[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:stats":3,"skills:sce6":8,"skills:pro6":55,"skills:creators9":100,"skills:all:stars:114:":195},{"skillCount":4,"professionCount":5,"scenarioCount":6,"creatorCount":7},196852,11,7,1926,[9,20,27,34,41,48],{"categoryNo":10,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":13,"categoryNameEn":14,"description":15,"level":16,"skillCount":17,"parentNo":18,"parentName":18,"children":19},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",1,39458,null,[],{"categoryNo":21,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":22,"categoryNameEn":23,"description":24,"level":16,"skillCount":25,"parentNo":18,"parentName":18,"children":26},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":28,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":29,"categoryNameEn":30,"description":31,"level":16,"skillCount":32,"parentNo":18,"parentName":18,"children":33},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":35,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":36,"categoryNameEn":37,"description":38,"level":16,"skillCount":39,"parentNo":18,"parentName":18,"children":40},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":42,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":43,"categoryNameEn":44,"description":45,"level":16,"skillCount":46,"parentNo":18,"parentName":18,"children":47},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":49,"taxonomyType":11,"taxonomyTypeDesc":12,"categoryName":50,"categoryNameEn":51,"description":52,"level":16,"skillCount":53,"parentNo":18,"parentName":18,"children":54},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],[56,65,72,79,86,93],{"categoryNo":57,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":60,"categoryNameEn":61,"description":62,"level":16,"skillCount":63,"parentNo":18,"parentName":18,"children":64},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",13274,[],{"categoryNo":66,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":67,"categoryNameEn":68,"description":69,"level":16,"skillCount":70,"parentNo":18,"parentName":18,"children":71},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":73,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":74,"categoryNameEn":75,"description":76,"level":16,"skillCount":77,"parentNo":18,"parentName":18,"children":78},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":80,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":81,"categoryNameEn":82,"description":83,"level":16,"skillCount":84,"parentNo":18,"parentName":18,"children":85},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":87,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":88,"categoryNameEn":89,"description":90,"level":16,"skillCount":91,"parentNo":18,"parentName":18,"children":92},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":94,"taxonomyType":58,"taxonomyTypeDesc":59,"categoryName":95,"categoryNameEn":96,"description":97,"level":16,"skillCount":98,"parentNo":18,"parentName":18,"children":99},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"records":101,"total":7,"current":16,"size":194},[102,114,123,133,143,153,163,172,182],{"accountNo":103,"login":104,"displayName":105,"avatarUrl":106,"accountType":107,"accountTypeDesc":108,"profileDescription":109,"skillCount":110,"repoCount":111,"professionCount":5,"scenarioCount":6,"totalStars":112,"updatedAt":113},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,828772,"2026-11-13 04:10:52",{"accountNo":115,"login":116,"displayName":116,"avatarUrl":117,"accountType":107,"accountTypeDesc":108,"profileDescription":118,"skillCount":119,"repoCount":120,"professionCount":6,"scenarioCount":6,"totalStars":121,"updatedAt":122},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":124,"login":125,"displayName":126,"avatarUrl":127,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":128,"repoCount":129,"professionCount":6,"scenarioCount":130,"totalStars":131,"updatedAt":132},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":134,"login":135,"displayName":136,"avatarUrl":137,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":138,"repoCount":139,"professionCount":140,"scenarioCount":6,"totalStars":141,"updatedAt":142},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":144,"login":145,"displayName":146,"avatarUrl":147,"accountType":107,"accountTypeDesc":108,"profileDescription":148,"skillCount":149,"repoCount":150,"professionCount":5,"scenarioCount":6,"totalStars":151,"updatedAt":152},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":154,"login":155,"displayName":156,"avatarUrl":157,"accountType":107,"accountTypeDesc":108,"profileDescription":158,"skillCount":159,"repoCount":160,"professionCount":5,"scenarioCount":6,"totalStars":161,"updatedAt":162},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":164,"login":165,"displayName":166,"avatarUrl":167,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":168,"repoCount":169,"professionCount":5,"scenarioCount":6,"totalStars":170,"updatedAt":171},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":173,"login":174,"displayName":175,"avatarUrl":176,"accountType":107,"accountTypeDesc":108,"profileDescription":18,"skillCount":177,"repoCount":178,"professionCount":179,"scenarioCount":6,"totalStars":180,"updatedAt":181},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":183,"login":184,"displayName":185,"avatarUrl":186,"accountType":187,"accountTypeDesc":188,"profileDescription":189,"skillCount":190,"repoCount":191,"professionCount":130,"scenarioCount":6,"totalStars":192,"updatedAt":193},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",9,{"records":196,"total":4,"current":555,"size":556},[197,238,264,277,303,328,350,368,389,404,418,436,452,465,478,499,511,528],{"skillNo":198,"name":199,"nameZh":18,"description":200,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":209,"categories":210,"keywords":218,"publishedAt":237},"01M6AEFB5FG75ZF1YGA33NCFJ9","detecting-model-extraction-attacks","Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume\u002Fdistribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning\u002Finversion\u002Fmembership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002FSKILL.md",[211,214,217],{"categoryNo":212,"categoryName":213,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":57,"categoryName":60,"taxonomyType":58,"taxonomyTypeDesc":59},[219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236],"extraction","detecting model extraction attacks","security","inference","cybersecurity","deployment","monitoring","red-team","ai-security","detection","rate-limiting","model-extraction","membership-inference","model-inversion","inference-api","mitre-atlas","query-monitoring","mlsecops","2026-11-10 10:12:30",{"skillNo":239,"name":240,"nameZh":18,"description":241,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":237},"01M6AEF7VZ87P3PHBCYJS7J7K9","detecting-modbus-protocol-anomalies","Detect anomalies in Modbus\u002FTCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-modbus-protocol-anomalies\u002FSKILL.md",[244],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[246,247,248,249,250,223,251,252,253,254,225,255,256,257,258,259,260,261,262,263],"protocol","modbus","detecting modbus protocol anomalies","suspicious","python","pr","code","validation","tcp","Zeek","ids","suricata","ot-security","ics","scada","industrial-control","iec62443","protocol-anomaly",{"skillNo":265,"name":266,"nameZh":18,"description":267,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":268,"categories":269,"keywords":271,"publishedAt":237},"01M6AEF4H33NR3XMFHBX8EECC8","detecting-modbus-command-injection-attacks","Detect command injection against Modbus TCP\u002FRTU in ICS\u002FSCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register\u002Fcoil changes, or responding to FrostyGoop-style Modbus attacks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-modbus-command-injection-attacks\u002FSKILL.md",[270],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[272,221,223,251,246,273,254,225,274,275,256,228,258,259,260,247,276],"detecting modbus command injection attacks","communication","protocol-analysis","threat-detection","command-injection",{"skillNo":278,"name":279,"nameZh":18,"description":280,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":281,"categories":282,"keywords":287,"publishedAt":237},"01M6AEF0KMZRY39G6TJRKSS1XN","detecting-mobile-malware-behavior","Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mobile-malware-behavior\u002FSKILL.md",[283,286],{"categoryNo":284,"categoryName":285,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[288,289,290,291,249,292,223,293,251,294,273,225,295,296,297,298,299,300,301,302],"malware","detecting mobile malware behavior","testing","malicious","android","accessibility","verification","malware analysis","malware-analysis","command-and-control","exfiltration","mobile-security","ios","owasp-mobile","analyzing",{"skillNo":304,"name":305,"nameZh":18,"description":306,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":307,"categories":308,"keywords":310,"publishedAt":237},"01M6AEEWKNKRVQ2ZNVKWXQP6N9","detecting-misconfigured-azure-storage","Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-misconfigured-azure-storage\u002FSKILL.md",[309],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[311,312,313,314,315,316,221,223,317,251,318,319,320,321,322,323,324,325,326,327],"storage","azure storage","azure","detecting misconfigured azure storage","cli","containers","defender","logging","audit","cloud-security","network","data","powershell","encryption","blob-storage","SAS-tokens","storage-security",{"skillNo":329,"name":330,"nameZh":18,"description":331,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":332,"categories":333,"keywords":335,"publishedAt":237},"01M6AEESA4ASJ0FPVKAJXWZQME","detecting-mimikatz-execution-patterns","Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary\u002Fhash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR\u002FSIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-mimikatz-execution-patterns\u002FSKILL.md",[334],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[336,337,338,223,339,340,341,342,343,344,345,346,228,347,348,349],"mimikatz","detecting mimikatz execution patterns","memory","incident response","siem","threat hunting","web","mitre-attack","threat-hunting","proactive-detection","credential-dumping","edr","lsass","t1003",{"skillNo":351,"name":352,"nameZh":18,"description":353,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":354,"categories":355,"keywords":356,"publishedAt":237},"01M6AEEP3FCDFWHN7HAA2Z6ASR","detecting-malicious-scheduled-tasks-with-sysmon","Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698\u002F4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task\u002FJob analysis.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-malicious-scheduled-tasks-with-sysmon\u002FSKILL.md",[],[291,357,358,359,360,249,221,223,361,362,363,364,365,225,344,256,366,228,367],"tasks","sysmon","detecting malicious scheduled tasks with sysmon","directory","windows","create","xml","file","persistence","windows-security","scheduled-tasks",{"skillNo":369,"name":370,"nameZh":18,"description":371,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":372,"categories":373,"keywords":378,"publishedAt":237},"01M6AEEJHMSYVHCVMZF815DMKN","detecting-malicious-npm-packages","Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network\u002Ffilesystem monitoring. Use when vetting a new dependency, reviewing a package.json\u002Fpackage-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-malicious-npm-packages\u002FSKILL.md",[374,377],{"categoryNo":375,"categoryName":376,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[291,379,380,381,382,383,223,252,384,225,385,288,296,298,275,321,228,386,387,388],"packages","npm","detecting malicious npm packages","code review","review","package","static-analysis","supply-chain-security","guarddog","install-scripts",{"skillNo":390,"name":391,"nameZh":18,"description":392,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":393,"categories":394,"keywords":395,"publishedAt":237},"01M6AEEF1SJVK6EHXKKXT8Z281","detecting-living-off-the-land-with-lolbas","Detect Living Off the Land Binaries (LOLBins\u002FLOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries abusing built-in Windows binaries to download, execute, or proxy malicious code while evading traditional executable-based detection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-living-off-the-land-with-lolbas\u002FSKILL.md",[],[396,397,291,223,361,398,252,253,246,399,364,225,344,275,358,228,400,401,402,403],"land","detecting living off the land with lolbas","telemetry","proxy","process-monitoring","lolbas","sigma-rules","endpoint-detection",{"skillNo":405,"name":406,"nameZh":18,"description":407,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":408,"categories":409,"keywords":411,"publishedAt":237},"01M6AEEBS314Z39ZH63NSNXG0K","detecting-living-off-the-land-attacks","Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-living-off-the-land-attacks\u002FSKILL.md",[410],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[396,412,249,223,361,246,225,413,275,321,228,414,415,416,417,400],"detecting living off the land attacks","server","fileless","LOLBins","lotl","fileless-attacks",{"skillNo":419,"name":420,"nameZh":18,"description":421,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":422,"categories":423,"keywords":425,"publishedAt":237},"01M6AEE85YQAKTVMKQGCQPTGZJ","detecting-lateral-movement-with-zeek","Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002FSKILL.md",[424],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[255,426,221,223,251,427,364,428,429,321,430,431,432,433,434,435],"detecting lateral movement with zeek","rpc","forensics","network-forensics","network-security","lateral-movement","kerberos","smb","dce-rpc","ntlm-spray",{"skillNo":437,"name":438,"nameZh":18,"description":439,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":440,"categories":441,"keywords":443,"publishedAt":237},"01M6AEE4WPR6FH7320442BQ380","detecting-lateral-movement-with-splunk","Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI\u002FPsExec\u002FRDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-with-splunk\u002FSKILL.md",[442],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[444,445,223,340,361,446,246,447,413,343,344,321,448,449,345,431,450,228,451],"splunk","detecting lateral movement with splunk","authentication","logs","SPL","pivoting","ATT&CK","ta0008",{"skillNo":453,"name":454,"nameZh":18,"description":455,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":456,"categories":457,"keywords":459,"publishedAt":237},"01M6AEE1JXAAKD23N207CMCG8V","detecting-lateral-movement-in-network","Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-lateral-movement-in-network\u002FSKILL.md",[458],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[321,460,221,223,340,461,251,446,246,447,413,275,462,302,255,430,463,431,228,464],"detecting lateral movement in network","sessions","Enterprise","correlation","pass-the-hash",{"skillNo":466,"name":467,"nameZh":18,"description":468,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":469,"categories":470,"keywords":472,"publishedAt":237},"01M6AEDXCC4RY93DTSTB3D04V6","detecting-kerberoasting-attacks","Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords. Use when hunting for MITRE T1558 credential access activity or investigating suspected service account password cracking attempts in Active Directory Kerberos logs.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-kerberoasting-attacks\u002FSKILL.md",[471],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[473,474,360,223,246,475,447,225,413,476,343,344,321,345,432,228,477],"kerberoasting","detecting kerberoasting attacks","offline","credential-access","t1558",{"skillNo":479,"name":480,"nameZh":18,"description":481,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":482,"categories":483,"keywords":488,"publishedAt":237},"01M6AEDSYK16R3STYYGW32EN0Y","detecting-insider-threat-with-ueba","Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch\u002FOpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and alert on insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access. Use when building or tuning a UEBA pipeline rather than a one-off manual hunt.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-threat-with-ueba\u002FSKILL.md",[484,487],{"categoryNo":485,"categoryName":486,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":73,"categoryName":74,"taxonomyType":58,"taxonomyTypeDesc":59},[489,490,223,340,491,492,298,275,322,493,228,494,495,496,497,498],"UEBA","detecting insider threat with ueba","implement","analytics","pipeline","anomaly-detection","machine-learning","insider-threat","elasticsearch","behavior-analytics",{"skillNo":500,"name":501,"nameZh":18,"description":502,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":503,"categories":504,"keywords":506,"publishedAt":237},"01M6AEDPNNT2FSF32144KP8YD4","detecting-insider-threat-behaviors","Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft. Use when proactively threat-hunting for malicious or negligent insider activity, or when investigating a departing or disgruntled employee for potential data theft.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-threat-behaviors\u002FSKILL.md",[505],{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},[507,291,508,223,446,364,343,344,509,322,345,228,489,496,510],"detecting insider threat behaviors","policy","downloads","data-theft",{"skillNo":512,"name":513,"nameZh":18,"description":514,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":515,"categories":516,"keywords":519,"publishedAt":237},"01M6AEDK40K1DYPFT3K56Y7B0Q","detecting-insider-data-exfiltration-via-dlp","Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-data-exfiltration-via-dlp\u002FSKILL.md",[517,518],{"categoryNo":485,"categoryName":486,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":73,"categoryName":74,"taxonomyType":58,"taxonomyTypeDesc":59},[298,322,520,521,221,508,223,492,522,364,447,523,524,525,302,228,489,496,526,527],"detecting insider data exfiltration via dlp","file access","pandas","cloud","security-operations","exfiltration-detection","data-loss-prevention","dlp",{"skillNo":529,"name":530,"nameZh":18,"description":531,"descriptionZh":18,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":18,"sourceHtmlUrl":532,"categories":533,"keywords":539,"publishedAt":237},"01M6AEDF0NRW1WV302YBNMDW6Q","detecting-indirect-prompt-injection","Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML\u002FPDF\u002FOCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2. Use when an agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-indirect-prompt-injection\u002FSKILL.md",[534,537,538],{"categoryNo":535,"categoryName":536,"taxonomyType":11,"taxonomyTypeDesc":12},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":215,"categoryName":216,"taxonomyType":11,"taxonomyTypeDesc":12},{"categoryNo":80,"categoryName":81,"taxonomyType":58,"taxonomyTypeDesc":59},[540,541,542,221,223,342,543,544,545,219,227,546,547,548,549,550,551,552,553,554],"prompt injection","detecting indirect prompt injection","PDF","documents","multimodal","content","agent-security","owasp","llm-guard","prompt-injection","defense","indirect-prompt-injection","llm-defense","content-scanning","owasp-llm",114,18]