[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFMWFXH1SAPZPCMYWNBSBE":3,"skill-same:01M6AFMWFXH1SAPZPCMYWNBSBE":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AFMWFXH1SAPZPCMYWNBSBE","performing-authenticated-vulnerability-scan",null,"Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials to inspect installed software, patches, and configurations on Linux, Windows, and network devices. Use when a scan must catch vulnerabilities unauthenticated scanning misses, or when choosing and managing credential types for a credentialed scan.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing authenticated vulnerability scan","smb","credentials","winrm","authenticated-scanning","insightvm","rapid7","devices","risk","t1003","linux","openvas","qualys","nessus","vulnerability-management","network","cve","run","windows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-authenticated-vulnerability-scan\ndescription: Plan and run authenticated (credentialed) vulnerability scans with scanners such as\n  Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials\n  to inspect installed software, patches, and configurations on Linux, Windows, and network\n  devices. Use when a scan must catch vulnerabilities unauthenticated scanning misses, or when\n  choosing and managing credential types for a credentialed scan.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- vulnerability-management\n- cve\n- authenticated-scanning\n- credentials\n- nessus\n- qualys\n- risk\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n- T1003\n- T1110\n---\n# Performing Authenticated Vulnerability Scan\n\n## Overview\nAuthenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security settings. Compared to unauthenticated scanning, credentialed scans detect 45-60% more vulnerabilities with significantly fewer false positives because they can directly query installed packages, registry keys, and file system contents.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing authenticated vulnerability scan\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Vulnerability scanner (Nessus, Qualys, OpenVAS, Rapid7 InsightVM)\n- Service accounts with appropriate privileges on target systems\n- Secure credential storage (vault integration preferred)\n- Network access from scanner to target management ports\n- Written authorization from system owners\n\n## Core Concepts\n\n### Why Authenticated Scanning\nUnauthenticated scanning can only assess externally visible services and banners, often leading to:\n- Missed vulnerabilities in locally installed software\n- Inaccurate version detection from banner changes\n- Inability to check patch levels, configurations, or local policies\n- Higher false positive rates due to inference-based detection\n\nAuthenticated scanning resolves these by directly querying the target OS.\n\n### Credential Types by Platform\n\n#### Linux\u002FUnix Systems\n- **SSH Key Authentication**: RSA\u002FEd25519 key pairs (recommended)\n- **SSH Username\u002FPassword**: Fallback for systems without key-based auth\n- **Sudo\u002FSu Elevation**: Non-root user with sudo privileges\n- **Certificate-based SSH**: X.509 certificates for enterprise environments\n\n#### Windows Systems\n- **SMB (Windows)**: Domain or local admin credentials\n- **WMI**: Windows Management Instrumentation queries\n- **WinRM**: Windows Remote Management (HTTPS preferred)\n- **Kerberos**: Domain authentication with service tickets\n\n#### Network Devices\n- **SNMP v3**: USM with authentication and privacy (AES-256)\n- **SSH**: For Cisco IOS, Juniper JunOS, Palo Alto PAN-OS\n- **API Tokens**: REST API for modern network platforms\n\n#### Databases\n- **Oracle**: SYS\u002FSYSDBA credentials or TNS connection\n- **Microsoft SQL Server**: Windows auth or SQL auth\n- **PostgreSQL**: Role-based authentication\n- **MySQL**: User\u002Fpassword with SELECT privileges\n\n## Workflow\n\n### Step 1: Create Dedicated Service Accounts\n\n```bash\n# Linux: Create scan service account\nsudo useradd -m -s \u002Fbin\u002Fbash -c \"Vulnerability Scanner Service Account\" nessus_svc\nsudo usermod -aG sudo nessus_svc\n\n# Configure sudo for passwordless specific commands\necho 'nessus_svc ALL=(ALL) NOPASSWD: \u002Fusr\u002Fbin\u002Fdpkg -l, \u002Fusr\u002Fbin\u002Frpm -qa, \\\n\u002Fbin\u002Fcat \u002Fetc\u002Fshadow, \u002Fusr\u002Fsbin\u002Fdmidecode, \u002Fusr\u002Fbin\u002Ffind' | sudo tee \u002Fetc\u002Fsudoers.d\u002Fnessus_svc\n\n# Generate SSH key pair\nsudo -u nessus_svc ssh-keygen -t ed25519 -f \u002Fhome\u002Fnessus_svc\u002F.ssh\u002Fid_ed25519 -N \"\"\n\n# Distribute public key to targets\nfor host in $(cat target_hosts.txt); do\n    ssh-copy-id -i \u002Fhome\u002Fnessus_svc\u002F.ssh\u002Fid_ed25519.pub nessus_svc@$host\ndone\n```\n\n```powershell\n# Windows: Create scan service account via PowerShell\nNew-ADUser -Name \"SVC_VulnScan\" `\n    -SamAccountName \"SVC_VulnScan\" `\n    -UserPrincipalName \"SVC_VulnScan@domain.local\" `\n    -Description \"Vulnerability Scanner Service Account\" `\n    -PasswordNeverExpires $true `\n    -CannotChangePassword $true `\n    -Enabled $true `\n    -AccountPassword (Read-Host -AsSecureString \"Enter Password\")\n\n# Add to local Administrators group on targets via GPO or:\nAdd-ADGroupMember -Identity \"Domain Admins\" -Members \"SVC_VulnScan\"\n# For least privilege, use a dedicated GPO for local admin rights instead\n\n# Enable WinRM on targets\nEnable-PSRemoting -Force\nSet-Item WSMan:\\localhost\\Service\\AllowRemote -Value $true\nwinrm set winrm\u002Fconfig\u002Fservice '@{AllowUnencrypted=\"false\"}'\n```\n\n### Step 2: Configure Scanner Credentials\n\n#### Nessus Configuration\n```json\n{\n  \"credentials\": {\n    \"add\": {\n      \"Host\": {\n        \"SSH\": [{\n          \"auth_method\": \"public key\",\n          \"username\": \"nessus_svc\",\n          \"private_key\": \"\u002Fpath\u002Fto\u002Fid_ed25519\",\n          \"elevate_privileges_with\": \"sudo\",\n          \"escalation_account\": \"root\"\n        }],\n        \"Windows\": [{\n          \"auth_method\": \"Password\",\n          \"username\": \"DOMAIN\\\\SVC_VulnScan\",\n          \"password\": \"stored_in_vault\",\n          \"domain\": \"domain.local\"\n        }],\n        \"SNMPv3\": [{\n          \"username\": \"nessus_snmpv3\",\n          \"security_level\": \"authPriv\",\n          \"auth_algorithm\": \"SHA-256\",\n          \"auth_password\": \"stored_in_vault\",\n          \"priv_algorithm\": \"AES-256\",\n          \"priv_password\": \"stored_in_vault\"\n        }]\n      }\n    }\n  }\n}\n```\n\n### Step 3: Validate Credential Access\n\n```bash\n# Test SSH connectivity\nssh -i \u002Fpath\u002Fto\u002Fkey -o ConnectTimeout=10 nessus_svc@target_host \"uname -a && sudo dpkg -l | head -5\"\n\n# Test WinRM connectivity\npython3 -c \"\nimport winrm\ns = winrm.Session('target_host', auth=('DOMAIN\\\\\\\\SVC_VulnScan', 'password'), transport='ntlm')\nr = s.run_cmd('systeminfo')\nprint(r.std_out.decode())\n\"\n\n# Test SNMP v3 connectivity\nsnmpwalk -v3 -u nessus_snmpv3 -l authPriv -a SHA-256 -A authpass -x AES-256 -X privpass target_host sysDescr.0\n```\n\n### Step 4: Run Authenticated Scan\n\nConfigure and launch the scan using the Nessus API:\n```bash\n# Create scan with credentials\ncurl -k -X POST https:\u002F\u002Fnessus:8834\u002Fscans \\\n  -H \"X-Cookie: token=$TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"uuid\": \"'$TEMPLATE_UUID'\",\n    \"settings\": {\n      \"name\": \"Authenticated Scan - Production\",\n      \"text_targets\": \"192.168.1.0\u002F24\",\n      \"launch\": \"ON_DEMAND\"\n    },\n    \"credentials\": {\n      \"add\": {\n        \"Host\": {\n          \"SSH\": [{\"auth_method\": \"public key\", \"username\": \"nessus_svc\", \"private_key\": \"\u002Fkeys\u002Fid_ed25519\"}],\n          \"Windows\": [{\"auth_method\": \"Password\", \"username\": \"DOMAIN\\\\SVC_VulnScan\", \"password\": \"vault_ref\"}]\n        }\n      }\n    }\n  }'\n```\n\n### Step 5: Verify Credential Success\n\nAfter scan completion, check credential verification results:\n- **Plugin 19506** (Nessus Scan Information): Shows credential status\n- **Plugin 21745** (OS Security Patch Assessment): Confirms local checks\n- **Plugin 117887** (Local Security Checks): Credential verification\n- **Plugin 110385** (Nessus Credentialed Check): Target-level auth status\n\n## Credential Security Best Practices\n\n1. **Use a secrets vault** (HashiCorp Vault, CyberArk, AWS Secrets Manager) for credential storage\n2. **Rotate credentials** every 90 days or after personnel changes\n3. **Principle of least privilege** - only grant minimum required access\n4. **Audit credential usage** - monitor service account login events\n5. **Encrypt in transit** - use SSH keys over passwords, WinRM over HTTPS\n6. **Separate accounts** per scanner - never share credentials across tools\n7. **Disable interactive login** for scan service accounts where possible\n8. **Log all authentication** events for scan accounts in SIEM\n\n## Common Pitfalls\n- Using domain admin accounts instead of least-privilege service accounts\n- Storing credentials in plaintext scan configurations\n- Not testing credentials before scan launch (leads to wasted scan windows)\n- Forgetting to configure sudo\u002Felevation for Linux targets\n- Windows UAC blocking remote credentialed checks\n- Firewall rules blocking WMI\u002FWinRM\u002FSSH between scanner and targets\n- Credential lockout from multiple failed authentication attempts\n\n## Related Skills\n- scanning-infrastructure-with-nessus\n- performing-network-vulnerability-assessment\n- implementing-continuous-vulnerability-monitoring\n","# Performing Authenticated Vulnerability Scan\n\n## Overview\nAuthenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security settings. Compared to unauthenticated scanning, credentialed scans detect 45-60% more vulnerabilities with significantly fewer false positives because they can directly query installed packages, registry keys, and file system contents.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing authenticated vulnerability scan\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Vulnerability scanner (Nessus, Qualys, OpenVAS, Rapid7 InsightVM)\n- Service accounts with appropriate privileges on target systems\n- Secure credential storage (vault integration preferred)\n- Network access from scanner to target management ports\n- Written authorization from system owners\n\n## Core Concepts\n\n### Why Authenticated Scanning\nUnauthenticated scanning can only assess externally visible services and banners, often leading to:\n- Missed vulnerabilities in locally installed software\n- Inaccurate version detection from banner changes\n- Inability to check patch levels, configurations, or local policies\n- Higher false positive rates due to inference-based detection\n\nAuthenticated scanning resolves these by directly querying the target OS.\n\n### Credential Types by Platform\n\n#### Linux\u002FUnix Systems\n- **SSH Key Authentication**: RSA\u002FEd25519 key pairs (recommended)\n- **SSH Username\u002FPassword**: Fallback for systems without key-based auth\n- **Sudo\u002FSu Elevation**: Non-root user with sudo privileges\n- **Certificate-based SSH**: X.509 certificates for enterprise environments\n\n#### Windows Systems\n- **SMB (Windows)**: Domain or local admin credentials\n- **WMI**: Windows Management Instrumentation queries\n- **WinRM**: Windows Remote Management (HTTPS preferred)\n- **Kerberos**: Domain authentication with service tickets\n\n#### Network Devices\n- **SNMP v3**: USM with authentication and privacy (AES-256)\n- **SSH**: For Cisco IOS, Juniper JunOS, Palo Alto PAN-OS\n- **API Tokens**: REST API for modern network platforms\n\n#### Databases\n- **Oracle**: SYS\u002FSYSDBA credentials or TNS connection\n- **Microsoft SQL Server**: Windows auth or SQL auth\n- **PostgreSQL**: Role-based authentication\n- **MySQL**: User\u002Fpassword with SELECT privileges\n\n## Workflow\n\n### Step 1: Create Dedicated Service Accounts\n\n```bash\n# Linux: Create scan service account\nsudo useradd -m -s \u002Fbin\u002Fbash -c \"Vulnerability Scanner Service Account\" nessus_svc\nsudo usermod -aG sudo nessus_svc\n\n# Configure sudo for passwordless specific commands\necho 'nessus_svc ALL=(ALL) NOPASSWD: \u002Fusr\u002Fbin\u002Fdpkg -l, \u002Fusr\u002Fbin\u002Frpm -qa, \\\n\u002Fbin\u002Fcat \u002Fetc\u002Fshadow, \u002Fusr\u002Fsbin\u002Fdmidecode, \u002Fusr\u002Fbin\u002Ffind' | sudo tee \u002Fetc\u002Fsudoers.d\u002Fnessus_svc\n\n# Generate SSH key pair\nsudo -u nessus_svc ssh-keygen -t ed25519 -f \u002Fhome\u002Fnessus_svc\u002F.ssh\u002Fid_ed25519 -N \"\"\n\n# Distribute public key to targets\nfor host in $(cat target_hosts.txt); do\n    ssh-copy-id -i \u002Fhome\u002Fnessus_svc\u002F.ssh\u002Fid_ed25519.pub nessus_svc@$host\ndone\n```\n\n```powershell\n# Windows: Create scan service account via PowerShell\nNew-ADUser -Name \"SVC_VulnScan\" `\n    -SamAccountName \"SVC_VulnScan\" `\n    -UserPrincipalName \"SVC_VulnScan@domain.local\" `\n    -Description \"Vulnerability Scanner Service Account\" `\n    -PasswordNeverExpires $true `\n    -CannotChangePassword $true `\n    -Enabled $true `\n    -AccountPassword (Read-Host -AsSecureString \"Enter Password\")\n\n# Add to local Administrators group on targets via GPO or:\nAdd-ADGroupMember -Identity \"Domain Admins\" -Members \"SVC_VulnScan\"\n# For least privilege, use a dedicated GPO for local admin rights instead\n\n# Enable WinRM on targets\nEnable-PSRemoting -Force\nSet-Item WSMan:\\localhost\\Service\\AllowRemote -Value $true\nwinrm set winrm\u002Fconfig\u002Fservice '@{AllowUnencrypted=\"false\"}'\n```\n\n### Step 2: Configure Scanner Credentials\n\n#### Nessus Configuration\n```json\n{\n  \"credentials\": {\n    \"add\": {\n      \"Host\": {\n        \"SSH\": [{\n          \"auth_method\": \"public key\",\n          \"username\": \"nessus_svc\",\n          \"private_key\": \"\u002Fpath\u002Fto\u002Fid_ed25519\",\n          \"elevate_privileges_with\": \"sudo\",\n          \"escalation_account\": \"root\"\n        }],\n        \"Windows\": [{\n          \"auth_method\": \"Password\",\n          \"username\": \"DOMAIN\\\\SVC_VulnScan\",\n          \"password\": \"stored_in_vault\",\n          \"domain\": \"domain.local\"\n        }],\n        \"SNMPv3\": [{\n          \"username\": \"nessus_snmpv3\",\n          \"security_level\": \"authPriv\",\n          \"auth_algorithm\": \"SHA-256\",\n          \"auth_password\": \"stored_in_vault\",\n          \"priv_algorithm\": \"AES-256\",\n          \"priv_password\": \"stored_in_vault\"\n        }]\n      }\n    }\n  }\n}\n```\n\n### Step 3: Validate Credential Access\n\n```bash\n# Test SSH connectivity\nssh -i \u002Fpath\u002Fto\u002Fkey -o ConnectTimeout=10 nessus_svc@target_host \"uname -a && sudo dpkg -l | head -5\"\n\n# Test WinRM connectivity\npython3 -c \"\nimport winrm\ns = winrm.Session('target_host', auth=('DOMAIN\\\\\\\\SVC_VulnScan', 'password'), transport='ntlm')\nr = s.run_cmd('systeminfo')\nprint(r.std_out.decode())\n\"\n\n# Test SNMP v3 connectivity\nsnmpwalk -v3 -u nessus_snmpv3 -l authPriv -a SHA-256 -A authpass -x AES-256 -X privpass target_host sysDescr.0\n```\n\n### Step 4: Run Authenticated Scan\n\nConfigure and launch the scan using the Nessus API:\n```bash\n# Create scan with credentials\ncurl -k -X POST https:\u002F\u002Fnessus:8834\u002Fscans \\\n  -H \"X-Cookie: token=$TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"uuid\": \"'$TEMPLATE_UUID'\",\n    \"settings\": {\n      \"name\": \"Authenticated Scan - Production\",\n      \"text_targets\": \"192.168.1.0\u002F24\",\n      \"launch\": \"ON_DEMAND\"\n    },\n    \"credentials\": {\n      \"add\": {\n        \"Host\": {\n          \"SSH\": [{\"auth_method\": \"public key\", \"username\": \"nessus_svc\", \"private_key\": \"\u002Fkeys\u002Fid_ed25519\"}],\n          \"Windows\": [{\"auth_method\": \"Password\", \"username\": \"DOMAIN\\\\SVC_VulnScan\", \"password\": \"vault_ref\"}]\n        }\n      }\n    }\n  }'\n```\n\n### Step 5: Verify Credential Success\n\nAfter scan completion, check credential verification results:\n- **Plugin 19506** (Nessus Scan Information): Shows credential status\n- **Plugin 21745** (OS Security Patch Assessment): Confirms local checks\n- **Plugin 117887** (Local Security Checks): Credential verification\n- **Plugin 110385** (Nessus Credentialed Check): Target-level auth status\n\n## Credential Security Best Practices\n\n1. **Use a secrets vault** (HashiCorp Vault, CyberArk, AWS Secrets Manager) for credential storage\n2. **Rotate credentials** every 90 days or after personnel changes\n3. **Principle of least privilege** - only grant minimum required access\n4. **Audit credential usage** - monitor service account login events\n5. **Encrypt in transit** - use SSH keys over passwords, WinRM over HTTPS\n6. **Separate accounts** per scanner - never share credentials across tools\n7. **Disable interactive login** for scan service accounts where possible\n8. **Log all authentication** events for scan accounts in SIEM\n\n## Common Pitfalls\n- Using domain admin accounts instead of least-privilege service accounts\n- Storing credentials in plaintext scan configurations\n- Not testing credentials before scan launch (leads to wasted scan windows)\n- Forgetting to configure sudo\u002Felevation for Linux targets\n- Windows UAC blocking remote credentialed checks\n- Firewall rules blocking WMI\u002FWinRM\u002FSSH between scanner and targets\n- Credential lockout from multiple failed authentication attempts\n\n## Related Skills\n- scanning-infrastructure-with-nessus\n- performing-network-vulnerability-assessment\n- implementing-continuous-vulnerability-monitoring\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":38,"description":7,"mitre_attack":57},[38,40,28,26,37,36,32],"mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[58,59,60,61,62],"T1190","T1203","T1068","T1003","T1110","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-authenticated-vulnerability-scan",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-authenticated-vulnerability-scan",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-authenticated-vulnerability-scan",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-authenticated-vulnerability-scan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002FSKILL.md",true,[87,93,98,102,108,112,116,122],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",1320,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002FLICENSE",{"path":99,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE.txt",143,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fseo-images\u002FLICENSE.txt",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",2088,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fstandards.md",2292,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002Freferences\u002Fstandards.md",{"path":113,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fworkflows.md",3362,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002Freferences\u002Fworkflows.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",6960,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002Fscripts\u002Fagent.py",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fprocess.py",14567,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-authenticated-vulnerability-scan\u002Fscripts\u002Fprocess.py",[127,154,178,206,231,253],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,136,137,138,139,43,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,150,163,164,139,165,43,142,166,167,168,169,170,171,172,173,174,175,176,177],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[184,187],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[172,189,190,191,192,43,193,194,166,195,196,197,198,199,200,201,202,203,204,205],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[42,214,215,43,216,217,218,219,220,221,222,223,224,225,226,227,169,228,229,230],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,43,242,243,244,38,245,37,36,35,246,247,32,248,249,250,251,252],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","cvss","remediation","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":254,"name":255,"nameZh":6,"description":256,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":257,"categories":258,"keywords":260,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[259],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,261,43,262,263,264,265,266,267,268,269,201,270,202,271,272,273,274,275,276],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]