mukul975/Anthropic-Cybersecurity-Skills

API Gateway Log Analysis parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect attack patterns such as BOLA, excessive data exposure, and injection attempts. Use it when investigating security incidents or building detection rules.

Abusing DPAPI for Credential Access extracts and decrypts Windows DPAPI-protected secrets using SharpDPAPI, Mimikatz, or Impacket. Use it during authorized red-team engagements after gaining a foothold or when triaging DPAPI blobs.

Achieving CMMC Level 2 Compliance guides defense contractors through scoping CUI and FCI, implementing the 110 NIST SP 800-171 controls, computing the SPRS score, and preparing for a C3PAO assessment. Use it when handling CUI under DoD contracts or responding to DFARS 7012/7019/7020/7021 requirements.

Add New Skill provides a structured template for creating cybersecurity-focused Claude Code skills aligned with MITRE ATT&CK and NIST CSF. Use it when documenting a new security capability for the agent.

Analyzing APT Group with MITRE Navigator queries ATT&CK data with attackcti, mitreattack-python, and stix2, then builds Navigator layers and heatmap overlays to compare APT group TTPs, identify detection gaps, and report threat intelligence.

Analyzing Active Directory ACL Abuse connects to a domain controller via ldap3 to parse security descriptors and detect dangerous ACL misconfigurations that enable attacks like privilege escalation.

Analyzing Android Malware with Apktool performs static analysis of Android APK files using apktool, jadx, and androguard to extract permissions, detect dangerous permission combinations, and identify suspicious API calls without executing the sample. Use it to triage a suspicious APK or build mobile malware detection rules.

Analyzing Cloud Storage Access Patterns detects abnormal access in AWS S3, GCS, and Azure Blob Storage via audit logs for after-hours bulk downloads, new-IP access, and API-call spikes. Use when investigating suspected cloud data exfiltration or building detection rules

Analyzing Cobalt Strike Malleable C2 Profiles extracts HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior from profile files and beacon payloads, then generates network detection signatures. Use when reverse-engineering profiles or building Beacon detections.

Analyzing Cyber Kill Chain maps observed adversary actions to the seven Lockheed Martin Cyber Kill Chain phases, identifies detection gaps, and recommends courses of action. Use it for post-incident analysis, layered defensive control design, and threat intelligence reporting.

Analyzing DNS Logs for Exfiltration detects data exfiltration via DNS tunneling by analyzing query logs for long subdomains, high entropy, anomalous query volumes, and known tunneling tools.

Analyzing Disk Image with Autopsy performs comprehensive forensic analysis of raw, E01, or AFF disk images using Autopsy and The Sleuth Kit to recover deleted files, examine metadata and embedded artifacts, search keywords, and build timelines. Use it when you need structured analysis or visual reports from forensic evidence.

Azure Activity Log Threat Analysis queries Azure Monitor activity logs and sign-in logs via the azure-monitor-query Python library to detect suspicious admin operations and sign-in anomalies. Use it when investigating security incidents or building threat hunting queries for Azure environments.

Bootkit and Rootkit Analysis analyzes bootkits and advanced rootkits infecting MBR, VBR, and UEFI firmware. Use it when investigating persistent firmware-level threats that survive OS reinstallation, performing boot sector acquisition, firmware analysis, memory forensics, and boot chain integrity verification.

Browser Forensics with Hindsight parses Chromium-based browser databases (Chrome, Edge, Brave, Opera, Vivaldi) to extract and correlate web activity artifacts into a unified timeline for incident response, insider-threat investigations, and criminal cases.

C2 Communication Analysis examines malware command-and-control traffic over HTTP, HTTPS, DNS, and custom protocols to identify beaconing patterns, decode message structure, map infrastructure, and attribute threat actors.

CT Log Phishing Detection monitors Certificate Transparency logs with crt.sh and Certstream to flag suspicious certificates and phishing domains. Use it for threat hunting, security monitoring, and early detection of lookalike domains.

Campaign Attribution Analysis evaluates cyber-campaign evidence to attribute an operation to a threat actor using the Diamond Model and Analysis of Competing Hypotheses. Use it when an incident investigation needs a defensible attribution confidence level.

Cobalt Strike Beacon Config Analysis extracts and decodes Cobalt Strike beacon configurations from PE files, shellcode, or memory dumps to reveal C2 servers, sleep intervals, jitter, watermark, and malleable C2 profile settings. Use it during incident response, threat hunting, or detection rule building.

Disk Image Acquisition creates forensically sound bit-for-bit disk images with dd or dcfldd on Linux, preserving evidence integrity through hash verification. Use when imaging suspect drives, USB devices, or memory cards for incident response or legal proceedings.

Docker Container Forensics provides a workflow to preserve and analyze compromised Docker containers, including image layer inspection, host artifact examination, and security configuration auditing. Use it during incident response or container security investigations.

Email Header Phishing Analysis parses raw email headers to trace delivery paths, verify sender authenticity, and detect spoofing or phishing indicators. Use it during incident response or phishing investigations to validate SPF, DKIM, and DMARC records and assess domain reputation.

Ethereum Smart Contract Security Analysis performs static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect vulnerabilities like reentrancy and integer overflows. Use it to audit contracts before deployment, investigate security incidents, or build detection rules for threat hunting.

Security Skill Improvement provides a structured way to submit improvement requests for existing cybersecurity skills. Use it to identify issues in agent code, API references, frontmatter, or ATT&CK mappings and propose specific changes.

Shadow Credentials Privilege Escalation abuses the msDS-KeyCredentialLink attribute to append an attacker-controlled key and recover the target's NT hash via PKINIT, enabling account takeover without resetting passwords when BloodHound shows write access over the attribute.