[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEVCED0W4Y36KSDM3MPBC6":3,"skill-same:01M6AEVCED0W4Y36KSDM3MPBC6":149},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AEVCED0W4Y36KSDM3MPBC6","hunting-for-defense-evasion-via-timestomping",null,"Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-defense-evasion-via-timestomping\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"hunting for defense evasion via timestomping","defense","mft","mft-analysis","ntfs-forensics","timestomping","defense-evasion","hardening","ntfs","python","threat-hunting","forensics","file","metadata","content","verification","validation","cybersecurity","2026-11-10 10:12:30",false,"---\nname: hunting-for-defense-evasion-via-timestomping\ndescription: 'Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION\n  vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files\n  with anomalous temporal patterns indicating anti-forensic timestomping activity.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- timestomping\n- ntfs-forensics\n- mft-analysis\n- defense-evasion\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\n- Platform Hardening\n- File Format Verification\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmitre_attack:\n- T1046\n- T1057\n- T1082\n- T1083\n- T1027\n---\n\n# Hunting for Defense Evasion via Timestomping\n\nDetect timestamp manipulation by analyzing NTFS MFT entries for\ndiscrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.\n\n## When to Use\n\n- Investigating suspected anti-forensic activity where an adversary may have altered file timestamps to blend malware into legitimate directories\n- Threat hunting for defense evasion (MITRE ATT&CK T1070.006) across compromised Windows systems\n- Validating timeline integrity during forensic examinations of disk images or live acquisitions\n- Triaging suspicious files that appear to have creation dates older than the OS installation or inconsistent with known deployment timelines\n- Detecting tools like Timestomp (Metasploit), NTimeStomp, SetMACE, or PowerShell Set-ItemProperty used to alter timestamps\n- Building automated detection pipelines that flag temporal anomalies in MFT data for SOC analysts\n\n**Do not use** as the sole detection method; advanced adversaries can manipulate both $STANDARD_INFORMATION and $FILE_NAME timestamps (though the latter requires raw disk access and is much harder). Combine with USN Journal, $LogFile, and ShimCache\u002FAmcache analysis for corroboration.\n\n## Prerequisites\n\n- Raw $MFT file extracted from a Windows system (via FTK Imager, KAPE, or live extraction)\n- `MFTECmd` (Eric Zimmerman tool) or `analyzeMFT` for MFT parsing\n- Python 3.8+ with `pandas` for analysis\n- Optional: `mft` Python library (`pip install mft`) for programmatic MFT parsing\n- Optional: KAPE (Kroll Artifact Parser and Extractor) for automated artifact collection\n- Timeline Explorer or Excel for visual analysis of parsed MFT output\n\n## Workflow\n\n### Step 1: Extract the $MFT from a Live System or Disk Image\n\n```powershell\n# Method 1: Using KAPE to collect MFT and related artifacts\n.\\kape.exe --tsource C: --tdest D:\\Evidence\\MFT_Collection --target !SANS_Triage\n\n# Method 2: Using FTK Imager CLI to extract $MFT\nftkimager.exe \\\\.\\C: D:\\Evidence\\mft_raw.bin --e01 --include $MFT\n\n# Method 3: Raw copy using RawCopy (handles locked NTFS system files)\nRawCopy.exe \u002FFileNamePath:C:0 \u002FOutputPath:D:\\Evidence\\ \u002FOutputName:$MFT\n```\n\n```bash\n# Method 4: On a mounted forensic image in Linux\nsudo mount -o ro,norecovery \u002Fdev\u002Fsdb1 \u002Fmnt\u002Fevidence\nsudo icat -o 2048 \u002Fdev\u002Fsdb 0 > \u002Fmnt\u002Foutput\u002F$MFT\n\n# Method 5: Using sleuthkit to extract MFT from disk image\nicat -o 2048 evidence.E01 0 > extracted_MFT\n```\n\n### Step 2: Parse the MFT with MFTECmd\n\nUse Eric Zimmerman's MFTECmd to produce a CSV with both $STANDARD_INFORMATION and $FILE_NAME timestamps:\n\n```powershell\n# Parse MFT to CSV with all timestamp columns\nMFTECmd.exe -f \"D:\\Evidence\\$MFT\" --csv D:\\Evidence\\Parsed\\ --csvf mft_parsed.csv\n\n# The output CSV contains these critical columns:\n# Created0x10         - $STANDARD_INFORMATION Created timestamp\n# LastModified0x10    - $STANDARD_INFORMATION Modified timestamp\n# LastAccess0x10      - $STANDARD_INFORMATION Accessed timestamp\n# LastRecordChange0x10 - $STANDARD_INFORMATION Entry Modified timestamp\n# Created0x30         - $FILE_NAME Created timestamp\n# LastModified0x30    - $FILE_NAME Modified timestamp\n# LastAccess0x30      - $FILE_NAME Accessed timestamp\n# LastRecordChange0x30 - $FILE_NAME Entry Modified timestamp\n```\n\n### Step 3: Detect Timestomping via SI vs FN Comparison\n\nThe core detection: $STANDARD_INFORMATION timestamps are easily modified by user-mode tools, but $FILE_NAME timestamps are updated only by the NTFS driver (kernel-mode). When SI timestamps are OLDER than FN timestamps, timestomping is likely:\n\n```python\nimport pandas as pd\nfrom datetime import datetime, timedelta\n\ndef load_mft_data(csv_path):\n    \"\"\"Load MFTECmd parsed CSV output.\"\"\"\n    df = pd.read_csv(csv_path, low_memory=False)\n\n    # Parse timestamp columns\n    timestamp_cols = [\n        \"Created0x10\", \"LastModified0x10\", \"LastAccess0x10\", \"LastRecordChange0x10\",\n        \"Created0x30\", \"LastModified0x30\", \"LastAccess0x30\", \"LastRecordChange0x30\"\n    ]\n\n    for col in timestamp_cols:\n        if col in df.columns:\n            df[col] = pd.to_datetime(df[col], errors=\"coerce\")\n\n    return df\n\ndef detect_timestomping(df):\n    \"\"\"Detect timestamp manipulation by comparing SI and FN attributes.\n\n    Key indicators:\n    1. SI Created \u003C FN Created (SI timestamp pushed back in time)\n    2. SI timestamps have nanoseconds = 0000000 (tool artifact)\n    3. SI Created \u003C FN Entry Modified (impossible under normal NTFS behavior)\n    4. Large gap between SI and FN timestamps\n    \"\"\"\n    results = []\n\n    for idx, row in df.iterrows():\n        si_created = row.get(\"Created0x10\")\n        fn_created = row.get(\"Created0x30\")\n        si_modified = row.get(\"LastModified0x10\")\n        fn_modified = row.get(\"LastModified0x30\")\n        si_entry = row.get(\"LastRecordChange0x10\")\n        fn_entry = row.get(\"LastRecordChange0x30\")\n\n        if pd.isna(si_created) or pd.isna(fn_created):\n            continue\n\n        filepath = row.get(\"FileName\", \"unknown\")\n        parent_path = row.get(\"ParentPath\", \"\")\n        full_path = f\"{parent_path}\\\\{filepath}\" if parent_path else filepath\n        indicators = []\n\n        # Detection 1: SI Created is BEFORE FN Created\n        # Under normal NTFS operations, SI Created >= FN Created\n        if si_created \u003C fn_created:\n            delta = fn_created - si_created\n            indicators.append({\n                \"check\": \"SI_Created \u003C FN_Created\",\n                \"si_value\": str(si_created),\n                \"fn_value\": str(fn_created),\n                \"delta\": str(delta),\n                \"confidence\": \"high\"\n            })\n\n        # Detection 2: SI Modified is BEFORE FN Created\n        # A file cannot be modified before it was created\n        if pd.notna(si_modified) and si_modified \u003C fn_created:\n            indicators.append({\n                \"check\": \"SI_Modified \u003C FN_Created\",\n                \"si_value\": str(si_modified),\n                \"fn_value\": str(fn_created),\n                \"confidence\": \"high\"\n            })\n\n        # Detection 3: Nanosecond precision check\n        # Many timestomping tools set timestamps with zero nanoseconds\n        if pd.notna(si_created):\n            si_created_str = str(si_created)\n            if \".000000\" in si_created_str or si_created_str.endswith(\"00:00:00\"):\n                # Check if FN has normal nanosecond precision\n                fn_str = str(fn_created)\n                if \".000000\" not in fn_str:\n                    indicators.append({\n                        \"check\": \"SI_nanoseconds_zeroed\",\n                        \"si_value\": si_created_str,\n                        \"fn_value\": fn_str,\n                        \"confidence\": \"medium\"\n                    })\n\n        # Detection 4: Large time gap between SI and FN\n        # Normal gap is seconds to minutes, not years\n        if abs((si_created - fn_created).days) > 365:\n            indicators.append({\n                \"check\": \"SI_FN_gap_exceeds_1_year\",\n                \"si_value\": str(si_created),\n                \"fn_value\": str(fn_created),\n                \"delta_days\": abs((si_created - fn_created).days),\n                \"confidence\": \"high\"\n            })\n\n        # Detection 5: SI Entry Modified much later than SI Created\n        # Indicates the SI attribute was rewritten\n        if pd.notna(si_entry) and pd.notna(si_created):\n            entry_delta = si_entry - si_created\n            if entry_delta.days > 365 * 5:  # Entry modified years after creation\n                indicators.append({\n                    \"check\": \"SI_entry_modified_years_after_creation\",\n                    \"si_created\": str(si_created),\n                    \"si_entry_modified\": str(si_entry),\n                    \"confidence\": \"medium\"\n                })\n\n        if indicators:\n            results.append({\n                \"file_path\": full_path,\n                \"entry_number\": row.get(\"EntryNumber\", \"\"),\n                \"in_use\": row.get(\"InUse\", True),\n                \"si_created\": str(si_created),\n                \"fn_created\": str(fn_created),\n                \"indicators\": indicators,\n                \"highest_confidence\": max(i[\"confidence\"] for i in indicators),\n            })\n\n    return results\n\n# Run detection\ndf = load_mft_data(\"D:\\\\Evidence\\\\Parsed\\\\mft_parsed.csv\")\nstomped_files = detect_timestomping(df)\n\nprint(f\"\\nTimestomping Detection Results\")\nprint(f\"{'='*60}\")\nprint(f\"Total MFT entries analyzed: {len(df)}\")\nprint(f\"Suspicious entries found: {len(stomped_files)}\")\nprint()\n\nfor entry in sorted(stomped_files, key=lambda x: x[\"highest_confidence\"], reverse=True):\n    print(f\"[{entry['highest_confidence'].upper()}] {entry['file_path']}\")\n    print(f\"  SI Created: {entry['si_created']}\")\n    print(f\"  FN Created: {entry['fn_created']}\")\n    for ind in entry[\"indicators\"]:\n        print(f\"  Check: {ind['check']} (confidence: {ind['confidence']})\")\n    print()\n```\n\n### Step 4: Corroborate with USN Journal Analysis\n\nThe USN Journal records metadata change events that persist even after timestomping:\n\n```python\ndef correlate_with_usn_journal(stomped_files, usn_csv_path):\n    \"\"\"Cross-reference timestomped files with USN Journal entries.\n\n    The USN Journal records a BASIC_INFO_CHANGE reason when timestamps\n    are modified, providing corroborating evidence of timestomping.\n    \"\"\"\n    usn_df = pd.read_csv(usn_csv_path, low_memory=False)\n    usn_df[\"UpdateTimestamp\"] = pd.to_datetime(usn_df[\"UpdateTimestamp\"], errors=\"coerce\")\n\n    corroborated = []\n    for entry in stomped_files:\n        filename = entry[\"file_path\"].split(\"\\\\\")[-1]\n\n        # Find USN entries for this file with BASIC_INFO_CHANGE\n        usn_matches = usn_df[\n            (usn_df[\"Name\"] == filename) &\n            (usn_df[\"UpdateReasons\"].str.contains(\"BASIC_INFO_CHANGE\", na=False))\n        ]\n\n        if not usn_matches.empty:\n            entry[\"usn_corroboration\"] = True\n            entry[\"usn_change_times\"] = usn_matches[\"UpdateTimestamp\"].tolist()\n            entry[\"highest_confidence\"] = \"critical\"\n            corroborated.append(entry)\n            print(f\"[CORROBORATED] {filename} - USN Journal confirms \"\n                  f\"BASIC_INFO_CHANGE at {usn_matches['UpdateTimestamp'].iloc[0]}\")\n\n    return corroborated\n\n# Parse USN Journal (use MFTECmd or ANJP)\n# MFTECmd.exe -f \"$J\" --csv D:\\Evidence\\Parsed\\ --csvf usn_parsed.csv\n```\n\n### Step 5: Check ShimCache and Amcache for Timeline Validation\n\n```python\ndef check_shimcache_timeline(stomped_files, shimcache_csv):\n    \"\"\"Validate timestamps against ShimCache (AppCompatCache) entries.\n\n    ShimCache records the last modification time of executables\n    independently of NTFS timestamps, providing another corroboration point.\n    \"\"\"\n    shim_df = pd.read_csv(shimcache_csv, low_memory=False)\n    shim_df[\"LastModifiedTimeUTC\"] = pd.to_datetime(\n        shim_df[\"LastModifiedTimeUTC\"], errors=\"coerce\"\n    )\n\n    for entry in stomped_files:\n        filepath = entry[\"file_path\"]\n        shim_match = shim_df[\n            shim_df[\"Path\"].str.lower() == filepath.lower()\n        ]\n\n        if not shim_match.empty:\n            shim_time = shim_match[\"LastModifiedTimeUTC\"].iloc[0]\n            si_modified = pd.to_datetime(entry.get(\"si_created\"))\n\n            if pd.notna(shim_time) and pd.notna(si_modified):\n                delta = abs((shim_time - si_modified).days)\n                if delta > 30:\n                    entry[\"shimcache_mismatch\"] = True\n                    entry[\"shimcache_time\"] = str(shim_time)\n                    print(f\"[SHIMCACHE MISMATCH] {filepath}\")\n                    print(f\"  SI timestamp: {si_modified}\")\n                    print(f\"  ShimCache timestamp: {shim_time}\")\n                    print(f\"  Delta: {delta} days\")\n\n    return stomped_files\n```\n\n### Step 6: Generate a Timestomping Detection Report\n\n```python\nimport json\n\ndef generate_report(stomped_files, output_path):\n    \"\"\"Generate a structured JSON report of all timestomping detections.\"\"\"\n    report = {\n        \"report_title\": \"Timestomping Detection Analysis\",\n        \"generated_at\": datetime.utcnow().isoformat() + \"Z\",\n        \"mitre_technique\": \"T1070.006 - Indicator Removal: Timestomp\",\n        \"total_suspicious_files\": len(stomped_files),\n        \"critical_findings\": len([f for f in stomped_files if f[\"highest_confidence\"] == \"critical\"]),\n        \"high_findings\": len([f for f in stomped_files if f[\"highest_confidence\"] == \"high\"]),\n        \"medium_findings\": len([f for f in stomped_files if f[\"highest_confidence\"] == \"medium\"]),\n        \"findings\": stomped_files,\n    }\n\n    with open(output_path, \"w\") as f:\n        json.dump(report, f, indent=2, default=str)\n    print(f\"Report written to {output_path}\")\n    print(f\"  Critical: {report['critical_findings']}\")\n    print(f\"  High: {report['high_findings']}\")\n    print(f\"  Medium: {report['medium_findings']}\")\n\ngenerate_report(stomped_files, \"D:\\\\Evidence\\\\timestomping_report.json\")\n```\n\n## Verification\n\n- Confirm MFTECmd parses the $MFT without errors and produces both 0x10 (SI) and 0x30 (FN) timestamp columns\n- Create a test file and use a timestomping tool (e.g., NTimeStomp) in a lab to verify the detection logic catches the manipulation\n- Validate that the nanosecond-zeroed check does not produce excessive false positives on files created by installers that legitimately set timestamps\n- Cross-reference flagged files with the USN Journal to confirm BASIC_INFO_CHANGE events exist at the expected times\n- Verify ShimCache and Amcache timestamps provide independent corroboration of timeline inconsistencies\n- Test against known-clean system images to establish a false-positive baseline (some backup\u002Fimaging software legitimately resets timestamps)\n- Confirm the detection pipeline correctly handles deleted MFT entries (InUse=false) which may contain evidence of timestomped files that were later removed\n","# Hunting for Defense Evasion via Timestomping\n\nDetect timestamp manipulation by analyzing NTFS MFT entries for\ndiscrepancies between $STANDARD_INFORMATION and $FILE_NAME attributes.\n\n## When to Use\n\n- Investigating suspected anti-forensic activity where an adversary may have altered file timestamps to blend malware into legitimate directories\n- Threat hunting for defense evasion (MITRE ATT&CK T1070.006) across compromised Windows systems\n- Validating timeline integrity during forensic examinations of disk images or live acquisitions\n- Triaging suspicious files that appear to have creation dates older than the OS installation or inconsistent with known deployment timelines\n- Detecting tools like Timestomp (Metasploit), NTimeStomp, SetMACE, or PowerShell Set-ItemProperty used to alter timestamps\n- Building automated detection pipelines that flag temporal anomalies in MFT data for SOC analysts\n\n**Do not use** as the sole detection method; advanced adversaries can manipulate both $STANDARD_INFORMATION and $FILE_NAME timestamps (though the latter requires raw disk access and is much harder). Combine with USN Journal, $LogFile, and ShimCache\u002FAmcache analysis for corroboration.\n\n## Prerequisites\n\n- Raw $MFT file extracted from a Windows system (via FTK Imager, KAPE, or live extraction)\n- `MFTECmd` (Eric Zimmerman tool) or `analyzeMFT` for MFT parsing\n- Python 3.8+ with `pandas` for analysis\n- Optional: `mft` Python library (`pip install mft`) for programmatic MFT parsing\n- Optional: KAPE (Kroll Artifact Parser and Extractor) for automated artifact collection\n- Timeline Explorer or Excel for visual analysis of parsed MFT output\n\n## Workflow\n\n### Step 1: Extract the $MFT from a Live System or Disk Image\n\n```powershell\n# Method 1: Using KAPE to collect MFT and related artifacts\n.\\kape.exe --tsource C: --tdest D:\\Evidence\\MFT_Collection --target !SANS_Triage\n\n# Method 2: Using FTK Imager CLI to extract $MFT\nftkimager.exe \\\\.\\C: D:\\Evidence\\mft_raw.bin --e01 --include $MFT\n\n# Method 3: Raw copy using RawCopy (handles locked NTFS system files)\nRawCopy.exe \u002FFileNamePath:C:0 \u002FOutputPath:D:\\Evidence\\ \u002FOutputName:$MFT\n```\n\n```bash\n# Method 4: On a mounted forensic image in Linux\nsudo mount -o ro,norecovery \u002Fdev\u002Fsdb1 \u002Fmnt\u002Fevidence\nsudo icat -o 2048 \u002Fdev\u002Fsdb 0 > \u002Fmnt\u002Foutput\u002F$MFT\n\n# Method 5: Using sleuthkit to extract MFT from disk image\nicat -o 2048 evidence.E01 0 > extracted_MFT\n```\n\n### Step 2: Parse the MFT with MFTECmd\n\nUse Eric Zimmerman's MFTECmd to produce a CSV with both $STANDARD_INFORMATION and $FILE_NAME timestamps:\n\n```powershell\n# Parse MFT to CSV with all timestamp columns\nMFTECmd.exe -f \"D:\\Evidence\\$MFT\" --csv D:\\Evidence\\Parsed\\ --csvf mft_parsed.csv\n\n# The output CSV contains these critical columns:\n# Created0x10         - $STANDARD_INFORMATION Created timestamp\n# LastModified0x10    - $STANDARD_INFORMATION Modified timestamp\n# LastAccess0x10      - $STANDARD_INFORMATION Accessed timestamp\n# LastRecordChange0x10 - $STANDARD_INFORMATION Entry Modified timestamp\n# Created0x30         - $FILE_NAME Created timestamp\n# LastModified0x30    - $FILE_NAME Modified timestamp\n# LastAccess0x30      - $FILE_NAME Accessed timestamp\n# LastRecordChange0x30 - $FILE_NAME Entry Modified timestamp\n```\n\n### Step 3: Detect Timestomping via SI vs FN Comparison\n\nThe core detection: $STANDARD_INFORMATION timestamps are easily modified by user-mode tools, but $FILE_NAME timestamps are updated only by the NTFS driver (kernel-mode). When SI timestamps are OLDER than FN timestamps, timestomping is likely:\n\n```python\nimport pandas as pd\nfrom datetime import datetime, timedelta\n\ndef load_mft_data(csv_path):\n    \"\"\"Load MFTECmd parsed CSV output.\"\"\"\n    df = pd.read_csv(csv_path, low_memory=False)\n\n    # Parse timestamp columns\n    timestamp_cols = [\n        \"Created0x10\", \"LastModified0x10\", \"LastAccess0x10\", \"LastRecordChange0x10\",\n        \"Created0x30\", \"LastModified0x30\", \"LastAccess0x30\", \"LastRecordChange0x30\"\n    ]\n\n    for col in timestamp_cols:\n        if col in df.columns:\n            df[col] = pd.to_datetime(df[col], errors=\"coerce\")\n\n    return df\n\ndef detect_timestomping(df):\n    \"\"\"Detect timestamp manipulation by comparing SI and FN attributes.\n\n    Key indicators:\n    1. SI Created \u003C FN Created (SI timestamp pushed back in time)\n    2. SI timestamps have nanoseconds = 0000000 (tool artifact)\n    3. SI Created \u003C FN Entry Modified (impossible under normal NTFS behavior)\n    4. Large gap between SI and FN timestamps\n    \"\"\"\n    results = []\n\n    for idx, row in df.iterrows():\n        si_created = row.get(\"Created0x10\")\n        fn_created = row.get(\"Created0x30\")\n        si_modified = row.get(\"LastModified0x10\")\n        fn_modified = row.get(\"LastModified0x30\")\n        si_entry = row.get(\"LastRecordChange0x10\")\n        fn_entry = row.get(\"LastRecordChange0x30\")\n\n        if pd.isna(si_created) or pd.isna(fn_created):\n            continue\n\n        filepath = row.get(\"FileName\", \"unknown\")\n        parent_path = row.get(\"ParentPath\", \"\")\n        full_path = f\"{parent_path}\\\\{filepath}\" if parent_path else filepath\n        indicators = []\n\n        # Detection 1: SI Created is BEFORE FN Created\n        # Under normal NTFS operations, SI Created >= FN Created\n        if si_created \u003C fn_created:\n            delta = fn_created - si_created\n            indicators.append({\n                \"check\": \"SI_Created \u003C FN_Created\",\n                \"si_value\": str(si_created),\n                \"fn_value\": str(fn_created),\n                \"delta\": str(delta),\n                \"confidence\": \"high\"\n            })\n\n        # Detection 2: SI Modified is BEFORE FN Created\n        # A file cannot be modified before it was created\n        if pd.notna(si_modified) and si_modified \u003C fn_created:\n            indicators.append({\n                \"check\": \"SI_Modified \u003C FN_Created\",\n                \"si_value\": str(si_modified),\n                \"fn_value\": str(fn_created),\n                \"confidence\": \"high\"\n            })\n\n        # Detection 3: Nanosecond precision check\n        # Many timestomping tools set timestamps with zero nanoseconds\n        if pd.notna(si_created):\n            si_created_str = str(si_created)\n            if \".000000\" in si_created_str or si_created_str.endswith(\"00:00:00\"):\n                # Check if FN has normal nanosecond precision\n                fn_str = str(fn_created)\n                if \".000000\" not in fn_str:\n                    indicators.append({\n                        \"check\": \"SI_nanoseconds_zeroed\",\n                        \"si_value\": si_created_str,\n                        \"fn_value\": fn_str,\n                        \"confidence\": \"medium\"\n                    })\n\n        # Detection 4: Large time gap between SI and FN\n        # Normal gap is seconds to minutes, not years\n        if abs((si_created - fn_created).days) > 365:\n            indicators.append({\n                \"check\": \"SI_FN_gap_exceeds_1_year\",\n                \"si_value\": str(si_created),\n                \"fn_value\": str(fn_created),\n                \"delta_days\": abs((si_created - fn_created).days),\n                \"confidence\": \"high\"\n            })\n\n        # Detection 5: SI Entry Modified much later than SI Created\n        # Indicates the SI attribute was rewritten\n        if pd.notna(si_entry) and pd.notna(si_created):\n            entry_delta = si_entry - si_created\n            if entry_delta.days > 365 * 5:  # Entry modified years after creation\n                indicators.append({\n                    \"check\": \"SI_entry_modified_years_after_creation\",\n                    \"si_created\": str(si_created),\n                    \"si_entry_modified\": str(si_entry),\n                    \"confidence\": \"medium\"\n                })\n\n        if indicators:\n            results.append({\n                \"file_path\": full_path,\n                \"entry_number\": row.get(\"EntryNumber\", \"\"),\n                \"in_use\": row.get(\"InUse\", True),\n                \"si_created\": str(si_created),\n                \"fn_created\": str(fn_created),\n                \"indicators\": indicators,\n                \"highest_confidence\": max(i[\"confidence\"] for i in indicators),\n            })\n\n    return results\n\n# Run detection\ndf = load_mft_data(\"D:\\\\Evidence\\\\Parsed\\\\mft_parsed.csv\")\nstomped_files = detect_timestomping(df)\n\nprint(f\"\\nTimestomping Detection Results\")\nprint(f\"{'='*60}\")\nprint(f\"Total MFT entries analyzed: {len(df)}\")\nprint(f\"Suspicious entries found: {len(stomped_files)}\")\nprint()\n\nfor entry in sorted(stomped_files, key=lambda x: x[\"highest_confidence\"], reverse=True):\n    print(f\"[{entry['highest_confidence'].upper()}] {entry['file_path']}\")\n    print(f\"  SI Created: {entry['si_created']}\")\n    print(f\"  FN Created: {entry['fn_created']}\")\n    for ind in entry[\"indicators\"]:\n        print(f\"  Check: {ind['check']} (confidence: {ind['confidence']})\")\n    print()\n```\n\n### Step 4: Corroborate with USN Journal Analysis\n\nThe USN Journal records metadata change events that persist even after timestomping:\n\n```python\ndef correlate_with_usn_journal(stomped_files, usn_csv_path):\n    \"\"\"Cross-reference timestomped files with USN Journal entries.\n\n    The USN Journal records a BASIC_INFO_CHANGE reason when timestamps\n    are modified, providing corroborating evidence of timestomping.\n    \"\"\"\n    usn_df = pd.read_csv(usn_csv_path, low_memory=False)\n    usn_df[\"UpdateTimestamp\"] = pd.to_datetime(usn_df[\"UpdateTimestamp\"], errors=\"coerce\")\n\n    corroborated = []\n    for entry in stomped_files:\n        filename = entry[\"file_path\"].split(\"\\\\\")[-1]\n\n        # Find USN entries for this file with BASIC_INFO_CHANGE\n        usn_matches = usn_df[\n            (usn_df[\"Name\"] == filename) &\n            (usn_df[\"UpdateReasons\"].str.contains(\"BASIC_INFO_CHANGE\", na=False))\n        ]\n\n        if not usn_matches.empty:\n            entry[\"usn_corroboration\"] = True\n            entry[\"usn_change_times\"] = usn_matches[\"UpdateTimestamp\"].tolist()\n            entry[\"highest_confidence\"] = \"critical\"\n            corroborated.append(entry)\n            print(f\"[CORROBORATED] {filename} - USN Journal confirms \"\n                  f\"BASIC_INFO_CHANGE at {usn_matches['UpdateTimestamp'].iloc[0]}\")\n\n    return corroborated\n\n# Parse USN Journal (use MFTECmd or ANJP)\n# MFTECmd.exe -f \"$J\" --csv D:\\Evidence\\Parsed\\ --csvf usn_parsed.csv\n```\n\n### Step 5: Check ShimCache and Amcache for Timeline Validation\n\n```python\ndef check_shimcache_timeline(stomped_files, shimcache_csv):\n    \"\"\"Validate timestamps against ShimCache (AppCompatCache) entries.\n\n    ShimCache records the last modification time of executables\n    independently of NTFS timestamps, providing another corroboration point.\n    \"\"\"\n    shim_df = pd.read_csv(shimcache_csv, low_memory=False)\n    shim_df[\"LastModifiedTimeUTC\"] = pd.to_datetime(\n        shim_df[\"LastModifiedTimeUTC\"], errors=\"coerce\"\n    )\n\n    for entry in stomped_files:\n        filepath = entry[\"file_path\"]\n        shim_match = shim_df[\n            shim_df[\"Path\"].str.lower() == filepath.lower()\n        ]\n\n        if not shim_match.empty:\n            shim_time = shim_match[\"LastModifiedTimeUTC\"].iloc[0]\n            si_modified = pd.to_datetime(entry.get(\"si_created\"))\n\n            if pd.notna(shim_time) and pd.notna(si_modified):\n                delta = abs((shim_time - si_modified).days)\n                if delta > 30:\n                    entry[\"shimcache_mismatch\"] = True\n                    entry[\"shimcache_time\"] = str(shim_time)\n                    print(f\"[SHIMCACHE MISMATCH] {filepath}\")\n                    print(f\"  SI timestamp: {si_modified}\")\n                    print(f\"  ShimCache timestamp: {shim_time}\")\n                    print(f\"  Delta: {delta} days\")\n\n    return stomped_files\n```\n\n### Step 6: Generate a Timestomping Detection Report\n\n```python\nimport json\n\ndef generate_report(stomped_files, output_path):\n    \"\"\"Generate a structured JSON report of all timestomping detections.\"\"\"\n    report = {\n        \"report_title\": \"Timestomping Detection Analysis\",\n        \"generated_at\": datetime.utcnow().isoformat() + \"Z\",\n        \"mitre_technique\": \"T1070.006 - Indicator Removal: Timestomp\",\n        \"total_suspicious_files\": len(stomped_files),\n        \"critical_findings\": len([f for f in stomped_files if f[\"highest_confidence\"] == \"critical\"]),\n        \"high_findings\": len([f for f in stomped_files if f[\"highest_confidence\"] == \"high\"]),\n        \"medium_findings\": len([f for f in stomped_files if f[\"highest_confidence\"] == \"medium\"]),\n        \"findings\": stomped_files,\n    }\n\n    with open(output_path, \"w\") as f:\n        json.dump(report, f, indent=2, default=str)\n    print(f\"Report written to {output_path}\")\n    print(f\"  Critical: {report['critical_findings']}\")\n    print(f\"  High: {report['high_findings']}\")\n    print(f\"  Medium: {report['medium_findings']}\")\n\ngenerate_report(stomped_files, \"D:\\\\Evidence\\\\timestomping_report.json\")\n```\n\n## Verification\n\n- Confirm MFTECmd parses the $MFT without errors and produces both 0x10 (SI) and 0x30 (FN) timestamp columns\n- Create a test file and use a timestomping tool (e.g., NTimeStomp) in a lab to verify the detection logic catches the manipulation\n- Validate that the nanosecond-zeroed check does not produce excessive false positives on files created by installers that legitimately set timestamps\n- Cross-reference flagged files with the USN Journal to confirm BASIC_INFO_CHANGE events exist at the expected times\n- Verify ShimCache and Amcache timestamps provide independent corroboration of timeline inconsistencies\n- Test against known-clean system images to establish a false-positive baseline (some backup\u002Fimaging software legitimately resets timestamps)\n- Confirm the detection pipeline correctly handles deleted MFT entries (InUse=false) which may contain evidence of timestomped files that were later removed\n",{"name":5,"tags":47,"author":48,"domain":41,"license":15,"version":49,"nist_csf":50,"subdomain":34,"description":55,"mitre_attack":56,"d3fend_techniques":62},[29,28,27,30],"mahipal","1.0",[51,52,53,54],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05","Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.\n",[57,58,59,60,61],"T1046","T1057","T1082","T1083","T1027",[63,64,65,66,67],"File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fhunting-for-defense-evasion-via-timestomping",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-defense-evasion-via-timestomping",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-defense-evasion-via-timestomping",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill hunting-for-defense-evasion-via-timestomping","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-defense-evasion-via-timestomping\u002FSKILL.md",true,[92,97,103,107,111,115,119,123,127,131,137,141,145],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-defense-evasion-via-timestomping\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",1964,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-defense-evasion-via-timestomping\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fbest_practices.md",16071,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Fbest_practices.md",{"path":108,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fcallbacks.md",15540,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Fcallbacks.md",{"path":112,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fdata_module.md",14497,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Fdata_module.md",{"path":116,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fdistributed_training.md",14213,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Fdistributed_training.md",{"path":120,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Flightning_module.md",13728,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Flightning_module.md",{"path":124,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":125,"sourceHtmlUrl":126},"references\u002Flogging.md",14259,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Flogging.md",{"path":128,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":129,"sourceHtmlUrl":130},"references\u002Ftrainer.md",14784,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Freferences\u002Ftrainer.md",{"path":132,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":135,"sourceHtmlUrl":136},"scripts\u002Fagent.py","SCRIPT","脚本",8161,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-defense-evasion-via-timestomping\u002Fscripts\u002Fagent.py",{"path":138,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":139,"sourceHtmlUrl":140},"scripts\u002Fquick_trainer_setup.py",12985,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Fscripts\u002Fquick_trainer_setup.py",{"path":142,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":143,"sourceHtmlUrl":144},"scripts\u002Ftemplate_datamodule.py",9354,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Fscripts\u002Ftemplate_datamodule.py",{"path":146,"resourceType":133,"resourceTypeDesc":134,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Ftemplate_lightning_module.py",5886,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fscientific\u002Fpytorch-lightning\u002Fscripts\u002Ftemplate_lightning_module.py",[150,177,200,227,252,279],{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[156],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[158,159,160,161,162,41,163,164,165,166,167,168,169,170,171,172,173,174,175,176],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[185,173,186,187,162,188,41,165,39,189,190,191,192,193,194,195,196,197,198,199],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":210,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[206,209],{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[194,211,212,213,214,41,215,40,39,216,217,218,219,220,221,222,223,224,225,226],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[233],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,41,238,239,240,241,242,26,243,244,245,246,247,248,191,249,250,251],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[260,261,262,41,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":280,"name":281,"nameZh":6,"description":282,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":283,"categories":284,"keywords":286,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[285],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,287,41,288,36,289,290,291,292,293,294,222,295,223,296,297,298,299,300,301],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]