[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEGH8JS3G8FMPKM729VT3F":3,"skill-same:01M6AEGH8JS3G8FMPKM729VT3F":133},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":74,"commitSha":75,"skillDirectory":76,"forksCount":77,"repositoryHtmlUrl":78,"repositoryHomepageUrl":79,"ownerHtmlUrl":80,"ownerBlogUrl":81,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M6AEGH8JS3G8FMPKM729VT3F","detecting-process-hollowing-technique",null,"Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon Event ID 25. Use when investigating a legitimate-looking process (svchost.exe, explorer.exe, rundll32.exe) suspected of hosting injected code via NtUnmapViewOfSection.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"detecting process hollowing technique","analyzing","t1055","process-hollowing","edr","detection","process-injection","proactive-detection","hardening","sysmon","memory","Volatility","threat-hunting","mitre-attack","monitoring","verification","code","plugin","telemetry","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-process-hollowing-technique\ndescription: Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped\n  sections, hollowed process indicators, and parent-child anomalies using EDR\n  telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon\n  Event ID 25. Use when investigating a legitimate-looking process (svchost.exe,\n  explorer.exe, rundll32.exe) suspected of hosting injected code via\n  NtUnmapViewOfSection.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- threat-hunting\n- mitre-attack\n- process-hollowing\n- process-injection\n- edr\n- t1055\n- proactive-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Platform Monitoring\n- Process Code Segment Verification\n- Segment Address Offset Randomization\n- Process Analysis\n- Application Hardening\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1055\n---\n\n# Detecting Process Hollowing Technique\n\n## When to Use\n\n- When investigating suspected fileless malware or in-memory threats\n- After EDR alerts on process injection or suspicious memory operations\n- When hunting for defense evasion techniques in a compromised environment\n- When threat intel reports indicate process hollowing in active campaigns\n- During purple team exercises validating T1055.012 detection coverage\n\n## Prerequisites\n\n- EDR with memory protection monitoring (CrowdStrike, MDE, SentinelOne)\n- Sysmon with Event IDs 1 (Process Create), 8 (CreateRemoteThread), 25 (ProcessTampering)\n- Windows ETW providers for process hollowing (Microsoft-Windows-Kernel-Process)\n- Memory forensics capabilities (Volatility, WinDbg)\n- Process integrity monitoring tools\n\n## Workflow\n\n1. **Understand Hollowing Mechanics**: Process hollowing involves creating a legitimate process in suspended state, unmapping its memory, writing malicious code, then resuming execution.\n2. **Monitor Suspended Process Creation**: Hunt for processes created with CREATE_SUSPENDED flag followed by memory writes and thread resumption.\n3. **Detect Memory Section Anomalies**: Identify processes where the in-memory image differs from the on-disk binary (image mismatch).\n4. **Analyze Parent-Child Process Trees**: Flag processes whose behavior does not match their binary name (e.g., svchost.exe making unusual network connections).\n5. **Check Process Integrity**: Compare process memory sections against the legitimate binary on disk.\n6. **Correlate with Network Activity**: Hollowed processes often establish C2 connections - correlate suspicious process behavior with network logs.\n7. **Document and Contain**: Report findings, isolate affected endpoints, and update detection rules.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1055.012 | Process Injection: Process Hollowing |\n| T1055 | Process Injection (parent technique) |\n| T1055.001 | DLL Injection |\n| T1055.003 | Thread Execution Hijacking |\n| T1055.004 | Asynchronous Procedure Call |\n| CREATE_SUSPENDED | Windows flag to create a process in suspended state |\n| NtUnmapViewOfSection | API to unmap process memory sections |\n| WriteProcessMemory | API to write into another process's memory |\n| ResumeThread | API to resume a suspended thread |\n| Image Mismatch | Process memory content differs from on-disk binary |\n| Process Doppelganging | Related technique using NTFS transactions (T1055.013) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | Memory protection and hollowing detection |\n| Microsoft Defender for Endpoint | ProcessTampering alerts |\n| Sysmon v13+ | Event ID 25 ProcessTampering detection |\n| Volatility | Memory forensics - malfind plugin |\n| pe-sieve | Process memory scanner for hollowed processes |\n| Hollows Hunter | Automated hollowed process detection |\n| Process Hacker | Live process memory inspection |\n| API Monitor | Monitor NtUnmapViewOfSection calls |\n\n## Common Scenarios\n\n1. **Svchost.exe Hollowing**: Malware creates svchost.exe suspended, hollows it, injects backdoor code - process appears legitimate but behaves maliciously.\n2. **Explorer.exe Hollowing**: Attacker hollows explorer.exe to inherit its network permissions and trusted process context.\n3. **Rundll32 Hollowing**: Malicious loader creates rundll32.exe, replaces its memory with implant code for C2 beaconing.\n4. **Multi-Stage Hollowing**: Loader uses process hollowing as first stage, then performs additional injection into services.\n\n## Output Format\n\n```\nHunt ID: TH-HOLLOW-[DATE]-[SEQ]\nTechnique: T1055.012\nHollowed Process: [Process name and PID]\nOriginal Binary: [Expected on-disk path]\nParent Process: [Parent name and PID]\nMemory Mismatch: [Yes\u002FNo]\nSuspicious APIs: [NtUnmapViewOfSection, WriteProcessMemory, etc.]\nNetwork Activity: [C2 connections if any]\nHost: [Hostname]\nUser: [Account context]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n","# Detecting Process Hollowing Technique\n\n## When to Use\n\n- When investigating suspected fileless malware or in-memory threats\n- After EDR alerts on process injection or suspicious memory operations\n- When hunting for defense evasion techniques in a compromised environment\n- When threat intel reports indicate process hollowing in active campaigns\n- During purple team exercises validating T1055.012 detection coverage\n\n## Prerequisites\n\n- EDR with memory protection monitoring (CrowdStrike, MDE, SentinelOne)\n- Sysmon with Event IDs 1 (Process Create), 8 (CreateRemoteThread), 25 (ProcessTampering)\n- Windows ETW providers for process hollowing (Microsoft-Windows-Kernel-Process)\n- Memory forensics capabilities (Volatility, WinDbg)\n- Process integrity monitoring tools\n\n## Workflow\n\n1. **Understand Hollowing Mechanics**: Process hollowing involves creating a legitimate process in suspended state, unmapping its memory, writing malicious code, then resuming execution.\n2. **Monitor Suspended Process Creation**: Hunt for processes created with CREATE_SUSPENDED flag followed by memory writes and thread resumption.\n3. **Detect Memory Section Anomalies**: Identify processes where the in-memory image differs from the on-disk binary (image mismatch).\n4. **Analyze Parent-Child Process Trees**: Flag processes whose behavior does not match their binary name (e.g., svchost.exe making unusual network connections).\n5. **Check Process Integrity**: Compare process memory sections against the legitimate binary on disk.\n6. **Correlate with Network Activity**: Hollowed processes often establish C2 connections - correlate suspicious process behavior with network logs.\n7. **Document and Contain**: Report findings, isolate affected endpoints, and update detection rules.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| T1055.012 | Process Injection: Process Hollowing |\n| T1055 | Process Injection (parent technique) |\n| T1055.001 | DLL Injection |\n| T1055.003 | Thread Execution Hijacking |\n| T1055.004 | Asynchronous Procedure Call |\n| CREATE_SUSPENDED | Windows flag to create a process in suspended state |\n| NtUnmapViewOfSection | API to unmap process memory sections |\n| WriteProcessMemory | API to write into another process's memory |\n| ResumeThread | API to resume a suspended thread |\n| Image Mismatch | Process memory content differs from on-disk binary |\n| Process Doppelganging | Related technique using NTFS transactions (T1055.013) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | Memory protection and hollowing detection |\n| Microsoft Defender for Endpoint | ProcessTampering alerts |\n| Sysmon v13+ | Event ID 25 ProcessTampering detection |\n| Volatility | Memory forensics - malfind plugin |\n| pe-sieve | Process memory scanner for hollowed processes |\n| Hollows Hunter | Automated hollowed process detection |\n| Process Hacker | Live process memory inspection |\n| API Monitor | Monitor NtUnmapViewOfSection calls |\n\n## Common Scenarios\n\n1. **Svchost.exe Hollowing**: Malware creates svchost.exe suspended, hollows it, injects backdoor code - process appears legitimate but behaves maliciously.\n2. **Explorer.exe Hollowing**: Attacker hollows explorer.exe to inherit its network permissions and trusted process context.\n3. **Rundll32 Hollowing**: Malicious loader creates rundll32.exe, replaces its memory with implant code for C2 beaconing.\n4. **Multi-Stage Hollowing**: Loader uses process hollowing as first stage, then performs additional injection into services.\n\n## Output Format\n\n```\nHunt ID: TH-HOLLOW-[DATE]-[SEQ]\nTechnique: T1055.012\nHollowed Process: [Process name and PID]\nOriginal Binary: [Expected on-disk path]\nParent Process: [Parent name and PID]\nMemory Mismatch: [Yes\u002FNo]\nSuspicious APIs: [NtUnmapViewOfSection, WriteProcessMemory, etc.]\nNetwork Activity: [C2 connections if any]\nHost: [Hostname]\nUser: [Account context]\nRisk Level: [Critical\u002FHigh\u002FMedium\u002FLow]\n```\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"nist_csf":57,"subdomain":41,"description":7,"mitre_attack":62,"d3fend_techniques":68},[41,42,32,35,33,31,36],"mahipal","1.0",[58,59,60,61],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05",[63,64,65,66,67],"T1046","T1057","T1082","T1083","T1055",[69,70,71,72,73],"Platform Monitoring","Process Code Segment Verification","Segment Address Offset Randomization","Process Analysis","Application Hardening","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-process-hollowing-technique",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-process-hollowing-technique",{"tool":90,"command":91},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-process-hollowing-technique",{"tool":93,"command":94},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-process-hollowing-technique","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002FSKILL.md",true,[98,104,109,115,119,123,129],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"assets\u002Ftemplate.md","ASSET","资产文件",972,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002Fassets\u002Ftemplate.md",{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002FLICENSE",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fapi-reference.md","REFERENCE","参考文档",1162,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002Freferences\u002Fapi-reference.md",{"path":116,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fstandards.md",3127,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002Freferences\u002Fstandards.md",{"path":120,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fworkflows.md",3819,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002Freferences\u002Fworkflows.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",4564,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002Fscripts\u002Fagent.py",{"path":130,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":131,"sourceHtmlUrl":132},"scripts\u002Fprocess.py",12220,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-process-hollowing-technique\u002Fscripts\u002Fprocess.py",[134,160,183,210,236,263],{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,143,144,145,146,48,147,148,149,45,150,151,152,153,154,155,156,157,158,159],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[166],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[168,156,169,170,146,171,48,149,44,172,173,174,175,176,177,178,179,180,181,182],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":193,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[189,192],{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[177,194,195,196,197,48,198,199,44,200,201,202,203,204,34,205,206,207,208,209],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[216],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,48,221,222,223,224,225,226,227,228,229,230,231,232,174,233,234,235],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[242],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[244,245,246,48,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":264,"name":265,"nameZh":6,"description":266,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":267,"categories":268,"keywords":270,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[269],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,271,48,272,273,274,275,276,277,278,33,205,279,206,280,281,282,283,284,285],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]