来自 mukul975/Anthropic-Cybersecurity-Skills 的 Skills

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using Sharp…

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certi…

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements acros…

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (M…

Detect dangerous ACL misconfigurations in Active Directory using ldap3

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection,…

'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more …

'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query

'Analyzes bootkit and advanced rootkit malware infecting the Master

Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passw…

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH)…

Monitor Certificate Transparency logs using crt.sh and Certstream to

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours …

Extract and analyze Cobalt Strike beacon configuration from PE files

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extrac…

'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom

'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain

Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and …

'Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

Investigate compromised Docker containers by analyzing images, layers,

Parse and analyze email headers (Received chain, Return-Path, Message-ID)

Perform static and symbolic analysis of Solidity smart contracts using

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Detect and analyze heap spray attacks in memory dumps using Volatility3