Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 121 · 50 results shown
Skill
hunting-for-t1098-account-manipulation
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-t1098-account-manipulation
Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs 4738, 4728, 4732, 4756, 4670, and 5136. Use when investigating suspected privilege persistence in Active Directory, after detecting anomalous group/credential changes, or during incident response to trace account tampering.
Repository stars: 35,758 · Incomplete scan
Skill
securing-serverless-functions
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-serverless-functions
Hardens serverless compute platforms (AWS Lambda, Azure Functions, Google Cloud Functions): least-privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring. Use when deploying serverless functions with sensitive access, auditing for overly permissive roles, or adding functions to a DevSecOps pipeline.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-wireless-network-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-wireless-network-penetration-test
Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-template-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-template-injection-vulnerabilities
Detects and exploits Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution. Use when pentesting a web application that renders user input through a server-side template engine and you need to confirm and weaponize SSTI.
Repository stars: 35,758 · Incomplete scan
Skill
performing-bandwidth-throttling-attack-simulation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-bandwidth-throttling-attack-simulation
Simulate bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized lab environments to test QoS controls, application resilience, and monitoring detection of traffic manipulation. Use when validating how VoIP, video, or other real-time applications and network monitoring tools respond to degraded bandwidth or slowloris-style throttling attacks.
Repository stars: 35,758 · Incomplete scan
Skill
performing-network-forensics-with-wireshark
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-network-forensics-with-wireshark
Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control communications. Use when analyzing captured traffic from a security incident, reconstructing data exfiltration, or finding network indicators of compromise during malware analysis.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-aws-credential-exposure-with-trufflehog
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-aws-credential-exposure-with-trufflehog
Scan source code repositories, CI/CD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI/CD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.
Repository stars: 35,758 · Incomplete scan
Skill
generating-and-analyzing-sboms
mukul975/Anthropic-Cybersecurity-Skills · skills/generating-and-analyzing-sboms
Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD.
Repository stars: 35,758 · Incomplete scan
Skill
performing-threat-intelligence-sharing-with-misp
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-threat-intelligence-sharing-with-misp
Uses PyMISP (the official MISP REST API library) to create events with structured IOCs (IPs, domains, hashes, URLs), enrich them with MITRE ATT&CK tags and galaxy clusters, manage sharing groups and distribution levels, search existing intelligence, and export in STIX 2.1 format. Use when creating, enriching, or sharing threat intelligence events on a MISP instance, or integrating IOC feeds with other platforms.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-immutable-backup-with-restic
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-immutable-backup-with-restic
Implements ransomware-resistant backups using restic with S3-compatible Object Lock (AWS S3, MinIO, Backblaze B2), automating backup creation, integrity checks via restic check --read-data, retention enforcement, and restore testing. Use when building immutable backup infrastructure, adding a WORM copy to a 3-2-1-1-0 strategy, or automating scheduled backup-verification workflows.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-container-network-policies-with-calico
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-container-network-policies-with-calico
Uses Calico's own policy CRDs beyond the upstream Kubernetes API - GlobalNetworkPolicy, HostEndpoint, NetworkSet, policy tiers, and DNS-based egress rules - applied and audited with calicoctl. Use when a policy must span namespaces or protect the host itself, when egress has to be expressed by domain name, or when ordering policies into tiers. Keywords: calicoctl, GlobalNetworkPolicy, HostEndpoint, NetworkSet, tier, DNS egress, order. Do not use for portable upstream NetworkPolicy - use implementing-network-policies-for-kubernetes; for installing Calico and writing standard policy with it use implementing-kubernetes-network-policy-with-calico.
Repository stars: 35,758 · Incomplete scan
Skill
orchestrating-llm-attacks-with-pyrit
mukul975/Anthropic-Cybersecurity-Skills · skills/orchestrating-llm-attacks-with-pyrit
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-attacks-on-scada-systems
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-attacks-on-scada-systems
This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command injection into PLCs, HMI compromise, historian data manipulation, and denial-of-service against control system communications. It leverages OT-specific intrusion detection systems, industrial protocol anomaly detection, and process data analytics to identify attacks that traditional IT security tools miss.
Repository stars: 35,758 · Incomplete scan
Skill
reverse-engineering-android-malware-with-jadx
mukul975/Anthropic-Cybersecurity-Skills · skills/reverse-engineering-android-malware-with-jadx
Reverse engineers malicious Android APK files using the JADX decompiler to read Java/Kotlin source, inspect manifest permissions, receivers, services, and native libraries, and identify data theft, C2 communication, privilege escalation, or overlay-attack behavior. Use when analyzing a suspected Android banking trojan, spyware, SMS stealer, or other flagged APK, or when investigating mobile malware or Android threats generally.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-oauth-misconfiguration
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-oauth-misconfiguration
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Repository stars: 35,758 · Incomplete scan
Skill
performing-vulnerability-scanning-with-nessus
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-vulnerability-scanning-with-nessus
Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patches across network infrastructure, servers, and applications. The scanner correlates findings with CVE databases and CVSS scores to produce prioritized remediation guidance. Activates for requests involving vulnerability scanning, Nessus assessment, patch compliance checking, or automated vulnerability detection.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-campaign-attribution-evidence
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-internal-reconnaissance-with-bloodhound-ce
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-internal-reconnaissance-with-bloodhound-ce
Conduct internal Active Directory reconnaissance using BloodHound Community Edition's graph database with the SharpHound (AD) and AzureHound (Entra ID) collectors, mapping ACLs, sessions, and group memberships into attack paths from a low-privileged foothold to Domain Admin. Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-bluetooth-low-energy-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-bluetooth-low-energy-attacks
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-cloud-trail-log-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cloud-trail-log-analysis
Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-ransomware-payment-wallets
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-ransomware-payment-wallets
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-mft-for-deleted-file-recovery
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT, and X-Ways Forensics to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space. Use when recovering evidence of deleted files, reconstructing NTFS file-system timelines, or detecting anti-forensic timestomping during a Windows forensic examination.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-typosquatting-packages
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-typosquatting-packages
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated ("slopsquatting") dependency list, or when auditing a lockfile diff for a swapped package.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-privilege-escalation-in-kubernetes-pods
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-privilege-escalation-in-kubernetes-pods
Detects and prevents privilege escalation inside Kubernetes pods by combining admission control (OPA policies), runtime monitoring (Falco), and audit log analysis of security contexts, Linux capabilities, and syscall patterns. Use when investigating a pod running as root or privileged, hardening workloads against in-pod escalation, or hunting for containers exceeding their intended scope. Keywords: allowPrivilegeEscalation, runAsRoot, capabilities, securityContext, OPA, Falco, audit log. Do not use for escalation through RBAC and service-account permissions - use auditing-kubernetes-rbac-privilege-escalation.
Repository stars: 35,758 · Incomplete scan
Skill
performing-malware-ioc-extraction
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-malware-ioc-extraction
Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist
Repository stars: 35,758 · Incomplete scan
Skill
implementing-zero-trust-with-hashicorp-boundary
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-with-hashicorp-boundary
Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller/worker setup, Vault-backed credential brokering, session recording, and OIDC/LDAP auth across an org/project scope hierarchy. Use when replacing VPN or direct network access with just-in-time, credential-less Boundary sessions, or standing up Boundary controllers and workers.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-kerberoasting-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-kerberoasting-attacks
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords. Use when hunting for MITRE T1558 credential access activity or investigating suspected service account password cracking attempts in Active Directory Kerberos logs.
Repository stars: 35,758 · Incomplete scan
Skill
managing-cloud-identity-with-okta
mukul975/Anthropic-Cybersecurity-Skills · skills/managing-cloud-identity-with-okta
Implement Okta as a centralized cloud identity provider: configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA with Okta FastPass, automate user provisioning/deprovisioning, and enforce adaptive access policies on device posture and risk signals. Use when standing up Okta SSO, rolling out FastPass MFA, automating identity lifecycle, or building risk-based conditional access for cloud environments.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-aws-with-pacu
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-aws-with-pacu
Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence/backdooring modules like iam__backdoor_users_keys. Use for authorized AWS penetration tests or red-team engagements, assessing blast radius from a compromised IAM credential, or generating attacker telemetry for purple-team detection testing.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-living-off-the-cloud-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-living-off-the-cloud-techniques
Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e. "living off the cloud" tradecraft that blends in with normal cloud API and service activity. Use when threat hunting for cloud-native C2 channels, abnormal use of storage/SaaS services for data staging, or exfiltration hidden in legitimate cloud traffic.
Repository stars: 35,758 · Incomplete scan
Skill
testing-oauth2-implementation-flaws
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-oauth2-implementation-flaws
Tests OAuth 2.0 and OpenID Connect implementations for authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass, using Burp Suite Professional and the EsPReSSO extension to probe the authorization server, client, and token handling. Use when assessing OAuth2/OIDC flows or SSO systems for misconfigurations enabling account takeover.
Repository stars: 35,758 · Incomplete scan
Skill
achieving-cmmc-level-2-compliance
mukul975/Anthropic-Cybersecurity-Skills · skills/achieving-cmmc-level-2-compliance
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
Repository stars: 35,758 · Incomplete scan
Skill
performing-ioc-enrichment-automation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ioc-enrichment-automation
Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-api-security-posture-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-api-security-posture-management
Implements API Security Posture Management (API-SPM) to continuously discover, classify, and risk-score APIs -- including internal, external, partner, and shadow endpoints -- while aggregating findings from DAST, SAST, SCA, and runtime monitoring into a unified risk view. Use when building continuous API inventory and risk-scoring, detecting configuration drift or policy violations, or unifying API risk visibility across an organization.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-ransomware-leak-site-intelligence
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-ransomware-leak-site-intelligence
Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-startup-folder-persistence
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-startup-folder-persistence
Detects T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, cross-referencing Autoruns entries, and running a Python watchdog script for real-time filesystem monitoring. Use when hunting for malware or implants that survive reboot via startup-folder placement, or when validating autoruns/EDR findings against known-good startup baselines.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-deception-based-detection-with-canarytoken
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-deception-based-detection-with-canarytoken
Deploys and monitors Canary Tokens via the Thinkst Canary REST API for deception-based breach detection, programmatically creating web bug, DNS, MS Word document, and AWS API key tokens and generating deception coverage reports from triggered alerts. Use when standing up honeytoken tripwires for early breach detection or building a deception-technology coverage report.
Repository stars: 35,758 · Incomplete scan
Skill
performing-initial-access-with-evilginx3
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-initial-access-with-evilginx3
Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-ipv6-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-ipv6-vulnerabilities
Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
Repository stars: 35,758 · Incomplete scan
Skill
building-soc-metrics-and-kpi-tracking
mukul975/Anthropic-Cybersecurity-Skills · skills/building-soc-metrics-and-kpi-tracking
Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using SIEM data. Use when SOC leadership needs operational visibility, continuous improvement tracking, or executive-level reporting on security operations effectiveness.
Repository stars: 35,758 · Incomplete scan
Skill
performing-cloud-asset-inventory-with-cartography
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-asset-inventory-with-cartography
Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database, mapping relationships such as IAM permission chains, network paths, and cross-account trust. Use when building a cloud asset inventory, querying the graph to identify attack paths, or generating security reports across multi-cloud infrastructure.
Repository stars: 35,758 · Incomplete scan
Skill
intercepting-mobile-traffic-with-burpsuite
mukul975/Anthropic-Cybersecurity-Skills · skills/intercepting-mobile-traffic-with-burpsuite
Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-file-integrity-monitoring-with-aide
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-file-integrity-monitoring-with-aide
Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.
Repository stars: 35,758 · Incomplete scan
Skill
performing-disk-forensics-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-disk-forensics-investigation
Conduct disk forensics investigations using forensic imaging, file system analysis, and timeline reconstruction, with tools such as FTK Imager, Autopsy, and The Sleuth Kit, for evidence acquisition, deleted file recovery, and artifact examination. Use when a security incident requires forensic analysis of persistent storage or when evidence must be preserved for legal or HR proceedings.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-lnk-file-and-jump-list-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, reconstructing file-access or program-execution timelines, or examining recent/frequently-used file evidence in a forensic exam.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-pass-the-ticket-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-pass-the-ticket-attacks
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.
Repository stars: 35,758 · Incomplete scan
Skill
building-vulnerability-scanning-workflow
mukul975/Anthropic-Cybersecurity-Skills · skills/building-vulnerability-scanning-workflow
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-network-traffic-for-incidents
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-network-traffic-for-incidents
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-sbom-for-supply-chain-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-sbom-for-supply-chain-vulnerabilities
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-cyber-kill-chain
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-cyber-kill-chain
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.
Repository stars: 35,758 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
