[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFGV6VY5HTJC0NT041DPM8":3,"skill-same:01M6AFGV6VY5HTJC0NT041DPM8":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":88,"commitSha":89,"skillDirectory":90,"forksCount":91,"repositoryHtmlUrl":92,"repositoryHomepageUrl":93,"ownerHtmlUrl":94,"ownerBlogUrl":95,"ownerDescription":96,"updatedAt":97,"install":98,"resources":111},"01M6AFGV6VY5HTJC0NT041DPM8","investigating-ransomware-attack-artifacts",null,"Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw\u002FHayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-ransomware-attack-artifacts\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ransomware","investigating ransomware attack artifacts","artifacts","encryption","cybersecurity","analysis","collection","initial-access","t1074","Tools","digital-forensics","cryptocurrency","notes","memory","evidence-collection","Volatility","phishing","malware","collect","vector","2026-11-10 10:12:30",false,"---\nname: investigating-ransomware-attack-artifacts\ndescription: Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw\u002FHayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- ransomware\n- malware-analysis\n- incident-response\n- encryption-recovery\n- evidence-collection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1486\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - stealth\n  - monetization\n  techniques:\n  - id: T1110\n    name: Brute Force\n    tactic: initial-access\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: T1070\n    name: Indicator Removal\n    tactic: stealth\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n  - id: F1017.001\n    name: 'Conversion to Physical Monetary Instruments: Cash'\n    tactic: monetization\n    source: f3\n---\n\n# Investigating Ransomware Attack Artifacts\n\n## When to Use\n- Immediately after discovering ransomware encryption on systems\n- When performing forensic analysis to understand the full scope of a ransomware incident\n- For identifying the ransomware variant and determining if decryption is possible\n- When tracing the attack chain from initial access to encryption\n- For documenting evidence to support law enforcement and insurance claims\n\n## Prerequisites\n- Forensic images of affected systems (preserve before remediation)\n- Memory dumps captured before system shutdown (if available)\n- Ransom notes and encrypted file samples\n- Network traffic captures from the attack period\n- Windows Event Logs, Prefetch files, and registry hives\n- Access to ransomware identification tools (ID Ransomware, No More Ransom)\n- Isolated sandbox environment for malware analysis\n\n## Workflow\n\n### Step 1: Preserve Evidence and Identify the Ransomware Variant\n\n```bash\n# CRITICAL: Do NOT restart systems. Preserve memory first if possible.\n# Encryption keys may still be in memory.\n\n# Capture memory from running systems\n# Windows: DumpIt.exe (generates memory.raw)\n# Linux: sudo insmod lime.ko \"path=\u002Fevidence\u002Fmemory.lime format=lime\"\n\n# Collect ransom note\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002FREADME*.txt \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002FDECRYPT*.txt \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002FHOW_TO*.txt \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.hta\" -o -name \"*DECRYPT*\" -o -name \"*RANSOM*\" -o -name \"*README*\" \\\n   2>\u002Fdev\u002Fnull | head -20 > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fnote_locations.txt\n\n# Collect sample encrypted files (for identification)\nfind \u002Fmnt\u002Fevidence\u002FUsers\u002F -name \"*.encrypted\" -o -name \"*.locked\" -o -name \"*.crypted\" \\\n   -o -name \"*.crypt\" -o -name \"*.enc\" | head -10 > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencrypted_samples.txt\n\n# Copy sample encrypted files\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsamples\u002F\nhead -5 \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencrypted_samples.txt | while read f; do\n    cp \"$f\" \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsamples\u002F\ndone\n\n# Identify ransomware variant using file extension and ransom note\npython3 \u003C\u003C 'PYEOF'\nimport os, hashlib, json\n\nransomware_indicators = {\n    '.lockbit': 'LockBit',\n    '.blackcat': 'BlackCat\u002FALPHV',\n    '.royal': 'Royal',\n    '.akira': 'Akira',\n    '.clop': 'Cl0p',\n    '.conti': 'Conti',\n    '.ryuk': 'Ryuk',\n    '.revil': 'REvil\u002FSodinokibi',\n    '.maze': 'Maze',\n    '.phobos': 'Phobos',\n    '.dharma': 'Dharma\u002FCrySIS',\n    '.stop': 'STOP\u002FDjvu',\n    '.hive': 'Hive',\n    '.blackbasta': 'Black Basta',\n    '.play': 'Play',\n}\n\n# Check encrypted file extensions\nsamples_dir = '\u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsamples\u002F'\nfor f in os.listdir(samples_dir):\n    ext = os.path.splitext(f)[1].lower()\n    variant = ransomware_indicators.get(ext, 'Unknown')\n    sha256 = hashlib.sha256(open(os.path.join(samples_dir, f), 'rb').read()).hexdigest()\n    print(f\"File: {f}\")\n    print(f\"  Extension: {ext}\")\n    print(f\"  Suspected Variant: {variant}\")\n    print(f\"  SHA-256: {sha256}\")\n    print()\n\n# Parse ransom note for IoCs\nnote_dir = '\u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F'\nfor note in os.listdir(note_dir):\n    with open(os.path.join(note_dir, note), 'r', errors='ignore') as f:\n        content = f.read()\n        print(f\"\\n=== Ransom Note: {note} ===\")\n        # Extract bitcoin addresses\n        import re\n        btc = re.findall(r'[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-zA-HJ-NP-Z0-9]{25,39}', content)\n        tor = re.findall(r'[a-z2-7]{56}\\.onion', content)\n        emails = re.findall(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}', content)\n\n        if btc: print(f\"  Bitcoin addresses: {btc}\")\n        if tor: print(f\"  Tor addresses: {tor}\")\n        if emails: print(f\"  Contact emails: {emails}\")\nPYEOF\n```\n\n### Step 2: Determine the Attack Timeline\n\n```bash\n# Find the earliest encrypted file (encryption start time)\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.encrypted\" -printf '%T+ %p\\n' 2>\u002Fdev\u002Fnull | sort | head -5 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencryption_start.txt\n\n# Find the latest encrypted file (encryption end time)\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.encrypted\" -printf '%T+ %p\\n' 2>\u002Fdev\u002Fnull | sort -r | head -5 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencryption_end.txt\n\n# Analyze Prefetch for ransomware executable\nls \u002Fmnt\u002Fevidence\u002FWindows\u002FPrefetch\u002F | grep -iE \"(encrypt|ransom|lock|crypt)\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fprefetch_hits.txt\n\n# Check Windows Event Logs for key events\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\n# Security log - authentication and access events\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\nattack_events = []\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n\n    # Key events for ransomware investigation\n    if event_id in ('4624', '4625', '4648', '4672', '4697', '4698', '4688', '1102'):\n        event_data = data['Event'].get('EventData', {})\n        attack_events.append({\n            'time': timestamp,\n            'event_id': event_id,\n            'data': json.dumps(event_data, default=str)[:200]\n        })\n\n# Sort and display timeline\nattack_events.sort(key=lambda x: x['time'])\nprint(\"=== RANSOMWARE ATTACK TIMELINE ===\\n\")\nfor event in attack_events[-50:]:\n    print(f\"  [{event['time']}] EventID {event['event_id']}: {event['data'][:150]}\")\nPYEOF\n\n# Check for Volume Shadow Copy deletion (common ransomware behavior)\n# Look for vssadmin.exe or wmic shadowcopy in event logs and Prefetch\ngrep -l \"vssadmin\" \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F*.evtx 2>\u002Fdev\u002Fnull\nls \u002Fmnt\u002Fevidence\u002FWindows\u002FPrefetch\u002F | grep -i \"vssadmin\\|wmic\\|bcdedit\\|wbadmin\"\n```\n\n### Step 3: Trace Initial Access and Lateral Movement\n\n```bash\n# Check for common ransomware initial access vectors\n\n# RDP brute force\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\nfrom collections import defaultdict\n\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\nfailed_rdp = defaultdict(int)\nsuccessful_rdp = []\n\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n    event_data = data['Event'].get('EventData', {})\n    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n\n    if event_id == '4625':  # Failed logon\n        logon_type = str(event_data.get('LogonType', ''))\n        if logon_type == '10':  # RDP\n            source_ip = event_data.get('IpAddress', 'Unknown')\n            failed_rdp[source_ip] += 1\n\n    if event_id == '4624':  # Successful logon\n        logon_type = str(event_data.get('LogonType', ''))\n        if logon_type in ('10', '3'):  # RDP or Network\n            source_ip = event_data.get('IpAddress', 'Unknown')\n            username = event_data.get('TargetUserName', 'Unknown')\n            successful_rdp.append({'time': timestamp, 'user': username, 'ip': source_ip, 'type': logon_type})\n\nprint(\"=== FAILED RDP ATTEMPTS ===\")\nfor ip, count in sorted(failed_rdp.items(), key=lambda x: x[1], reverse=True)[:10]:\n    print(f\"  {ip}: {count} failed attempts\")\n\nprint(f\"\\n=== SUCCESSFUL NETWORK\u002FRDP LOGONS ===\")\nfor logon in successful_rdp[-20:]:\n    type_name = 'RDP' if logon['type'] == '10' else 'Network'\n    print(f\"  [{logon['time']}] {logon['user']} from {logon['ip']} ({type_name})\")\nPYEOF\n\n# Check for phishing-related artifacts\n# Browser downloads, email attachments, Office macros\nfind \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDownloads\u002F -name \"*.exe\" -o -name \"*.dll\" -o -name \"*.js\" \\\n   -o -name \"*.vbs\" -o -name \"*.hta\" -o -name \"*.ps1\" 2>\u002Fdev\u002Fnull \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsuspicious_downloads.txt\n\n# Check PowerShell execution\nls \u002Fmnt\u002Fevidence\u002FWindows\u002FPrefetch\u002F | grep -i powershell\n```\n\n### Step 4: Assess Encryption Scope and Recovery Options\n\n```bash\n# Count encrypted files by directory\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.encrypted\" 2>\u002Fdev\u002Fnull | \\\n   awk -F\u002F '{OFS=\"\u002F\"; NF--; print}' | sort | uniq -c | sort -rn | head -20 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencryption_scope.txt\n\n# Check if Volume Shadow Copies survived\nvssadmin list shadows 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fvss_status.txt\n\n# Check for backup integrity\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.bak\" -o -name \"*.backup\" 2>\u002Fdev\u002Fnull | head -20\n\n# Check No More Ransom project for available decryptors\n# https:\u002F\u002Fwww.nomoreransom.org\u002Fen\u002Fdecryption-tools.html\necho \"Check https:\u002F\u002Fwww.nomoreransom.org\u002F for decryption tools\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fdecryption_options.txt\n\n# Attempt to recover encryption keys from memory dump\nif [ -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw ]; then\n    # Search for AES key schedules in memory\n    vol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n       --yara-rules 'rule AES_Key { strings: $aes = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 } condition: $aes }' \\\n       > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Faes_key_search.txt\n\n    # Search for RSA key material\n    vol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n       --yara-rules 'rule RSA_Key { strings: $rsa = \"RSA PRIVATE KEY\" condition: $rsa }' \\\n       > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Frsa_key_search.txt\nfi\n```\n\n### Step 5: Document Findings and Generate Report\n\n```bash\n# Generate comprehensive ransomware investigation report\ncat \u003C\u003C 'REPORT' > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Finvestigation_report.txt\nRANSOMWARE INCIDENT INVESTIGATION REPORT\n==========================================\nCase Number: 2024-001\nDate: $(date -u)\nAnalyst: [Examiner Name]\n\n1. INCIDENT OVERVIEW\n   - Ransomware Variant: [Identified variant]\n   - First Encryption: [Timestamp from earliest encrypted file]\n   - Last Encryption: [Timestamp from latest encrypted file]\n   - Systems Affected: [Count]\n   - Data Encrypted: [Volume estimate]\n\n2. INITIAL ACCESS VECTOR\n   - Method: [RDP brute force \u002F Phishing \u002F Exploit \u002F etc.]\n   - Entry Point: [System and IP]\n   - Timestamp: [First unauthorized access]\n   - Credentials Used: [Account names]\n\n3. ATTACK CHAIN\n   a. Initial Access: [Details]\n   b. Execution: [Ransomware binary details]\n   c. Persistence: [Services, scheduled tasks]\n   d. Privilege Escalation: [Method used]\n   e. Lateral Movement: [Systems accessed, methods]\n   f. Collection\u002FStaging: [Data staging before encryption]\n   g. Impact: [Encryption execution]\n\n4. INDICATORS OF COMPROMISE\n   - Ransomware Binary SHA-256: [Hash]\n   - C2 Servers: [IPs\u002FDomains]\n   - Bitcoin Wallet: [Address]\n   - Tor Site: [.onion address]\n   - Attacker IPs: [Source IPs]\n\n5. RECOVERY ASSESSMENT\n   - Decryptor Available: [Yes\u002FNo]\n   - Shadow Copies: [Survived\u002FDeleted]\n   - Backups: [Status and integrity]\n   - Memory Key Recovery: [Attempted\u002FResults]\n\n6. RECOMMENDATIONS\n   - [Remediation steps]\n   - [Prevention measures]\n   - [Monitoring improvements]\nREPORT\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Ransomware variant identification | Determining the specific ransomware family from extensions, notes, and behavior |\n| Double extortion | Attack combining encryption with data theft and threatened public release |\n| Volume Shadow Copies | Windows backup mechanism often deleted by ransomware to prevent recovery |\n| Encryption scope | Assessment of which files, directories, and systems were encrypted |\n| Dwell time | Period between initial access and ransomware deployment (often days to weeks) |\n| Ransom note IoCs | Bitcoin addresses, Tor sites, and email addresses in ransom demands |\n| Key recovery | Attempting to extract encryption keys from memory before shutdown |\n| No More Ransom | Law enforcement initiative providing free decryption tools for some variants |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| ID Ransomware | Online service identifying ransomware variant from samples |\n| No More Ransom | Free decryption tools from law enforcement partnerships |\n| Volatility | Memory forensics for encryption key and malware artifact recovery |\n| Chainsaw\u002FHayabusa | Windows Event Log analysis for attack timeline reconstruction |\n| PECmd | Prefetch analysis confirming ransomware executable execution |\n| YARA | Pattern matching for ransomware variant identification |\n| Any.Run\u002FJoe Sandbox | Online malware sandboxes for ransomware behavior analysis |\n| Capa | Mandiant tool identifying malware capabilities from static analysis |\n\n## Common Scenarios\n\n**Scenario 1: LockBit Attack via RDP**\nTrace initial access through RDP brute force in event logs, identify attacker IP and compromised account, follow lateral movement through network logons, find LockBit deployment via PsExec or GPO, document encryption timeline from file timestamps, check for data exfiltration before encryption.\n\n**Scenario 2: Phishing-Initiated Ransomware**\nTrace phishing email through browser history and email artifacts, identify malicious attachment execution in Prefetch, follow Cobalt Strike beacon communication in network logs, trace privilege escalation and domain compromise, document ransomware deployment across the network.\n\n**Scenario 3: Supply Chain Ransomware Attack**\nIdentify the compromised software update mechanism, trace the malicious update distribution in application logs, analyze the ransomware payload delivered via the trusted channel, assess which systems received the update, determine if the vendor was notified.\n\n**Scenario 4: Recovery from Partial Encryption**\nDetermine which systems and files were encrypted before containment, check for surviving volume shadow copies, verify backup integrity and restoration capability, attempt memory-based key recovery, contact law enforcement for potential decryptor availability.\n\n## Output Format\n\n```\nRansomware Investigation Summary:\n  Variant: LockBit 3.0\n  First Seen: 2024-01-18 02:00:00 UTC\n  Encryption Duration: 4 hours 23 minutes\n  Systems Encrypted: 45 out of 200 (containment stopped spread)\n\n  Attack Timeline:\n    2024-01-10 14:32 - RDP brute force from 203.0.113.45 (1,234 attempts)\n    2024-01-10 15:00 - Successful RDP login as admin_backup\n    2024-01-12 02:00 - Mimikatz executed (credential dump)\n    2024-01-12 02:30 - Domain Admin credentials obtained\n    2024-01-15 03:00 - Data exfiltration (45 GB to 185.x.x.x)\n    2024-01-18 02:00 - LockBit deployed via PsExec to 45 systems\n    2024-01-18 06:23 - Encryption completed on affected systems\n\n  Recovery Options:\n    Decryptor: Not available (LockBit 3.0)\n    Shadow Copies: Deleted on all systems\n    Backups: Last clean backup 2024-01-09 (9 days of data loss)\n    Memory Keys: Not recovered (systems rebooted)\n\n  IOCs:\n    Ransomware Hash: a1b2c3d4e5f6...\n    C2 IP: 185.x.x.x\n    Bitcoin: bc1q...\n    Tor: http:\u002F\u002Flockbit...onion\n```\n","# Investigating Ransomware Attack Artifacts\n\n## When to Use\n- Immediately after discovering ransomware encryption on systems\n- When performing forensic analysis to understand the full scope of a ransomware incident\n- For identifying the ransomware variant and determining if decryption is possible\n- When tracing the attack chain from initial access to encryption\n- For documenting evidence to support law enforcement and insurance claims\n\n## Prerequisites\n- Forensic images of affected systems (preserve before remediation)\n- Memory dumps captured before system shutdown (if available)\n- Ransom notes and encrypted file samples\n- Network traffic captures from the attack period\n- Windows Event Logs, Prefetch files, and registry hives\n- Access to ransomware identification tools (ID Ransomware, No More Ransom)\n- Isolated sandbox environment for malware analysis\n\n## Workflow\n\n### Step 1: Preserve Evidence and Identify the Ransomware Variant\n\n```bash\n# CRITICAL: Do NOT restart systems. Preserve memory first if possible.\n# Encryption keys may still be in memory.\n\n# Capture memory from running systems\n# Windows: DumpIt.exe (generates memory.raw)\n# Linux: sudo insmod lime.ko \"path=\u002Fevidence\u002Fmemory.lime format=lime\"\n\n# Collect ransom note\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002FREADME*.txt \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002FDECRYPT*.txt \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002FHOW_TO*.txt \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.hta\" -o -name \"*DECRYPT*\" -o -name \"*RANSOM*\" -o -name \"*README*\" \\\n   2>\u002Fdev\u002Fnull | head -20 > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fnote_locations.txt\n\n# Collect sample encrypted files (for identification)\nfind \u002Fmnt\u002Fevidence\u002FUsers\u002F -name \"*.encrypted\" -o -name \"*.locked\" -o -name \"*.crypted\" \\\n   -o -name \"*.crypt\" -o -name \"*.enc\" | head -10 > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencrypted_samples.txt\n\n# Copy sample encrypted files\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsamples\u002F\nhead -5 \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencrypted_samples.txt | while read f; do\n    cp \"$f\" \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsamples\u002F\ndone\n\n# Identify ransomware variant using file extension and ransom note\npython3 \u003C\u003C 'PYEOF'\nimport os, hashlib, json\n\nransomware_indicators = {\n    '.lockbit': 'LockBit',\n    '.blackcat': 'BlackCat\u002FALPHV',\n    '.royal': 'Royal',\n    '.akira': 'Akira',\n    '.clop': 'Cl0p',\n    '.conti': 'Conti',\n    '.ryuk': 'Ryuk',\n    '.revil': 'REvil\u002FSodinokibi',\n    '.maze': 'Maze',\n    '.phobos': 'Phobos',\n    '.dharma': 'Dharma\u002FCrySIS',\n    '.stop': 'STOP\u002FDjvu',\n    '.hive': 'Hive',\n    '.blackbasta': 'Black Basta',\n    '.play': 'Play',\n}\n\n# Check encrypted file extensions\nsamples_dir = '\u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsamples\u002F'\nfor f in os.listdir(samples_dir):\n    ext = os.path.splitext(f)[1].lower()\n    variant = ransomware_indicators.get(ext, 'Unknown')\n    sha256 = hashlib.sha256(open(os.path.join(samples_dir, f), 'rb').read()).hexdigest()\n    print(f\"File: {f}\")\n    print(f\"  Extension: {ext}\")\n    print(f\"  Suspected Variant: {variant}\")\n    print(f\"  SHA-256: {sha256}\")\n    print()\n\n# Parse ransom note for IoCs\nnote_dir = '\u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fransom_notes\u002F'\nfor note in os.listdir(note_dir):\n    with open(os.path.join(note_dir, note), 'r', errors='ignore') as f:\n        content = f.read()\n        print(f\"\\n=== Ransom Note: {note} ===\")\n        # Extract bitcoin addresses\n        import re\n        btc = re.findall(r'[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-zA-HJ-NP-Z0-9]{25,39}', content)\n        tor = re.findall(r'[a-z2-7]{56}\\.onion', content)\n        emails = re.findall(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}', content)\n\n        if btc: print(f\"  Bitcoin addresses: {btc}\")\n        if tor: print(f\"  Tor addresses: {tor}\")\n        if emails: print(f\"  Contact emails: {emails}\")\nPYEOF\n```\n\n### Step 2: Determine the Attack Timeline\n\n```bash\n# Find the earliest encrypted file (encryption start time)\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.encrypted\" -printf '%T+ %p\\n' 2>\u002Fdev\u002Fnull | sort | head -5 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencryption_start.txt\n\n# Find the latest encrypted file (encryption end time)\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.encrypted\" -printf '%T+ %p\\n' 2>\u002Fdev\u002Fnull | sort -r | head -5 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencryption_end.txt\n\n# Analyze Prefetch for ransomware executable\nls \u002Fmnt\u002Fevidence\u002FWindows\u002FPrefetch\u002F | grep -iE \"(encrypt|ransom|lock|crypt)\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fprefetch_hits.txt\n\n# Check Windows Event Logs for key events\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\n# Security log - authentication and access events\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\nattack_events = []\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n\n    # Key events for ransomware investigation\n    if event_id in ('4624', '4625', '4648', '4672', '4697', '4698', '4688', '1102'):\n        event_data = data['Event'].get('EventData', {})\n        attack_events.append({\n            'time': timestamp,\n            'event_id': event_id,\n            'data': json.dumps(event_data, default=str)[:200]\n        })\n\n# Sort and display timeline\nattack_events.sort(key=lambda x: x['time'])\nprint(\"=== RANSOMWARE ATTACK TIMELINE ===\\n\")\nfor event in attack_events[-50:]:\n    print(f\"  [{event['time']}] EventID {event['event_id']}: {event['data'][:150]}\")\nPYEOF\n\n# Check for Volume Shadow Copy deletion (common ransomware behavior)\n# Look for vssadmin.exe or wmic shadowcopy in event logs and Prefetch\ngrep -l \"vssadmin\" \u002Fcases\u002Fcase-2024-001\u002Fevtx\u002F*.evtx 2>\u002Fdev\u002Fnull\nls \u002Fmnt\u002Fevidence\u002FWindows\u002FPrefetch\u002F | grep -i \"vssadmin\\|wmic\\|bcdedit\\|wbadmin\"\n```\n\n### Step 3: Trace Initial Access and Lateral Movement\n\n```bash\n# Check for common ransomware initial access vectors\n\n# RDP brute force\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\nfrom collections import defaultdict\n\nparser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fevtx\u002FSecurity.evtx\")\n\nfailed_rdp = defaultdict(int)\nsuccessful_rdp = []\n\nfor record in parser.records_json():\n    data = json.loads(record['data'])\n    event_id = str(data['Event']['System']['EventID'])\n    event_data = data['Event'].get('EventData', {})\n    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n\n    if event_id == '4625':  # Failed logon\n        logon_type = str(event_data.get('LogonType', ''))\n        if logon_type == '10':  # RDP\n            source_ip = event_data.get('IpAddress', 'Unknown')\n            failed_rdp[source_ip] += 1\n\n    if event_id == '4624':  # Successful logon\n        logon_type = str(event_data.get('LogonType', ''))\n        if logon_type in ('10', '3'):  # RDP or Network\n            source_ip = event_data.get('IpAddress', 'Unknown')\n            username = event_data.get('TargetUserName', 'Unknown')\n            successful_rdp.append({'time': timestamp, 'user': username, 'ip': source_ip, 'type': logon_type})\n\nprint(\"=== FAILED RDP ATTEMPTS ===\")\nfor ip, count in sorted(failed_rdp.items(), key=lambda x: x[1], reverse=True)[:10]:\n    print(f\"  {ip}: {count} failed attempts\")\n\nprint(f\"\\n=== SUCCESSFUL NETWORK\u002FRDP LOGONS ===\")\nfor logon in successful_rdp[-20:]:\n    type_name = 'RDP' if logon['type'] == '10' else 'Network'\n    print(f\"  [{logon['time']}] {logon['user']} from {logon['ip']} ({type_name})\")\nPYEOF\n\n# Check for phishing-related artifacts\n# Browser downloads, email attachments, Office macros\nfind \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDownloads\u002F -name \"*.exe\" -o -name \"*.dll\" -o -name \"*.js\" \\\n   -o -name \"*.vbs\" -o -name \"*.hta\" -o -name \"*.ps1\" 2>\u002Fdev\u002Fnull \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fsuspicious_downloads.txt\n\n# Check PowerShell execution\nls \u002Fmnt\u002Fevidence\u002FWindows\u002FPrefetch\u002F | grep -i powershell\n```\n\n### Step 4: Assess Encryption Scope and Recovery Options\n\n```bash\n# Count encrypted files by directory\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.encrypted\" 2>\u002Fdev\u002Fnull | \\\n   awk -F\u002F '{OFS=\"\u002F\"; NF--; print}' | sort | uniq -c | sort -rn | head -20 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fencryption_scope.txt\n\n# Check if Volume Shadow Copies survived\nvssadmin list shadows 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fvss_status.txt\n\n# Check for backup integrity\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.bak\" -o -name \"*.backup\" 2>\u002Fdev\u002Fnull | head -20\n\n# Check No More Ransom project for available decryptors\n# https:\u002F\u002Fwww.nomoreransom.org\u002Fen\u002Fdecryption-tools.html\necho \"Check https:\u002F\u002Fwww.nomoreransom.org\u002F for decryption tools\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Fdecryption_options.txt\n\n# Attempt to recover encryption keys from memory dump\nif [ -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw ]; then\n    # Search for AES key schedules in memory\n    vol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n       --yara-rules 'rule AES_Key { strings: $aes = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 } condition: $aes }' \\\n       > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Faes_key_search.txt\n\n    # Search for RSA key material\n    vol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n       --yara-rules 'rule RSA_Key { strings: $rsa = \"RSA PRIVATE KEY\" condition: $rsa }' \\\n       > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Frsa_key_search.txt\nfi\n```\n\n### Step 5: Document Findings and Generate Report\n\n```bash\n# Generate comprehensive ransomware investigation report\ncat \u003C\u003C 'REPORT' > \u002Fcases\u002Fcase-2024-001\u002Fransomware\u002Finvestigation_report.txt\nRANSOMWARE INCIDENT INVESTIGATION REPORT\n==========================================\nCase Number: 2024-001\nDate: $(date -u)\nAnalyst: [Examiner Name]\n\n1. INCIDENT OVERVIEW\n   - Ransomware Variant: [Identified variant]\n   - First Encryption: [Timestamp from earliest encrypted file]\n   - Last Encryption: [Timestamp from latest encrypted file]\n   - Systems Affected: [Count]\n   - Data Encrypted: [Volume estimate]\n\n2. INITIAL ACCESS VECTOR\n   - Method: [RDP brute force \u002F Phishing \u002F Exploit \u002F etc.]\n   - Entry Point: [System and IP]\n   - Timestamp: [First unauthorized access]\n   - Credentials Used: [Account names]\n\n3. ATTACK CHAIN\n   a. Initial Access: [Details]\n   b. Execution: [Ransomware binary details]\n   c. Persistence: [Services, scheduled tasks]\n   d. Privilege Escalation: [Method used]\n   e. Lateral Movement: [Systems accessed, methods]\n   f. Collection\u002FStaging: [Data staging before encryption]\n   g. Impact: [Encryption execution]\n\n4. INDICATORS OF COMPROMISE\n   - Ransomware Binary SHA-256: [Hash]\n   - C2 Servers: [IPs\u002FDomains]\n   - Bitcoin Wallet: [Address]\n   - Tor Site: [.onion address]\n   - Attacker IPs: [Source IPs]\n\n5. RECOVERY ASSESSMENT\n   - Decryptor Available: [Yes\u002FNo]\n   - Shadow Copies: [Survived\u002FDeleted]\n   - Backups: [Status and integrity]\n   - Memory Key Recovery: [Attempted\u002FResults]\n\n6. RECOMMENDATIONS\n   - [Remediation steps]\n   - [Prevention measures]\n   - [Monitoring improvements]\nREPORT\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Ransomware variant identification | Determining the specific ransomware family from extensions, notes, and behavior |\n| Double extortion | Attack combining encryption with data theft and threatened public release |\n| Volume Shadow Copies | Windows backup mechanism often deleted by ransomware to prevent recovery |\n| Encryption scope | Assessment of which files, directories, and systems were encrypted |\n| Dwell time | Period between initial access and ransomware deployment (often days to weeks) |\n| Ransom note IoCs | Bitcoin addresses, Tor sites, and email addresses in ransom demands |\n| Key recovery | Attempting to extract encryption keys from memory before shutdown |\n| No More Ransom | Law enforcement initiative providing free decryption tools for some variants |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| ID Ransomware | Online service identifying ransomware variant from samples |\n| No More Ransom | Free decryption tools from law enforcement partnerships |\n| Volatility | Memory forensics for encryption key and malware artifact recovery |\n| Chainsaw\u002FHayabusa | Windows Event Log analysis for attack timeline reconstruction |\n| PECmd | Prefetch analysis confirming ransomware executable execution |\n| YARA | Pattern matching for ransomware variant identification |\n| Any.Run\u002FJoe Sandbox | Online malware sandboxes for ransomware behavior analysis |\n| Capa | Mandiant tool identifying malware capabilities from static analysis |\n\n## Common Scenarios\n\n**Scenario 1: LockBit Attack via RDP**\nTrace initial access through RDP brute force in event logs, identify attacker IP and compromised account, follow lateral movement through network logons, find LockBit deployment via PsExec or GPO, document encryption timeline from file timestamps, check for data exfiltration before encryption.\n\n**Scenario 2: Phishing-Initiated Ransomware**\nTrace phishing email through browser history and email artifacts, identify malicious attachment execution in Prefetch, follow Cobalt Strike beacon communication in network logs, trace privilege escalation and domain compromise, document ransomware deployment across the network.\n\n**Scenario 3: Supply Chain Ransomware Attack**\nIdentify the compromised software update mechanism, trace the malicious update distribution in application logs, analyze the ransomware payload delivered via the trusted channel, assess which systems received the update, determine if the vendor was notified.\n\n**Scenario 4: Recovery from Partial Encryption**\nDetermine which systems and files were encrypted before containment, check for surviving volume shadow copies, verify backup integrity and restoration capability, attempt memory-based key recovery, contact law enforcement for potential decryptor availability.\n\n## Output Format\n\n```\nRansomware Investigation Summary:\n  Variant: LockBit 3.0\n  First Seen: 2024-01-18 02:00:00 UTC\n  Encryption Duration: 4 hours 23 minutes\n  Systems Encrypted: 45 out of 200 (containment stopped spread)\n\n  Attack Timeline:\n    2024-01-10 14:32 - RDP brute force from 203.0.113.45 (1,234 attempts)\n    2024-01-10 15:00 - Successful RDP login as admin_backup\n    2024-01-12 02:00 - Mimikatz executed (credential dump)\n    2024-01-12 02:30 - Domain Admin credentials obtained\n    2024-01-15 03:00 - Data exfiltration (45 GB to 185.x.x.x)\n    2024-01-18 02:00 - LockBit deployed via PsExec to 45 systems\n    2024-01-18 06:23 - Encryption completed on affected systems\n\n  Recovery Options:\n    Decryptor: Not available (LockBit 3.0)\n    Shadow Copies: Deleted on all systems\n    Backups: Last clean backup 2024-01-09 (9 days of data loss)\n    Memory Keys: Not recovered (systems rebooted)\n\n  IOCs:\n    Ransomware Hash: a1b2c3d4e5f6...\n    C2 IP: 185.x.x.x\n    Bitcoin: bc1q...\n    Tor: http:\u002F\u002Flockbit...onion\n```\n",{"name":5,"tags":49,"author":54,"domain":28,"license":15,"version":55,"mitre_f3":56,"nist_csf":79,"subdomain":34,"description":7,"mitre_attack":83},[50,24,51,52,53,38],"forensics","malware-analysis","incident-response","encryption-recovery","mahipal","1.0",{"tactics":57,"version":60,"techniques":61},[31,58,59],"stealth","monetization","1.1",[62,66,69,72,76],{"id":63,"name":64,"source":65,"tactic":31},"T1110","Brute Force","attack",{"id":67,"name":68,"source":65,"tactic":31},"T1660","Phishing",{"id":70,"name":71,"source":65,"tactic":58},"T1070","Indicator Removal",{"id":73,"name":74,"source":75,"tactic":59},"F1018","Convert to Cryptocurrency","f3",{"id":77,"name":78,"source":75,"tactic":59},"F1017.001","Conversion to Physical Monetary Instruments: Cash",[80,81,82],"RS.AN-03","DE.AE-02","RS.MA-01",[84,85,86,70,87],"T1005","T1074","T1119","T1486","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Finvestigating-ransomware-attack-artifacts",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":99,"prompt":109,"zipAvailable":110},[100,103,106],{"tool":101,"command":102},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-ransomware-attack-artifacts",{"tool":104,"command":105},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-ransomware-attack-artifacts",{"tool":107,"command":108},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-ransomware-attack-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-ransomware-attack-artifacts\u002FSKILL.md",true,[112,117,123],{"path":113,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-ransomware-attack-artifacts\u002FLICENSE",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fapi-reference.md","REFERENCE","参考文档",2185,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-ransomware-attack-artifacts\u002Freferences\u002Fapi-reference.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",7924,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-ransomware-attack-artifacts\u002Fscripts\u002Fagent.py",[130,156,179,204,228,255],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[138,139,140,141,142,28,143,144,145,146,26,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,142,167,28,145,168,169,170,33,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,190,191,192,193,28,194,195,168,196,197,52,24,35,198,199,200,201,202,203],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,28,215,216,217,218,219,220,221,222,223,224,34,225,33,30,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,28,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,263,28,264,265,266,267,268,269,270,271,199,272,200,29,273,274,275,276,277],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]