mitre-attack-agent-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 918 files.

• attack-ent-t1001-001-junk-data

  Analyze MITRE ATT&CK T1001.001 Junk Data in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1001.001, Junk Data, or enterprise ATT&CK. Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye S…

  enterprise/attack-ent-t1001-001-junk-data/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1001-002-steganography

  Analyze MITRE ATT&CK T1001.002 Steganography in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1001.002, Steganography, or enterprise ATT&CK. Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more diff…

  enterprise/attack-ent-t1001-002-steganography/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1001-003-protocol-or-service-impersonation

  Analyze MITRE ATT&CK T1001.003 Protocol or Service Impersonation in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1001.003, Protocol or Service Impersonation, or enterprise ATT&CK. Adversaries may impersonate legitimate protocols or web service traffic to di…

  enterprise/attack-ent-t1001-003-protocol-or-service-impersonation/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1001-data-obfuscation

  Analyze MITRE ATT&CK T1001 Data Obfuscation in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1001, Data Obfuscation, or enterprise ATT&CK. Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyD…

  enterprise/attack-ent-t1001-data-obfuscation/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-001-lsass-memory

  Analyze MITRE ATT&CK T1003.001 LSASS Memory in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.001, LSASS Memory, or enterprise ATT&CK. Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subs…

  enterprise/attack-ent-t1003-001-lsass-memory/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-002-security-account-manager

  Analyze MITRE ATT&CK T1003.002 Security Account Manager in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.002, Security Account Manager, or enterprise ATT&CK. Adversaries may attempt to extract credential material from the Security Account Manager (SAM)…

  enterprise/attack-ent-t1003-002-security-account-manager/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-003-ntds

  Analyze MITRE ATT&CK T1003.003 NTDS in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.003, NTDS, or enterprise ATT&CK. Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as…

  enterprise/attack-ent-t1003-003-ntds/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-004-lsa-secrets

  Analyze MITRE ATT&CK T1003.004 LSA Secrets in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.004, LSA Secrets, or enterprise ATT&CK. Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain…

  enterprise/attack-ent-t1003-004-lsa-secrets/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-005-cached-domain-credentials

  Analyze MITRE ATT&CK T1003.005 Cached Domain Credentials in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.005, Cached Domain Credentials, or enterprise ATT&CK. Adversaries may attempt to access cached domain credentials used to allow authentication to o…

  enterprise/attack-ent-t1003-005-cached-domain-credentials/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-006-dcsync

  Analyze MITRE ATT&CK T1003.006 DCSync in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.006, DCSync, or enterprise ATT&CK. Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application…

  enterprise/attack-ent-t1003-006-dcsync/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-007-proc-filesystem

  Analyze MITRE ATT&CK T1003.007 Proc Filesystem in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.007, Proc Filesystem, or enterprise ATT&CK. Adversaries may gather credentials from the proc filesystem or `/proc`.

  enterprise/attack-ent-t1003-007-proc-filesystem/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-008-etc-passwd-and-etc-shadow

  Analyze MITRE ATT&CK T1003.008 /etc/passwd and /etc/shadow in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.008, /etc/passwd and /etc/shadow, or enterprise ATT&CK. Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/s…

  enterprise/attack-ent-t1003-008-etc-passwd-and-etc-shadow/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1003-os-credential-dumping

  Analyze MITRE ATT&CK T1003 OS Credential Dumping in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003, OS Credential Dumping, or enterprise ATT&CK. Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the…

  enterprise/attack-ent-t1003-os-credential-dumping/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1005-data-from-local-system

  Analyze MITRE ATT&CK T1005 Data from Local System in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1005, Data from Local System, or enterprise ATT&CK. Adversaries may search local system sources, such as file systems, configuration files, local databases, vi…

  enterprise/attack-ent-t1005-data-from-local-system/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1006-direct-volume-access

  Analyze MITRE ATT&CK T1006 Direct Volume Access in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1006, Direct Volume Access, or enterprise ATT&CK. Adversaries may directly access a volume to bypass file access controls and file system monitoring.

  enterprise/attack-ent-t1006-direct-volume-access/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1007-system-service-discovery

  Analyze MITRE ATT&CK T1007 System Service Discovery in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1007, System Service Discovery, or enterprise ATT&CK. Adversaries may try to gather information about registered local system services.

  enterprise/attack-ent-t1007-system-service-discovery/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1008-fallback-channels

  Analyze MITRE ATT&CK T1008 Fallback Channels in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1008, Fallback Channels, or enterprise ATT&CK. Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessibl…

  enterprise/attack-ent-t1008-fallback-channels/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1010-application-window-discovery

  Analyze MITRE ATT&CK T1010 Application Window Discovery in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1010, Application Window Discovery, or enterprise ATT&CK. Adversaries may attempt to get a listing of open application windows.

  enterprise/attack-ent-t1010-application-window-discovery/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1011-001-exfiltration-over-bluetooth

  Analyze MITRE ATT&CK T1011.001 Exfiltration Over Bluetooth in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1011.001, Exfiltration Over Bluetooth, or enterprise ATT&CK. Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and con…

  enterprise/attack-ent-t1011-001-exfiltration-over-bluetooth/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1011-exfiltration-over-other-network-medi

  Analyze MITRE ATT&CK T1011 Exfiltration Over Other Network Medium in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1011, Exfiltration Over Other Network Medium, or enterprise ATT&CK. Adversaries may attempt to exfiltrate data over a different network medium…

  enterprise/attack-ent-t1011-exfiltration-over-other-network-medi/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1012-query-registry

  Analyze MITRE ATT&CK T1012 Query Registry in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1012, Query Registry, or enterprise ATT&CK. Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed sof…

  enterprise/attack-ent-t1012-query-registry/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1014-rootkit

  Analyze MITRE ATT&CK T1014 Rootkit in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1014, Rootkit, or enterprise ATT&CK. Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

  enterprise/attack-ent-t1014-rootkit/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1016-001-internet-connection-discovery

  Analyze MITRE ATT&CK T1016.001 Internet Connection Discovery in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1016.001, Internet Connection Discovery, or enterprise ATT&CK. Adversaries may check for Internet connectivity on compromised systems.

  enterprise/attack-ent-t1016-001-internet-connection-discovery/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1016-002-wi-fi-discovery

  Analyze MITRE ATT&CK T1016.002 Wi-Fi Discovery in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1016.002, Wi-Fi Discovery, or enterprise ATT&CK. Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised…

  enterprise/attack-ent-t1016-002-wi-fi-discovery/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1016-system-network-configuration-discove

  Analyze MITRE ATT&CK T1016 System Network Configuration Discovery in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1016, System Network Configuration Discovery, or enterprise ATT&CK. Adversaries may look for details about the network configuration and settin…

  enterprise/attack-ent-t1016-system-network-configuration-discove/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1018-remote-system-discovery

  Analyze MITRE ATT&CK T1018 Remote System Discovery in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1018, Remote System Discovery, or enterprise ATT&CK. Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical ident…

  enterprise/attack-ent-t1018-remote-system-discovery/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1020-001-traffic-duplication

  Analyze MITRE ATT&CK T1020.001 Traffic Duplication in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1020.001, Traffic Duplication, or enterprise ATT&CK. Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infras…

  enterprise/attack-ent-t1020-001-traffic-duplication/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1020-automated-exfiltration

  Analyze MITRE ATT&CK T1020 Automated Exfiltration in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1020, Automated Exfiltration, or enterprise ATT&CK. Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after…

  enterprise/attack-ent-t1020-automated-exfiltration/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1021-001-remote-desktop-protocol

  Analyze MITRE ATT&CK T1021.001 Remote Desktop Protocol in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1021.001, Remote Desktop Protocol, or enterprise ATT&CK. Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a com…

  enterprise/attack-ent-t1021-001-remote-desktop-protocol/SKILL.md on GitHub (opens in a new tab)

• attack-ent-t1021-002-smb-windows-admin-shares

  Analyze MITRE ATT&CK T1021.002 SMB/Windows Admin Shares in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1021.002, SMB/Windows Admin Shares, or enterprise ATT&CK. Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact wit…

  enterprise/attack-ent-t1021-002-smb-windows-admin-shares/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• superpowersby obra An agentic skills framework & software development methodology that works. 300k stars · 15 skills
• skillsby mattpocock Skills for Real Engineers. Straight from my .agents directory. 293k stars · 30 skills
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 280k stars · 30 skills
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 270k stars · 1 skill
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 220k stars · 1 skill
• skillsby anthropics Public repository for Agent Skills 181k stars · 19 skills