signed quote (`tpm2_quote`) over selected PCRs using an Attestation Key (AK), with a fresh nonce to prevent replay; a verifier then independently checks the signature and PCR digest (`tpm2_checkquote`) and compares against a golden\u002Fexpected value. This lets a server cryptographically establish that a remote machine booted approved firmware and kernel before granting access, sealing secrets, or admitting it to a Zero Trust network.\n\nThis skill provides the full `tpm2-tools` workflow for enrolling an AK, capturing and verifying quotes, replaying event logs, sealing\u002Funsealing data to a PCR policy, and building a golden-value baseline for fleet attestation.\n\n## When to Use\n\n- Establishing that endpoints\u002Fservers booted a known-good firmware and kernel before granting access (Zero Trust device posture).\n- Detecting boot-chain tampering (bootkits, unauthorized firmware\u002Fkernel changes) via PCR drift from a baseline.\n- Verifying measured-boot integrity after a Secure Boot or firmware incident.\n- Sealing secrets (disk keys, credentials) to a measured-boot state so they only release on a trusted boot.\n- Building or auditing a remote-attestation service (e.g., Keylime, custom verifier).\n\n## Prerequisites\n\n- A system with a TPM 2.0 device and the resource manager:\n  ```bash\n  sudo apt install tpm2-tools tpm2-abrmd        # Debian\u002FUbuntu\n  sudo dnf install tpm2-tools tpm2-abrmd        # Fedora\u002FRHEL\n  ```\n- Access to the TPM (`\u002Fdev\u002Ftpm0` \u002F `\u002Fdev\u002Ftpmrm0`) and the kernel measurement log at `\u002Fsys\u002Fkernel\u002Fsecurity\u002Ftpm0\u002Fbinary_bios_measurements`.\n- Root for reading some sysfs entries and for NV\u002FAK operations.\n- For remote attestation: a verifier host and a transport for the quote\u002Fnonce exchange.\n\n## Objectives\n\n- Read and interpret PCR banks and their TCG-assigned meanings.\n- Verify the TPM event log reproduces live PCR values (event-log replay).\n- Create an Attestation Key and produce a nonce-bound signed quote.\n- Independently verify the quote signature and PCR digest on a verifier.\n- Establish golden PCR baselines and detect drift across a fleet.\n- Optionally seal\u002Funseal a secret to a measured-boot PCR policy.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | Relevance |\n|--------------|----------------|-----------|\n| T1542 | Pre-OS Boot | Measured boot detects pre-OS tampering this technique relies on. |\n| T1542.001 | Pre-OS Boot: System Firmware | PCR 0–7 drift reveals unauthorized firmware modification. |\n| T1542.003 | Pre-OS Boot: Bootkit | Bootloader\u002Fkernel measurements (PCR 8–10) expose bootkit changes. |\n| T1014 | Rootkit | IMA measurements (PCR 10) and quote verification surface concealed tampering. |\n| T1601.001 | Modify System Image: Patch System Image | Attestation against golden values flags unauthorized image patches. |\n\n## Workflow\n\n### 1. Confirm the TPM is present and read its properties\n```bash\ntpm2_getcap properties-fixed | grep -i manufacturer\ntpm2_getcap pcrs                 # list supported PCR banks (sha1, sha256, ...)\n```\n\n### 2. Read current PCR values\nPCR 7 = Secure Boot policy; PCR 0–7 = firmware; PCR 8–9 = bootloader\u002Fkernel; PCR 10 = IMA.\n```bash\ntpm2_pcrread sha256                       # all sha256 PCRs\ntpm2_pcrread sha256:0,1,2,3,4,5,6,7       # firmware + Secure Boot policy\ntpm2_pcrread sha256:7                      # Secure Boot policy only\n```\n\n### 3. Replay the TPM event log against live PCRs\nConfirm the recorded log reproduces the current PCR values (authenticity check).\n```bash\ntpm2_eventlog \u002Fsys\u002Fkernel\u002Fsecurity\u002Ftpm0\u002Fbinary_bios_measurements > eventlog.yaml\n# The YAML includes a \"pcrs\" section with the calculated values — compare to step 2.\n# Any mismatch means the event log and the live PCRs disagree (tampering or stale log).\n```\n\n### 4. Create a primary key and an Attestation Key (AK)\nThe AK signs quotes; its public part is shared with the verifier out-of-band.\n```bash\ntpm2_createprimary -C e -g sha256 -G rsa -c primary.ctx\ntpm2_create -C primary.ctx -G rsa -u ak.pub -r ak.priv \\\n  -a 'fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|sign'\ntpm2_load -C primary.ctx -u ak.pub -r ak.priv -c ak.ctx\ntpm2_readpublic -c ak.ctx -o ak.pem -f pem      # export AK public key for the verifier\n```\n\n### 5. Produce a nonce-bound quote (attestor side)\nThe verifier supplies a fresh random nonce to defeat replay.\n```bash\nNONCE=$(openssl rand -hex 20)\ntpm2_quote -c ak.ctx -l sha256:0,1,2,3,4,5,6,7,8,9 \\\n  -q \"$NONCE\" -m quote.msg -s quote.sig -o quote.pcrs -g sha256\n# Send quote.msg, quote.sig, quote.pcrs (and the nonce) to the verifier.\n```\n\n### 6. Verify the quote (verifier side)\nIndependently validate the signature, nonce, and PCR digest with the AK public key.\n```bash\ntpm2_checkquote -u ak.pem -m quote.msg -s quote.sig -f quote.pcrs \\\n  -q \"$NONCE\" -g sha256\n# Exit 0 + matching PCR digest == authentic, fresh, untampered quote.\n```\n\n### 7. Build and compare against a golden baseline\nCompare attested PCRs to known-good values captured from a trusted reference build.\n```bash\n# Capture golden values on a trusted reference machine:\ntpm2_pcrread sha256:0,7 > golden_pcrs.txt\n# On each attested host, diff the quote's PCR section against golden_pcrs.txt.\ndiff \u003C(grep -A8 'sha256' quote.pcrs) golden_pcrs.txt\n```\n\n### 8. Seal a secret to a measured-boot policy (optional)\nBind a secret so the TPM only releases it when PCRs match the trusted state.\n```bash\ntpm2_createpolicy --policy-pcr -l sha256:7 -L pcr7.policy -f pcr7.dat\necho -n \"diskkey\" | tpm2_create -C primary.ctx -L pcr7.policy \\\n  -i - -u sealed.pub -r sealed.priv\ntpm2_load -C primary.ctx -u sealed.pub -r sealed.priv -c sealed.ctx\n# Unseal succeeds only while PCR 7 matches the sealed policy:\ntpm2_unseal -c sealed.ctx -p pcr:sha256:7\n```\n\n### 9. Inspect IMA runtime measurements (PCR 10)\nIf IMA is enabled, the runtime measurement list extends PCR 10.\n```bash\ntpm2_pcrread sha256:10\nhead -20 \u002Fsys\u002Fkernel\u002Fsecurity\u002Fima\u002Fascii_runtime_measurements\n```\n\n### 10. Run the bundled attestation helper\n`agent.py` reads PCRs, replays the event log, optionally produces+verifies a quote, and diffs a baseline.\n```bash\nsudo python scripts\u002Fagent.py --pcrs 0,1,2,3,4,5,6,7 --baseline golden_pcrs.json --output attest.json\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| tpm2-tools | CLI for all TPM 2.0 operations | https:\u002F\u002Fgithub.com\u002Ftpm2-software\u002Ftpm2-tools |\n| tpm2-tss | TSS2 stack the tools build on | https:\u002F\u002Fgithub.com\u002Ftpm2-software\u002Ftpm2-tss |\n| Keylime | Scalable remote attestation framework | https:\u002F\u002Fgithub.com\u002Fkeylime\u002Fkeylime |\n| TCG PC Client Platform Firmware Profile | PCR usage specification | https:\u002F\u002Ftrustedcomputinggroup.org\u002F |\n| Linux IMA docs | Integrity Measurement Architecture | https:\u002F\u002Fsourceforge.net\u002Fp\u002Flinux-ima\u002Fwiki\u002FHome\u002F |\n| RFC 9683 | Remote integrity verification of TPM devices | https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc9683 |\n\n## Validation Criteria\n\n- [ ] TPM 2.0 presence and supported PCR banks confirmed.\n- [ ] Current PCR values read for firmware and Secure Boot policy PCRs.\n- [ ] Event log replayed and confirmed to reproduce live PCR values.\n- [ ] Attestation Key created and its public key exported to the verifier.\n- [ ] Nonce-bound quote produced and independently verified with `tpm2_checkquote`.\n- [ ] Attested PCRs compared against a golden baseline; drift flagged.\n- [ ] (Optional) Secret sealed\u002Funsealed against a PCR policy successfully.\n- [ ] IMA runtime measurements reviewed where enabled.\n- [ ] Results documented per host with pass\u002Ffail and any drift evidence.\n","# Validating TPM Measured Boot and Attestation\n\n> **Legal Notice:** Perform TPM operations only on systems you own or are authorized to assess. Some operations (clearing the TPM, taking ownership, defining NV indices) are destructive or can lock the device. This skill is for defensive integrity verification and authorized assessment.\n\n## Overview\n\nA Trusted Platform Module (TPM 2.0) is a hardware root of trust that supports **measured boot**: each stage of the boot chain hashes (\"measures\") the next stage and *extends* that measurement into a Platform Configuration Register (PCR) before handing off control. PCRs cannot be set arbitrarily — they can only be extended (`new = hash(old || measurement)`), so the final PCR value is a tamper-evident summary of everything that executed. The TCG firmware profile assigns specific meanings: UEFI firmware code\u002Fconfig measure into **PCR 0–7** (PCR 7 specifically captures Secure Boot policy), bootloaders measure the kernel into **PCR 8–9**, and Linux IMA measures executables into **PCR 10**.\n\nTwo complementary verifications matter. **Local validation** reads current PCRs (`tpm2_pcrread`) and replays the TPM event log (`tpm2_eventlog` on `\u002Fsys\u002Fkernel\u002Fsecurity\u002Ftpm0\u002Fbinary_bios_measurements`) to confirm the recorded measurements reproduce the live PCR values — proving the log is authentic and revealing exactly *what* changed if a value drifts from baseline. **Remote attestation** has the TPM produce a signed quote (`tpm2_quote`) over selected PCRs using an Attestation Key (AK), with a fresh nonce to prevent replay; a verifier then independently checks the signature and PCR digest (`tpm2_checkquote`) and compares against a golden\u002Fexpected value. This lets a server cryptographically establish that a remote machine booted approved firmware and kernel before granting access, sealing secrets, or admitting it to a Zero Trust network.\n\nThis skill provides the full `tpm2-tools` workflow for enrolling an AK, capturing and verifying quotes, replaying event logs, sealing\u002Funsealing data to a PCR policy, and building a golden-value baseline for fleet attestation.\n\n## When to Use\n\n- Establishing that endpoints\u002Fservers booted a known-good firmware and kernel before granting access (Zero Trust device posture).\n- Detecting boot-chain tampering (bootkits, unauthorized firmware\u002Fkernel changes) via PCR drift from a baseline.\n- Verifying measured-boot integrity after a Secure Boot or firmware incident.\n- Sealing secrets (disk keys, credentials) to a measured-boot state so they only release on a trusted boot.\n- Building or auditing a remote-attestation service (e.g., Keylime, custom verifier).\n\n## Prerequisites\n\n- A system with a TPM 2.0 device and the resource manager:\n  ```bash\n  sudo apt install tpm2-tools tpm2-abrmd        # Debian\u002FUbuntu\n  sudo dnf install tpm2-tools tpm2-abrmd        # Fedora\u002FRHEL\n  ```\n- Access to the TPM (`\u002Fdev\u002Ftpm0` \u002F `\u002Fdev\u002Ftpmrm0`) and the kernel measurement log at `\u002Fsys\u002Fkernel\u002Fsecurity\u002Ftpm0\u002Fbinary_bios_measurements`.\n- Root for reading some sysfs entries and for NV\u002FAK operations.\n- For remote attestation: a verifier host and a transport for the quote\u002Fnonce exchange.\n\n## Objectives\n\n- Read and interpret PCR banks and their TCG-assigned meanings.\n- Verify the TPM event log reproduces live PCR values (event-log replay).\n- Create an Attestation Key and produce a nonce-bound signed quote.\n- Independently verify the quote signature and PCR digest on a verifier.\n- Establish golden PCR baselines and detect drift across a fleet.\n- Optionally seal\u002Funseal a secret to a measured-boot PCR policy.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | Relevance |\n|--------------|----------------|-----------|\n| T1542 | Pre-OS Boot | Measured boot detects pre-OS tampering this technique relies on. |\n| T1542.001 | Pre-OS Boot: System Firmware | PCR 0–7 drift reveals unauthorized firmware modification. |\n| T1542.003 | Pre-OS Boot: Bootkit | Bootloader\u002Fkernel measurements (PCR 8–10) expose bootkit changes. |\n| T1014 | Rootkit | IMA measurements (PCR 10) and quote verification surface concealed tampering. |\n| T1601.001 | Modify System Image: Patch System Image | Attestation against golden values flags unauthorized image patches. |\n\n## Workflow\n\n### 1. Confirm the TPM is present and read its properties\n```bash\ntpm2_getcap properties-fixed | grep -i manufacturer\ntpm2_getcap pcrs                 # list supported PCR banks (sha1, sha256, ...)\n```\n\n### 2. Read current PCR values\nPCR 7 = Secure Boot policy; PCR 0–7 = firmware; PCR 8–9 = bootloader\u002Fkernel; PCR 10 = IMA.\n```bash\ntpm2_pcrread sha256                       # all sha256 PCRs\ntpm2_pcrread sha256:0,1,2,3,4,5,6,7       # firmware + Secure Boot policy\ntpm2_pcrread sha256:7                      # Secure Boot policy only\n```\n\n### 3. Replay the TPM event log against live PCRs\nConfirm the recorded log reproduces the current PCR values (authenticity check).\n```bash\ntpm2_eventlog \u002Fsys\u002Fkernel\u002Fsecurity\u002Ftpm0\u002Fbinary_bios_measurements > eventlog.yaml\n# The YAML includes a \"pcrs\" section with the calculated values — compare to step 2.\n# Any mismatch means the event log and the live PCRs disagree (tampering or stale log).\n```\n\n### 4. Create a primary key and an Attestation Key (AK)\nThe AK signs quotes; its public part is shared with the verifier out-of-band.\n```bash\ntpm2_createprimary -C e -g sha256 -G rsa -c primary.ctx\ntpm2_create -C primary.ctx -G rsa -u ak.pub -r ak.priv \\\n  -a 'fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|sign'\ntpm2_load -C primary.ctx -u ak.pub -r ak.priv -c ak.ctx\ntpm2_readpublic -c ak.ctx -o ak.pem -f pem      # export AK public key for the verifier\n```\n\n### 5. Produce a nonce-bound quote (attestor side)\nThe verifier supplies a fresh random nonce to defeat replay.\n```bash\nNONCE=$(openssl rand -hex 20)\ntpm2_quote -c ak.ctx -l sha256:0,1,2,3,4,5,6,7,8,9 \\\n  -q \"$NONCE\" -m quote.msg -s quote.sig -o quote.pcrs -g sha256\n# Send quote.msg, quote.sig, quote.pcrs (and the nonce) to the verifier.\n```\n\n### 6. Verify the quote (verifier side)\nIndependently validate the signature, nonce, and PCR digest with the AK public key.\n```bash\ntpm2_checkquote -u ak.pem -m quote.msg -s quote.sig -f quote.pcrs \\\n  -q \"$NONCE\" -g sha256\n# Exit 0 + matching PCR digest == authentic, fresh, untampered quote.\n```\n\n### 7. Build and compare against a golden baseline\nCompare attested PCRs to known-good values captured from a trusted reference build.\n```bash\n# Capture golden values on a trusted reference machine:\ntpm2_pcrread sha256:0,7 > golden_pcrs.txt\n# On each attested host, diff the quote's PCR section against golden_pcrs.txt.\ndiff \u003C(grep -A8 'sha256' quote.pcrs) golden_pcrs.txt\n```\n\n### 8. Seal a secret to a measured-boot policy (optional)\nBind a secret so the TPM only releases it when PCRs match the trusted state.\n```bash\ntpm2_createpolicy --policy-pcr -l sha256:7 -L pcr7.policy -f pcr7.dat\necho -n \"diskkey\" | tpm2_create -C primary.ctx -L pcr7.policy \\\n  -i - -u sealed.pub -r sealed.priv\ntpm2_load -C primary.ctx -u sealed.pub -r sealed.priv -c sealed.ctx\n# Unseal succeeds only while PCR 7 matches the sealed policy:\ntpm2_unseal -c sealed.ctx -p pcr:sha256:7\n```\n\n### 9. Inspect IMA runtime measurements (PCR 10)\nIf IMA is enabled, the runtime measurement list extends PCR 10.\n```bash\ntpm2_pcrread sha256:10\nhead -20 \u002Fsys\u002Fkernel\u002Fsecurity\u002Fima\u002Fascii_runtime_measurements\n```\n\n### 10. Run the bundled attestation helper\n`agent.py` reads PCRs, replays the event log, optionally produces+verifies a quote, and diffs a baseline.\n```bash\nsudo python scripts\u002Fagent.py --pcrs 0,1,2,3,4,5,6,7 --baseline golden_pcrs.json --output attest.json\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| tpm2-tools | CLI for all TPM 2.0 operations | https:\u002F\u002Fgithub.com\u002Ftpm2-software\u002Ftpm2-tools |\n| tpm2-tss | TSS2 stack the tools build on | https:\u002F\u002Fgithub.com\u002Ftpm2-software\u002Ftpm2-tss |\n| Keylime | Scalable remote attestation framework | https:\u002F\u002Fgithub.com\u002Fkeylime\u002Fkeylime |\n| TCG PC Client Platform Firmware Profile | PCR usage specification | https:\u002F\u002Ftrustedcomputinggroup.org\u002F |\n| Linux IMA docs | Integrity Measurement Architecture | https:\u002F\u002Fsourceforge.net\u002Fp\u002Flinux-ima\u002Fwiki\u002FHome\u002F |\n| RFC 9683 | Remote integrity verification of TPM devices | https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc9683 |\n\n## Validation Criteria\n\n- [ ] TPM 2.0 presence and supported PCR banks confirmed.\n- [ ] Current PCR values read for firmware and Secure Boot policy PCRs.\n- [ ] Event log replayed and confirmed to reproduce live PCR values.\n- [ ] Attestation Key created and its public key exported to the verifier.\n- [ ] Nonce-bound quote produced and independently verified with `tpm2_checkquote`.\n- [ ] Attested PCRs compared against a golden baseline; drift flagged.\n- [ ] (Optional) Secret sealed\u002Funsealed against a PCR policy successfully.\n- [ ] IMA runtime measurements reviewed where enabled.\n- [ ] Results documented per host with pass\u002Ffail and any drift evidence.\n",{"name":5,"tags":49,"author":53,"domain":37,"license":15,"version":54,"nist_csf":55,"subdomain":50,"description":7,"mitre_attack":57},[50,51,33,39,52,40,41,42],"hardware-firmware-security","tpm","pcr","mahipal","1.0",[56],"PR.PS-01",[58],"T1542","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fvalidating-tpm-measured-boot-attestation",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill validating-tpm-measured-boot-attestation",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill validating-tpm-measured-boot-attestation",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill validating-tpm-measured-boot-attestation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",true,[83,88,94,98],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",2594,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fstandards.md",1537,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002Freferences\u002Fstandards.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",6397,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002Fscripts\u002Fagent.py",[105,129,157,183,210,234],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[111],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,34,37,117,118,28,119,120,121,122,123,124,125,24,126,127,128],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","code-signing","cosign","keyless",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":139,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[135,138],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[36,140,141,142,143,37,144,145,29,146,147,148,149,150,151,152,153,154,155,156],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,166,167,37,168,169,170,171,172,173,174,175,176,177,178,179,32,180,181,182],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[191,192,193,37,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[216],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,218,37,219,220,221,222,223,224,225,226,152,227,153,228,229,230,231,232,233],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":44},"01M6AGCYCY9QW562V4CDK3X2RY","triaging-security-incident-with-ir-playbook","Classifies and prioritizes security incidents using structured IR playbooks and SIEM\u002Fcase-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[240],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,242,243,37,219,244,245,145,222,246,148,225,152,153,247,248,229,207,230],"playbook","triaging security incident with ir playbook","triage","teams","splunk","tuning","thehive"]