Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 124 · 50 results shown
Skill
performing-kerberoasting-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-kerberoasting-attack
Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, and cracks the NTLM-encrypted tickets offline to recover service account credentials. Use during authorized red team engagements or penetration tests to assess AD privilege escalation and credential access risk from weak service account passwords.
Repository stars: 35,763 · Incomplete scan
Skill
generating-forensic-timelines-with-hayabusa
mukul975/Anthropic-Cybersecurity-Skills · skills/generating-forensic-timelines-with-hayabusa
Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.
Repository stars: 35,763 · Incomplete scan
Skill
building-incident-timeline-with-timesketch
mukul975/Anthropic-Cybersecurity-Skills · skills/building-incident-timeline-with-timesketch
Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data (including Plaso output) for attack chain reconstruction and investigation documentation. Use when reconstructing the sequence of events during an incident investigation or when multiple analysts need to jointly tag, annotate, and search a shared DFIR timeline.
Repository stars: 35,763 · Incomplete scan
Skill
testing-for-sensitive-data-exposure
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-sensitive-data-exposure
Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.
Repository stars: 35,763 · Incomplete scan
Skill
analyzing-pdf-malware-with-pdfid
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-pdf-malware-with-pdfid
Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-log-forwarding-with-fluentd
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-log-forwarding-with-fluentd
Configures Fluent Bit as an endpoint log forwarder and Fluentd as the central aggregator for centralized log collection, routing, filtering, and enrichment, covering input plugins for syslog/file-tailing/application logs and output routing to Elasticsearch, S3, and Splunk. Use when setting up centralized log aggregation across distributed infrastructure or generating Fluent Bit/Fluentd configuration files for a new log pipeline.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-container-drift-at-runtime
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-container-drift-at-runtime
Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do not use for detecting breakout from the container to the host - use detecting-container-escape-attempts.
Repository stars: 35,763 · Incomplete scan
Skill
building-ransomware-playbook-with-cisa-framework
mukul975/Anthropic-Cybersecurity-Skills · skills/building-ransomware-playbook-with-cisa-framework
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-business-email-compromise-with-ai
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-business-email-compromise-with-ai
Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.
Repository stars: 35,763 · Incomplete scan
Skill
executing-active-directory-attack-simulation
mukul975/Anthropic-Cybersecurity-Skills · skills/executing-active-directory-attack-simulation
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
Repository stars: 35,763 · Incomplete scan
Skill
performing-hardware-security-module-integration
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-hardware-security-module-integration
Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface using python-pkcs11, performing key generation, signing, encryption, verification, and token/slot queries against SoftHSM2, AWS CloudHSM, or YubiHSM2. Use when implementing HSM-backed key management or validating HSM configuration for FIPS 140-2/3 compliance.
Repository stars: 35,763 · Incomplete scan
Skill
extracting-windows-event-logs-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/extracting-windows-event-logs-artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
Repository stars: 35,763 · Incomplete scan
Skill
performing-graphql-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-graphql-security-assessment
Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.
Repository stars: 35,763 · Incomplete scan
Skill
deploying-honeytokens-and-canarytokens
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-honeytokens-and-canarytokens
Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source Canarytokens project and alerts via email or webhook when a token is touched. Use for high-fidelity intrusion detection in low-telemetry areas like file shares or credential stores, or to catch credential dumping and data-theft staging.
Repository stars: 35,763 · Incomplete scan
Skill
executing-red-team-engagement-planning
mukul975/Anthropic-Cybersecurity-Skills · skills/executing-red-team-engagement-planning
Build the foundational red team engagement plan - scope definition, Rules of Engagement (restrictions, communication plan, emergency stop procedures, legal authorization), MITRE ATT&CK-aligned threat profile selection, and operational timelines - producing an engagement brief for stakeholder approval. Use before any offensive testing begins, when scoping a full-scope, assumed-breach, objective-based, or purple-team engagement.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-email-sandboxing-with-proofpoint
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-email-sandboxing-with-proofpoint
Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry
Repository stars: 35,763 · Incomplete scan
Skill
containing-active-breach
mukul975/Anthropic-Cybersecurity-Skills · skills/containing-active-breach
Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach. Implements short-term and long-term containment using network segmentation, endpoint isolation, credential revocation, and access control modifications. Activates for requests involving breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response.
Repository stars: 35,763 · Incomplete scan
Skill
performing-container-escape-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-container-escape-detection
Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - privileged flags, dangerous capability grants, host path mounts, shared namespaces, and CVE-2022-0492 style cgroup abuse. Use when sweeping a cluster for workloads that could break out, producing a posture report, or checking configuration before enforcement is switched on. Keywords: privileged, hostPath, hostPID, capabilities, CVE-2022-0492, cgroup, kubernetes python client, posture audit. Do not use for runtime syscall-based detection - use detecting-container-escape-attempts. '
Repository stars: 35,763 · Incomplete scan
Skill
hunting-for-persistence-mechanisms-in-windows
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-persistence-mechanisms-in-windows
Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions. Use when performing a broad persistence sweep during incident response or building SIEM detections that cover the full range of Windows persistence techniques (MITRE T1547).
Repository stars: 35,763 · Incomplete scan
Skill
detecting-ntlm-relay-with-event-correlation
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-ntlm-relay-with-event-correlation
Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.
Repository stars: 35,763 · Incomplete scan
Skill
conducting-memory-forensics-with-volatility
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-memory-forensics-with-volatility
Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-device-posture-assessment-in-zero-trust
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-device-posture-assessment-in-zero-trust
Implements device posture assessment as a zero trust access control by integrating endpoint health signals from CrowdStrike ZTA, Microsoft Intune, and Jamf into conditional access policies that enforce compliance before granting access. Use when requiring device health checks before app access, wiring posture signals into conditional access, or implementing the CISA Zero Trust device pillar.
Repository stars: 35,763 · Incomplete scan
Skill
managing-third-party-vendor-risk
mukul975/Anthropic-Cybersecurity-Skills · skills/managing-third-party-vendor-risk
Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors continuously, and offboard securely. Use when assessing a new vendor, standing up a vendor-risk program, tiering a portfolio, reviewing a SOC 2/CAIQ, or writing security terms into a contract.
Repository stars: 35,763 · Incomplete scan
Skill
performing-supply-chain-attack-simulation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-supply-chain-attack-simulation
Simulates and detects software supply chain attacks: typosquatting detection via Levenshtein distance against popular PyPI package names, dependency confusion testing against private registries, SHA-256 package hash verification, and known-CVE scanning with pip-audit. Use when auditing a project's dependencies for malicious or confused packages, or when assessing package-registry supply-chain risk.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-cloud-security-posture-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cloud-security-posture-management
Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center. Use for cross-cloud posture monitoring, CIS/SOC 2/PCI DSS compliance, or drift-detection workflows; not for runtime workload protection or application security testing.
Repository stars: 35,763 · Incomplete scan
Skill
performing-external-network-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-external-network-penetration-test
Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.
Repository stars: 35,763 · Incomplete scan
Skill
performing-iot-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-iot-security-assessment
Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debugging via UART and JTAG, network protocol analysis, and runtime exploitation to identify vulnerabilities across all layers of the IoT stack. Activates for requests involving IoT security testing, embedded device assessment, firmware security analysis, or smart device penetration testing.
Repository stars: 35,763 · Incomplete scan
Skill
defending-llms-with-guardrails
mukul975/Anthropic-Cybersecurity-Skills · skills/defending-llms-with-guardrails
Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspect and constrain LLM prompts and responses. Use when adding a production runtime safety layer to an LLM, RAG, or agent application to block jailbreaks, prompt injection (OWASP LLM01), toxic content, or sensitive-data leakage before it reaches or leaves the model.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-wmi-persistence
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-wmi-persistence
Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation, cross-referenced against root\subscription namespace contents and Sysinternals Autoruns. Use when hunting WMI-based persistence, triaging a Sysmon alert on these event IDs, or during incident response and purple-team validation of WMI defenses.
Repository stars: 35,763 · Incomplete scan
Skill
performing-lateral-movement-with-wmiexec
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-lateral-movement-with-wmiexec
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
Repository stars: 35,763 · Incomplete scan
Skill
recovering-from-ransomware-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/recovering-from-ransomware-attack
Executes structured ransomware incident recovery following NIST/CISA frameworks: environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized restoration from verified backups, credential reset, and Active Directory/database recovery in dependency order. Use when recovering from a ransomware attack, performing post-encryption restoration, or executing disaster recovery after ransomware encryption.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-soar-playbook-for-phishing
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-soar-playbook-for-phishing
Automates phishing incident response by calling the Splunk SOAR (Phantom) REST API to create containers, attach artifacts (emails, URLs, attachments), and trigger response playbooks. Use when building or wiring up a Splunk SOAR phishing playbook, ingesting a suspected phishing report into SOAR, or automating containment and triage for phishing incidents.
Repository stars: 35,763 · Incomplete scan
Skill
auditing-entra-id-with-aadinternals
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-entra-id-with-aadinternals
Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-prototype-pollution-in-javascript
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-prototype-pollution-in-javascript
Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through property injection into Object.prototype. Use when assessing a JavaScript/Node.js application for prototype pollution, especially where a merge, clone, or extend function accepts user-controlled keys.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-active-directory-certificate-services-esc1
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-active-directory-certificate-services-esc1
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-kerberoasting-with-impacket
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-kerberoasting-with-impacket
Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4/AES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.
Repository stars: 35,763 · Incomplete scan
Skill
emulating-cloud-attacks-with-stratus-red-team
mukul975/Anthropic-Cybersecurity-Skills · skills/emulating-cloud-attacks-with-stratus-red-team
Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle, then verify the telemetry they generate. Use to validate that cloud detections (CloudTrail, GuardDuty, Microsoft Sentinel, GCP SCC, Falco) actually fire, or to run a repeatable purple-team exercise generating realistic attacker telemetry.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-model-extraction-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-model-extraction-attacks
Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning/inversion/membership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-http-request-smuggling
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-http-request-smuggling
Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.
Repository stars: 35,763 · Incomplete scan
Skill
conducting-social-engineering-pretext-call
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-social-engineering-pretext-call
Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
Repository stars: 35,763 · Incomplete scan
Skill
extracting-config-from-agent-tesla-rat
mukul975/Anthropic-Cybersecurity-Skills · skills/extracting-config-from-agent-tesla-rat
Extracts embedded configuration from Agent Tesla RAT samples, including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation and memory analysis. Use when analyzing a suspected or confirmed Agent Tesla sample and you need to recover its exfiltration channel and C2 configuration for threat intelligence or incident response.
Repository stars: 35,763 · Incomplete scan
Skill
acquiring-disk-image-with-dd-and-dcfldd
mukul975/Anthropic-Cybersecurity-Skills · skills/acquiring-disk-image-with-dd-and-dcfldd
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-ticketing-system-for-incidents
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ticketing-system-for-incidents
Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-dmarc-dkim-spf-email-security
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-dmarc-dkim-spf-email-security
Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce a rejection/quarantine policy on unauthenticated mail, including auditing a domain's current DNS state. Use when hardening a domain's email security posture or defending against phishing and spoofing attacks.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-mobile-application-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-mobile-application-management
Implements Mobile Application Management (MAM) policies to protect enterprise data on managed and unmanaged mobile devices through app-level controls including data loss prevention, selective wipe, app configuration, and containerization. Use when securing corporate apps on BYOD devices, implementing Intune App Protection Policies, or enforcing data separation between personal and work apps. Activates for requests involving MAM deployment, app protection policies, mobile containerization, or BYOD security.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-excessive-data-exposure-in-api
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-excessive-data-exposure-in-api
Tests APIs for excessive data exposure (OWASP API3:2023) by intercepting raw API responses and comparing them against what the UI actually renders, looking for leaked PII, internal identifiers, debug data, or business-sensitive fields the frontend filters but the API still transmits. Use when auditing REST or mobile-app APIs for over-fetching, response filtering bypass, or unintended data leakage in endpoint responses.
Repository stars: 35,763 · Incomplete scan
Skill
parsing-artifacts-with-eric-zimmerman-tools
mukul975/Anthropic-Cybersecurity-Skills · skills/parsing-artifacts-with-eric-zimmerman-tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
Repository stars: 35,763 · Incomplete scan
Skill
building-threat-feed-aggregation-with-misp
mukul975/Anthropic-Cybersecurity-Skills · skills/building-threat-feed-aggregation-with-misp
Deploy MISP via Docker and configure feeds from sources like abuse.ch, AlienVault OTX, and CIRCL to aggregate, correlate, and distribute threat intelligence, including automated feed synchronization and STIX/TAXII-based integration with Splunk, Elasticsearch, and SOAR platforms. Use when standing up centralized IOC management or wiring multi-source threat feeds into a SIEM.
Repository stars: 35,763 · Incomplete scan
Skill
performing-ics-asset-discovery-with-claroty
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ics-asset-discovery-with-claroty
Performs ICS/OT asset discovery with Claroty xDome, combining passive monitoring and Claroty Edge active queries to inventory PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels. Use when gaining visibility into an undocumented OT environment, preparing an IEC 62443 asset inventory, or onboarding Claroty xDome; not for IT-only discovery.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-privileged-session-monitoring
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-privileged-session-monitoring
Implements privileged session monitoring and recording using PAM solutions, focusing on CyberArk Privileged Session Manager (PSM) and open-source alternatives, covering session recording configuration, keystroke logging, real-time monitoring, risk-based session analysis, and compliance audit trail generation. Use when configuring CyberArk PSM, recording administrator sessions, or building compliance audit trails for privileged access.
Repository stars: 35,763 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
