Anthropic-Cybersecurity-Skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 818 files.

• abusing-dpapi-for-credential-access

  Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from…

  skills/abusing-dpapi-for-credential-access/SKILL.md on GitHub (opens in a new tab)

• abusing-shadow-credentials-for-privesc

  Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during auth…

  skills/abusing-shadow-credentials-for-privesc/SKILL.md on GitHub (opens in a new tab)

• achieving-cmmc-level-2-compliance

  Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD c…

  skills/achieving-cmmc-level-2-compliance/SKILL.md on GitHub (opens in a new tab)

• acquiring-disk-image-with-dd-and-dcfldd

  Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings be…

  skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md on GitHub (opens in a new tab)

• analyzing-active-directory-acl-abuse

  Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths

  skills/analyzing-active-directory-acl-abuse/SKILL.md on GitHub (opens in a new tab)

• analyzing-android-malware-with-apktool

  Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection ru…

  skills/analyzing-android-malware-with-apktool/SKILL.md on GitHub (opens in a new tab)

• analyzing-api-gateway-access-logs

  Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

  skills/analyzing-api-gateway-access-logs/SKILL.md on GitHub (opens in a new tab)

• analyzing-apt-group-with-mitre-navigator

  Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.

  skills/analyzing-apt-group-with-mitre-navigator/SKILL.md on GitHub (opens in a new tab)

• analyzing-azure-activity-logs-for-threats

  Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.

  skills/analyzing-azure-activity-logs-for-threats/SKILL.md on GitHub (opens in a new tab)

• analyzing-bootkit-and-rootkit-samples

  Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware despite clear infection signs.

  skills/analyzing-bootkit-and-rootkit-samples/SKILL.md on GitHub (opens in a new tab)

• analyzing-browser-forensics-with-hindsight

  Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's w…

  skills/analyzing-browser-forensics-with-hindsight/SKILL.md on GitHub (opens in a new tab)

• analyzing-campaign-attribution-evidence

  Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

  skills/analyzing-campaign-attribution-evidence/SKILL.md on GitHub (opens in a new tab)

• analyzing-certificate-transparency-for-phishing

  Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

  skills/analyzing-certificate-transparency-for-phishing/SKILL.md on GitHub (opens in a new tab)

• analyzing-cloud-storage-access-patterns

  Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

  skills/analyzing-cloud-storage-access-patterns/SKILL.md on GitHub (opens in a new tab)

• analyzing-cobalt-strike-beacon-configuration

  Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.

  skills/analyzing-cobalt-strike-beacon-configuration/SKILL.md on GitHub (opens in a new tab)

• analyzing-cobaltstrike-malleable-c2-profiles

  Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.

  skills/analyzing-cobaltstrike-malleable-c2-profiles/SKILL.md on GitHub (opens in a new tab)

• analyzing-command-and-control-communication

  Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback domains, dead drops). Use after reverse engineering reveals network traffic needing protocol analysis or when building detection signatures for a framework like Cobalt Strike, Metasploit, or Sliver.

  skills/analyzing-command-and-control-communication/SKILL.md on GitHub (opens in a new tab)

• analyzing-cyber-kill-chain

  Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for req…

  skills/analyzing-cyber-kill-chain/SKILL.md on GitHub (opens in a new tab)

• analyzing-disk-image-with-autopsy

  Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.

  skills/analyzing-disk-image-with-autopsy/SKILL.md on GitHub (opens in a new tab)

• analyzing-dns-logs-for-exfiltration

  Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.

  skills/analyzing-dns-logs-for-exfiltration/SKILL.md on GitHub (opens in a new tab)

• analyzing-docker-container-forensics

  Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

  skills/analyzing-docker-container-forensics/SKILL.md on GitHub (opens in a new tab)

• analyzing-email-headers-for-phishing-investigation

  Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's sender domain was spoofed.

  skills/analyzing-email-headers-for-phishing-investigation/SKILL.md on GitHub (opens in a new tab)

• analyzing-ethereum-smart-contract-vulnerabilities

  Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.

  skills/analyzing-ethereum-smart-contract-vulnerabilities/SKILL.md on GitHub (opens in a new tab)

• analyzing-golang-malware-with-ghidra

  Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a st…

  skills/analyzing-golang-malware-with-ghidra/SKILL.md on GitHub (opens in a new tab)

• analyzing-heap-spray-exploitation

  Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

  skills/analyzing-heap-spray-exploitation/SKILL.md on GitHub (opens in a new tab)

• analyzing-indicators-of-compromise

  Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requ…

  skills/analyzing-indicators-of-compromise/SKILL.md on GitHub (opens in a new tab)

• analyzing-ios-app-security-with-objection

  Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

  skills/analyzing-ios-app-security-with-objection/SKILL.md on GitHub (opens in a new tab)

• analyzing-kubernetes-audit-logs

  Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: aud…

  skills/analyzing-kubernetes-audit-logs/SKILL.md on GitHub (opens in a new tab)

• analyzing-linux-audit-logs-for-intrusion

  Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport…

  skills/analyzing-linux-audit-logs-for-intrusion/SKILL.md on GitHub (opens in a new tab)

• analyzing-linux-elf-malware

  Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.

  skills/analyzing-linux-elf-malware/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• graphifyby Graphify-Labs Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Curs… 127k stars · 1 skill
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 97.3k stars · 13 skills
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 84.1k stars · 2 skills