[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFEP7H891BBCC7R34RDEHC":3,"skill-same:01M6AFEP7H891BBCC7R34RDEHC":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AFEP7H891BBCC7R34RDEHC","implementing-usb-device-control-policy",null,"Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"policy","implementing usb device control policy","data-loss-prevention","security","device-control","USB-control","intune","devices","prevention","t1547","t1059","cybersecurity","edr","endpoint","removable-media","endpoint-security","data","exfiltration","malware","pr","2026-11-10 10:12:30",false,"---\nname: implementing-usb-device-control-policy\ndescription: 'Implements USB device control policies to restrict unauthorized removable\n  media access on endpoints, preventing data exfiltration and malware introduction\n  via USB devices. Use when deploying device control via Group Policy, Intune, or\n  EDR platforms to enforce USB restrictions. Activates for requests involving USB\n  control, removable media policy, device control, or data loss prevention via USB.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- USB-control\n- device-control\n- data-loss-prevention\n- removable-media\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n- T1048\n---\n# Implementing USB Device Control Policy\n\n## When to Use\n\nUse this skill when:\n- Restricting USB storage devices to prevent data exfiltration or malware introduction\n- Implementing device control policies via GPO, Intune, or EDR device control modules\n- Creating USB whitelists for authorized devices while blocking all others\n- Meeting compliance requirements for removable media control (PCI DSS, HIPAA)\n\n**Do not use** for network-based DLP or cloud storage restrictions.\n\n## Prerequisites\n\n- Active Directory GPO or Microsoft Intune for policy deployment\n- Device Instance IDs of authorized USB devices\n- EDR with device control module (CrowdStrike, Microsoft Defender for Endpoint)\n- Understanding of USB device classes (mass storage, HID, printer, etc.)\n\n## Workflow\n\n### Step 1: Inventory Current USB Usage\n\n```powershell\n# Enumerate currently connected USB devices\nGet-PnpDevice -Class USB | Select-Object InstanceId, FriendlyName, Status\n\n# Query USB storage history from registry\nGet-ItemProperty \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\*\\*\" |\n  Select-Object FriendlyName, ContainerID, HardwareID\n\n# Collect USB usage across fleet (via EDR or scripts)\n# CrowdStrike: Investigate → USB Device Activity\n# MDE: DeviceEvents | where ActionType == \"UsbDriveMounted\"\n```\n\n### Step 2: Configure GPO Device Control\n\n```\nComputer Configuration → Administrative Templates → System → Removable Storage Access\n\n- All Removable Storage classes: Deny all access → Enabled\n  (Block read AND write for all removable storage)\n\nOR for granular control:\n- CD and DVD: Deny read access → Enabled\n- Removable Disks: Deny write access → Enabled (read-only USB)\n- Tape Drives: Deny all access → Enabled\n- WPD Devices: Deny all access → Enabled\n\nTo allow specific approved USB devices:\nComputer Configuration → Administrative Templates → System → Device Installation\n  → Device Installation Restrictions\n\n- Prevent installation of devices not described by other policy settings → Enabled\n- Allow installation of devices that match any of these device IDs → Enabled\n  Add approved Device IDs: USB\\VID_0781&PID_5583 (example: SanDisk Cruzer)\n```\n\n### Step 3: Deploy via Microsoft Defender for Endpoint\n\n```xml\n\u003C!-- MDE Device Control policy (XML format) -->\n\u003CPolicyGroups>\n  \u003CGroup Id=\"{d9a81dc0-1234-5678-9abc-def012345678}\"\n    Type=\"Device\" Name=\"Approved USB Devices\">\n    \u003CMatchClause>\n      \u003CMatchType>VID_PID\u003C\u002FMatchType>\n      \u003CMatchData>0781_5583\u003C\u002FMatchData> \u003C!-- SanDisk -->\n    \u003C\u002FMatchClause>\n  \u003C\u002FGroup>\n\u003C\u002FPolicyGroups>\n\n\u003CPolicyRules>\n  \u003CRule Id=\"{rule-guid}\" Name=\"Block unapproved USB storage\">\n    \u003CIncludedIdList>\n      \u003CPrimaryId>RemovableMediaDevices\u003C\u002FPrimaryId>\n    \u003C\u002FIncludedIdList>\n    \u003CExcludedIdList>\n      \u003CGroupId>{d9a81dc0-1234-5678-9abc-def012345678}\u003C\u002FGroupId>\n    \u003C\u002FExcludedIdList>\n    \u003CEntry>\n      \u003CType>Deny\u003C\u002FType>\n      \u003CAccessMask>63\u003C\u002FAccessMask> \u003C!-- All access -->\n      \u003COptions>4\u003C\u002FOptions> \u003C!-- Show notification -->\n    \u003C\u002FEntry>\n  \u003C\u002FRule>\n\u003C\u002FPolicyRules>\n```\n\n### Step 4: Audit and Monitor\n\n```\n# Monitor USB events in SIEM:\n# Windows Event ID 6416 - New external device recognized\n# Windows Event ID 4663 - File access on removable media\n# MDE: DeviceEvents where ActionType contains \"Usb\"\n\n# Generate USB activity reports monthly\n# Track: blocked attempts, approved device usage, exception requests\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **VID\u002FPID** | Vendor ID and Product ID that uniquely identify USB device models |\n| **Device Instance ID** | Unique identifier for a specific physical USB device |\n| **Device Control** | EDR\u002Fendpoint feature restricting device access based on type, vendor, or serial number |\n| **USB Class** | USB device category (mass storage 08h, HID 03h, printer 07h) |\n\n## Tools & Systems\n\n- **Microsoft Defender Device Control**: MDE module for USB restriction policies\n- **CrowdStrike Falcon Device Control**: EDR-based USB policy enforcement\n- **Group Policy (Removable Storage Access)**: Built-in Windows USB restriction via GPO\n- **Endpoint Protector**: Third-party device control and DLP solution\n\n## Common Pitfalls\n\n- **Blocking all USB without exception**: Keyboards and mice are USB HID devices. Block only mass storage class, not all USB.\n- **Not communicating policy to users**: USB blocks without user notification generate helpdesk tickets. Display a notification explaining the policy.\n- **Ignoring USB-C and Thunderbolt**: Modern devices use USB-C for docking, charging, and storage. Policies must distinguish between USB storage and USB peripherals.\n- **No approved device process**: Users with legitimate USB needs (presentations, field data collection) require an exception process with approved, encrypted devices.\n","# Implementing USB Device Control Policy\n\n## When to Use\n\nUse this skill when:\n- Restricting USB storage devices to prevent data exfiltration or malware introduction\n- Implementing device control policies via GPO, Intune, or EDR device control modules\n- Creating USB whitelists for authorized devices while blocking all others\n- Meeting compliance requirements for removable media control (PCI DSS, HIPAA)\n\n**Do not use** for network-based DLP or cloud storage restrictions.\n\n## Prerequisites\n\n- Active Directory GPO or Microsoft Intune for policy deployment\n- Device Instance IDs of authorized USB devices\n- EDR with device control module (CrowdStrike, Microsoft Defender for Endpoint)\n- Understanding of USB device classes (mass storage, HID, printer, etc.)\n\n## Workflow\n\n### Step 1: Inventory Current USB Usage\n\n```powershell\n# Enumerate currently connected USB devices\nGet-PnpDevice -Class USB | Select-Object InstanceId, FriendlyName, Status\n\n# Query USB storage history from registry\nGet-ItemProperty \"HKLM:\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\*\\*\" |\n  Select-Object FriendlyName, ContainerID, HardwareID\n\n# Collect USB usage across fleet (via EDR or scripts)\n# CrowdStrike: Investigate → USB Device Activity\n# MDE: DeviceEvents | where ActionType == \"UsbDriveMounted\"\n```\n\n### Step 2: Configure GPO Device Control\n\n```\nComputer Configuration → Administrative Templates → System → Removable Storage Access\n\n- All Removable Storage classes: Deny all access → Enabled\n  (Block read AND write for all removable storage)\n\nOR for granular control:\n- CD and DVD: Deny read access → Enabled\n- Removable Disks: Deny write access → Enabled (read-only USB)\n- Tape Drives: Deny all access → Enabled\n- WPD Devices: Deny all access → Enabled\n\nTo allow specific approved USB devices:\nComputer Configuration → Administrative Templates → System → Device Installation\n  → Device Installation Restrictions\n\n- Prevent installation of devices not described by other policy settings → Enabled\n- Allow installation of devices that match any of these device IDs → Enabled\n  Add approved Device IDs: USB\\VID_0781&PID_5583 (example: SanDisk Cruzer)\n```\n\n### Step 3: Deploy via Microsoft Defender for Endpoint\n\n```xml\n\u003C!-- MDE Device Control policy (XML format) -->\n\u003CPolicyGroups>\n  \u003CGroup Id=\"{d9a81dc0-1234-5678-9abc-def012345678}\"\n    Type=\"Device\" Name=\"Approved USB Devices\">\n    \u003CMatchClause>\n      \u003CMatchType>VID_PID\u003C\u002FMatchType>\n      \u003CMatchData>0781_5583\u003C\u002FMatchData> \u003C!-- SanDisk -->\n    \u003C\u002FMatchClause>\n  \u003C\u002FGroup>\n\u003C\u002FPolicyGroups>\n\n\u003CPolicyRules>\n  \u003CRule Id=\"{rule-guid}\" Name=\"Block unapproved USB storage\">\n    \u003CIncludedIdList>\n      \u003CPrimaryId>RemovableMediaDevices\u003C\u002FPrimaryId>\n    \u003C\u002FIncludedIdList>\n    \u003CExcludedIdList>\n      \u003CGroupId>{d9a81dc0-1234-5678-9abc-def012345678}\u003C\u002FGroupId>\n    \u003C\u002FExcludedIdList>\n    \u003CEntry>\n      \u003CType>Deny\u003C\u002FType>\n      \u003CAccessMask>63\u003C\u002FAccessMask> \u003C!-- All access -->\n      \u003COptions>4\u003C\u002FOptions> \u003C!-- Show notification -->\n    \u003C\u002FEntry>\n  \u003C\u002FRule>\n\u003C\u002FPolicyRules>\n```\n\n### Step 4: Audit and Monitor\n\n```\n# Monitor USB events in SIEM:\n# Windows Event ID 6416 - New external device recognized\n# Windows Event ID 4663 - File access on removable media\n# MDE: DeviceEvents where ActionType contains \"Usb\"\n\n# Generate USB activity reports monthly\n# Track: blocked attempts, approved device usage, exception requests\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **VID\u002FPID** | Vendor ID and Product ID that uniquely identify USB device models |\n| **Device Instance ID** | Unique identifier for a specific physical USB device |\n| **Device Control** | EDR\u002Fendpoint feature restricting device access based on type, vendor, or serial number |\n| **USB Class** | USB device category (mass storage 08h, HID 03h, printer 07h) |\n\n## Tools & Systems\n\n- **Microsoft Defender Device Control**: MDE module for USB restriction policies\n- **CrowdStrike Falcon Device Control**: EDR-based USB policy enforcement\n- **Group Policy (Removable Storage Access)**: Built-in Windows USB restriction via GPO\n- **Endpoint Protector**: Third-party device control and DLP solution\n\n## Common Pitfalls\n\n- **Blocking all USB without exception**: Keyboards and mice are USB HID devices. Block only mass storage class, not all USB.\n- **Not communicating policy to users**: USB blocks without user notification generate helpdesk tickets. Display a notification explaining the policy.\n- **Ignoring USB-C and Thunderbolt**: Modern devices use USB-C for docking, charging, and storage. Policies must distinguish between USB storage and USB peripherals.\n- **No approved device process**: Users with legitimate USB needs (presentations, field data collection) require an exception process with approved, encrypted devices.\n",{"name":5,"tags":49,"author":50,"domain":35,"license":15,"version":51,"nist_csf":52,"subdomain":39,"description":57,"mitre_attack":58},[37,29,28,26,38],"mahipal","1.0.0",[53,54,55,56],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.\n",[59,60,61,62,63],"T1055","T1547","T1059","T1036","T1048","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-usb-device-control-policy",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-usb-device-control-policy",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-usb-device-control-policy",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-usb-device-control-policy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",631,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",6248,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",666,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",680,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",8642,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",3523,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-usb-device-control-policy\u002Fscripts\u002Fprocess.py",[124,149,172,200,225,252],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[130],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[132,133,134,135,27,35,136,137,43,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,27,24,35,43,160,161,162,163,164,165,166,167,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,183,184,185,186,35,187,188,160,189,190,191,192,193,194,195,196,197,198,199],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[206],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,35,211,212,213,214,215,216,217,40,218,219,220,221,163,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,35,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,260,35,261,262,263,264,265,266,267,36,195,268,196,269,270,271,272,273,274],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]