Bootkit and Rootkit Analysis

Bootkit and Rootkit Analysis is a Quality skill for Claude Code, published by mukul975 in Anthropic-Cybersecurity-Skills.

27.8K stars3.4K forkson mukul975/Anthropic-Cybersecurity-SkillsAdded 2026/08/14Repository updated 2026/08/08

View source on GitHub Download repo ZIP

ai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hackingincident-responseinfosecllmmalware-analysismcpmitre-attacknist-csfosintpenetration-testingred-teamsecuritysecurity-automationthreat-huntingthreat-intelligence

Install in seconds

Install Bootkit and Rootkit Analysis

Copy Bootkit and Rootkit Analysis into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-bootkit-and-rootkit-samples ~/.claude/skills/analyzing-bootkit-and-rootkit-samples

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/analyzing-bootkit-and-rootkit-samples/SKILL.md in mukul975/Anthropic-Cybersecurity-Skills
Installs to: ~/.claude/skills/analyzing-bootkit-and-rootkit-samples
Collection: One of 25 skills cataloged from this repository
Category: Quality — 1354 skills

What Bootkit and Rootkit Analysis does

Bootkit and Rootkit Analysis analyzes bootkits and advanced rootkits infecting MBR, VBR, and UEFI firmware. Use it when investigating persistent firmware-level threats that survive OS reinstallation, performing boot sector acquisition, firmware analysis, memory forensics, and boot chain integrity verification.

Bootkit and Rootkit Analysis is cataloged under Quality on DirSkills. Bootkit and Rootkit Analysis comes from a repository tagged ai-agents, claude-code, cloud-security, cybersecurity and devsecops.

Documentation

README

Excerpt

Analyzing Bootkit and Rootkit Samples

When to Use

A system shows signs of compromise that persist through OS reinstallation
Antivirus and EDR are unable to detect malware despite clear evidence of compromise
UEFI Secure Boot has been disabled or shows integrity violations
Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)
Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)

Do not use for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.

Prerequisites

This is the opening of the README. Read the full README on GitHub.

Commands Bootkit and Rootkit Analysis provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/enum

Frequently asked about Bootkit and Rootkit Analysis

What else does mukul975 publish alongside Bootkit and Rootkit Analysis?
Bootkit and Rootkit Analysis is one of 25 skills that DirSkills catalogs from mukul975/Anthropic-Cybersecurity-Skills, the repository it ships in. Its siblings there include API Gateway Log Analysis, Abusing DPAPI for Credential Access and Achieving CMMC Level 2 Compliance. Each one is a separate skill with its own page in this directory, installs the same way Bootkit and Rootkit Analysis does, and is maintained by mukul975 in that same repository. The rest of the collection is listed on the mukul975/Anthropic-Cybersecurity-Skills page.
How does Bootkit and Rootkit Analysis compare to other Quality skills?
Bootkit and Rootkit Analysis ranks #106 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Bootkit and Rootkit Analysis against them. Open each page to compare what they document and how they install.