[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESSJ9WTBNH4529351YP063":3,"skill-same:01M6ESSJ9WTBNH4529351YP063":117},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":74,"ownerHtmlUrl":75,"ownerBlogUrl":6,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6ESSJ9WTBNH4529351YP063","analyzing-uefi-bootkit-persistence",null,"Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"persistence","bootkit","UEFI","analyzing","analyzing uefi bootkit persistence","firmware","secure boot","chain","partition","analysis","blacklotus","ESP","chipsec","Secure-Boot","cybersecurity","malware","monitoring","verification","code","secure","2026-11-10 10:12:30",false,"---\nname: analyzing-uefi-bootkit-persistence\ndescription: 'Analyzes UEFI bootkit persistence mechanisms including firmware implants\n  in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques,\n  and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus,\n  LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection,\n  chipsec-based firmware integrity verification, and Secure Boot configuration auditing.\n  Activates for requests involving UEFI malware analysis, firmware persistence investigation,\n  boot chain integrity verification, or Secure Boot bypass detection.\n\n  '\ndomain: cybersecurity\nsubdomain: firmware-security\ntags:\n- UEFI\n- bootkit\n- firmware\n- Secure-Boot\n- chipsec\n- ESP\n- persistence\nversion: 1.0.0\nauthor: mukul975\nlicense: Apache-2.0\nd3fend_techniques:\n- Platform Hardening\n- Restore Object\n- Platform Monitoring\n- Firmware Verification\n- Firmware Embedded Monitoring Code\nnist_csf:\n- ID.RA-01\n- PR.PS-01\n- PR.PS-02\nmitre_attack:\n- T1542.001\n- T1542.003\n- T1553.006\n- T1542\n- T1014\n---\n\n# Analyzing UEFI Bootkit Persistence\n\n## When to Use\n\n- A compromised system re-establishes C2 communication after OS reinstallation or disk replacement\n- Secure Boot has been tampered with, disabled, or shows unexpected Machine Owner Key (MOK) enrollment\n- Firmware integrity verification fails against vendor-provided baselines\n- Memory forensics reveals rootkit components loading during early boot phase\n- Investigating advanced persistent threat (APT) campaigns known to deploy UEFI implants\n- Auditing firmware security posture for enterprise endpoint hardening\n\n**Do not use** for standard MBR-based bootkits on legacy BIOS systems without UEFI; use MBR\u002FVBR bootkit analysis instead.\n\n## Prerequisites\n\n- chipsec framework for SPI flash dumping, UEFI variable inspection, and firmware security modules\n- UEFITool \u002F UEFIExtract for firmware volume parsing and DXE driver extraction\n- Python 3.8+ with struct, hashlib, subprocess, and os modules\n- Bootable Linux live USB for offline analysis (avoid running compromised OS)\n- Volatility 3 for memory forensics of boot-phase artifacts\n- YARA with UEFI malware rule sets for pattern-based detection\n- Access to vendor firmware baselines for integrity comparison\n\n## Workflow\n\n### Step 1: Dump SPI Flash Firmware\n\nAcquire the UEFI firmware from the SPI flash chip for offline analysis:\n\n```bash\n# Using chipsec to dump SPI flash contents\npython chipsec_util.py spi dump firmware_dump.rom\n\n# Using flashrom as an alternative\nflashrom -p internal -r firmware_dump.rom\n\n# Verify dump integrity\nsha256sum firmware_dump.rom\n\n# Read SPI flash descriptor information\npython chipsec_util.py spi info\n\n# Check SPI flash region access permissions\npython chipsec_main.py -m common.spi_access\n\n# Verify BIOS write protection is enabled\npython chipsec_main.py -m common.bios_wp\n\n# Check SPI flash controller lock\npython chipsec_main.py -m common.spi_lock\n```\n\n### Step 2: Inspect UEFI Variables\n\nEnumerate and analyze UEFI variables for unauthorized modifications:\n\n```bash\n# List all UEFI variables on a live system\npython chipsec_util.py uefi var-list\n\n# List UEFI variables from a SPI flash dump\npython chipsec_util.py uefi var-list-spi firmware_dump.rom\n\n# Read specific Secure Boot variables\npython chipsec_util.py uefi var-read SecureBoot 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read SetupMode 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read PK 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read KEK 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read db D719B2CB-3D3A-4596-A3BC-DAD00E67656F\n\n# Dump UEFI key databases for analysis\npython chipsec_util.py uefi keys\n\n# Check Secure Boot configuration module\npython chipsec_main.py -m common.secureboot.variables\n```\n\n### Step 3: Analyze EFI System Partition (ESP)\n\nInspect the ESP for unauthorized or modified boot components:\n\n```bash\n# Mount ESP (typically the first FAT32 partition, ~100-500MB)\nmkdir \u002Fmnt\u002Fesp\nmount \u002Fdev\u002Fsda1 \u002Fmnt\u002Fesp\n\n# List all files on ESP with timestamps\nfind \u002Fmnt\u002Fesp -type f -exec ls -la {} \\;\n\n# Check for BlackLotus indicators - custom directory under ESP:\u002Fsystem32\u002F\nls -la \u002Fmnt\u002Fesp\u002Fsystem32\u002F 2>\u002Fdev\u002Fnull\n\n# Verify Windows Boot Manager signature\nsigcheck -a \u002Fmnt\u002Fesp\u002FEFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi\n\n# Hash all EFI binaries for comparison against known-good values\nfind \u002Fmnt\u002Fesp -name \"*.efi\" -exec sha256sum {} \\;\n\n# Check for unauthorized .efi files outside standard directories\nfind \u002Fmnt\u002Fesp -name \"*.efi\" | grep -v \"Microsoft\\|Boot\\|ubuntu\\|grub\"\n\n# Look for grubx64.efi planted by BlackLotus\nfind \u002Fmnt\u002Fesp -name \"grubx64.efi\" -exec sha256sum {} \\;\n\n# Examine MeasuredBoot logs for anomalies (Windows)\n# Logs located at C:\\Windows\\Logs\\MeasuredBoot\\\n```\n\n### Step 4: Scan Firmware for Known Bootkit Signatures\n\nAnalyze the firmware dump for known UEFI malware patterns:\n\n```bash\n# Extract all firmware modules with UEFIExtract\nUEFIExtract firmware_dump.rom all\n\n# Generate firmware module whitelist from vendor baseline\npython chipsec_main.py -m tools.uefi.whitelist -a generate,baseline.json,firmware_vendor.rom\n\n# Compare current firmware against whitelist\npython chipsec_main.py -m tools.uefi.whitelist -a check,baseline.json,firmware_dump.rom\n\n# Scan firmware with UEFI-specific YARA rules\nyara -r uefi_bootkits.yar firmware_dump.rom\n\n# Scan extracted modules individually\nfind firmware_dump.rom.dump -name \"*.efi\" -exec yara -r uefi_bootkits.yar {} \\;\n\n# Check for modified CORE_DXE module (targeted by MoonBounce, CosmicStrand)\n# Compare GUID and hash against vendor baseline\n```\n\n### Step 5: Detect Secure Boot Bypass Mechanisms\n\nCheck for known Secure Boot bypass techniques:\n\n```bash\n# Check if Secure Boot is enabled\npython chipsec_main.py -m common.secureboot.variables\n\n# Verify SMM (System Management Mode) protections\npython chipsec_main.py -m common.smm\n\n# Check SMM BIOS write protection\npython chipsec_main.py -m common.bios_smi\n\n# On Windows - check boot configuration for bypass indicators\nbcdedit \u002Fenum firmware\nbcdedit \u002Fv\n\n# Check for testsigning\u002Fnointegritychecks\u002Fdebug flags\nbcdedit | findstr \u002Fi \"testsigning nointegritychecks debug\"\n\n# Verify HVCI (Hypervisor-enforced Code Integrity) is not disabled\n# BlackLotus sets HKLM:\\...\\DeviceGuard\\...\\HypervisorEnforcedCodeIntegrity Enabled=0\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\" \u002Fv Enabled\n\n# Check Secure Boot state via PowerShell\n# Confirm-SecureBootUEFI returns True if properly enabled\n```\n\n### Step 6: Perform Boot Chain Integrity Verification\n\nVerify every component in the boot chain from firmware through kernel:\n\n```bash\n# Verify firmware integrity against vendor hash\nsha256sum firmware_dump.rom\n# Compare with vendor-published hash\n\n# Verify bootloader signatures\nsigcheck -a C:\\Windows\\Boot\\EFI\\bootmgfw.efi\nsigcheck -a C:\\Windows\\System32\\winload.efi\nsigcheck -a C:\\Windows\\System32\\ntoskrnl.exe\n\n# Check for unsigned or invalid boot drivers\nsigcheck -u -e C:\\Windows\\System32\\drivers\\\n\n# Analyze Measured Boot logs for unexpected EFI_Boot_Services_Application entries\n# BlackLotus components appear as EV_EFI_Boot_Services_Application\n\n# Memory forensics for boot-phase artifacts\nvol3 -f memory.dmp windows.modules\nvol3 -f memory.dmp windows.driverscan\n```\n\n### Step 7: Document UEFI Bootkit Analysis Findings\n\nCompile a comprehensive analysis report:\n\n```\nReport should include:\n- Firmware version, vendor, and platform identification\n- SPI flash protection status (write protect, lock bits, access control)\n- Secure Boot configuration and any bypass indicators detected\n- UEFI variable anomalies (unauthorized keys, modified db\u002Fdbx, MOK enrollment)\n- ESP contents inventory with hash verification against known-good baselines\n- Firmware module comparison against vendor whitelist (added, modified, removed)\n- Known bootkit family attribution with confidence level\n- Boot chain integrity verification results for each component\n- Remediation steps (reflash, key rotation, hardware replacement)\n- MITRE ATT&CK mapping (T1542.001 - System Firmware, T1542.003 - Bootkit)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **UEFI Bootkit** | Malware that persists in UEFI firmware or the boot process, executing before the operating system loads and surviving OS reinstallation |\n| **SPI Flash** | Serial Peripheral Interface flash memory chip on the motherboard storing UEFI firmware; firmware-level bootkits like LoJax and MoonBounce modify SPI flash contents |\n| **EFI System Partition (ESP)** | FAT32 partition containing EFI bootloaders and drivers; bootkits like BlackLotus and ESPecter modify files on the ESP for persistence |\n| **Secure Boot** | UEFI security feature that verifies digital signatures of boot components; can be bypassed via vulnerabilities (CVE-2022-21894) or MOK enrollment |\n| **DXE Driver** | Driver Execution Environment driver loaded during UEFI boot; firmware implants inject malicious DXE drivers that execute before the OS |\n| **Machine Owner Key (MOK)** | User-installable Secure Boot key; BlackLotus enrolls attacker-controlled MOKs to sign malicious bootloaders |\n| **chipsec** | Intel platform security assessment framework for analyzing SPI flash, UEFI variables, Secure Boot, and hardware security configurations |\n| **HVCI** | Hypervisor-enforced Code Integrity, a Windows security feature that bootkits disable to load unsigned kernel drivers |\n\n## Tools & Systems\n\n- **chipsec**: Intel framework for dumping SPI flash, reading UEFI variables, verifying firmware write protection, and Secure Boot configuration auditing\n- **UEFITool**: Open-source UEFI firmware image parser for inspecting firmware volumes, extracting DXE drivers, and comparing module GUIDs\n- **sigcheck**: Sysinternals utility for verifying digital signatures of EFI binaries and boot chain components\n- **flashrom**: Open-source SPI flash programmer for reading and writing firmware chips on supported platforms\n- **YARA**: Pattern matching engine used with UEFI-specific rule sets to detect known bootkit signatures in firmware dumps\n\n## Common Scenarios\n\n### Scenario: Investigating Persistent Compromise Surviving OS Reinstallation\n\n**Context**: An enterprise endpoint was reimaged after a confirmed breach, but identical C2 beaconing resumed within hours. The endpoint has UEFI firmware with Secure Boot enabled, and a TPM 2.0 chip. The security team suspects a UEFI-level implant similar to BlackLotus or LoJax.\n\n**Approach**:\n1. Boot the system from a trusted Linux live USB to avoid executing any compromised OS components\n2. Dump SPI flash firmware using `chipsec_util.py spi dump` for offline analysis\n3. Mount the ESP and hash all `.efi` files for comparison against known-good values from identical hardware\n4. Check for the `ESP:\u002Fsystem32\u002F` directory (BlackLotus indicator) and unauthorized `grubx64.efi`\n5. Extract firmware modules with UEFIExtract and compare GUID inventory against vendor baseline\n6. Verify Secure Boot variables -- look for unauthorized MOK enrollment or modified db\u002Fdbx\n7. Check SPI flash write protection and lock bits using chipsec modules\n8. Scan firmware dump and extracted modules with UEFI-specific YARA rules\n9. If BlackLotus is suspected, check registry for HVCI disabled and MeasuredBoot logs for anomalous entries\n\n**Pitfalls**:\n- Running analysis from the compromised OS (rootkit components hide from live analysis)\n- Only checking the ESP without examining SPI flash firmware (misses firmware-level implants like LoJax, MoonBounce)\n- Assuming Secure Boot prevents all bootkits (CVE-2022-21894 and other bypasses exist)\n- Not preserving the original firmware dump before remediation (critical forensic evidence)\n- Reflashing firmware without verifying the vendor image is authentic and unmodified\n\n## Output Format\n\n```\nUEFI BOOTKIT PERSISTENCE ANALYSIS REPORT\n============================================\nSystem:           Lenovo ThinkPad X1 Carbon Gen 11\nFirmware:         N3HET82W (1.54) - Lenovo UEFI BIOS\nPlatform:         Intel 13th Gen (Raptor Lake)\nTPM:              2.0 (Infineon SLB 9672)\nSecure Boot:      ENABLED (BYPASSED via CVE-2022-21894)\nAnalysis Method:  Linux live USB + chipsec + UEFITool\n\nSPI FLASH PROTECTION STATUS\nBIOS Write Protection:    DISABLED [!]\nSPI Flash Lock (FLOCKDN): SET [OK]\nSMM BIOS Write Protect:   DISABLED [!]\nSPI Protected Ranges:     Region 0 only (descriptor)\n\nUEFI VARIABLE ANALYSIS\nSecureBoot:        Enabled (value=1)\nSetupMode:         Disabled (value=0)\nPK:                Lenovo Ltd. (legitimate)\nKEK:               Microsoft + Lenovo (legitimate)\ndb:                MODIFIED - contains unauthorized entry [!]\n  [!] Unknown certificate: CN=Secure Boot Signing, O=Unknown\n  [!] Not present in vendor baseline db\nMOK:               1 unauthorized key enrolled [!]\n  [!] MOK enrolled: CN=shim, self-signed, not from distro vendor\n\nESP PARTITION ANALYSIS\nTotal EFI binaries:     12\nVerified (signed):      9\nModified (hash mismatch): 2 [!]\nUnauthorized:           1 [!]\n\n  [!] EFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi - MODIFIED\n      Expected SHA-256: a3f2c8...\n      Current SHA-256:  7b1e4d...\n      Signature:        Valid (signed with unauthorized MOK)\n\n  [!] EFI\u002FMicrosoft\u002FBoot\u002Fgrubx64.efi - UNAUTHORIZED\n      SHA-256:  e9c1a7...\n      Not present in vendor baseline\n      Matches BlackLotus stage-2 loader signature\n\n  [!] system32\u002F directory present on ESP (BlackLotus artifact)\n      Directory empty (files deleted post-installation)\n\nFIRMWARE MODULE ANALYSIS\nTotal firmware modules:   312\nVendor baseline modules:  312\nAdded modules:            0\nModified modules:         0\nSPI flash integrity:      CLEAN (no firmware-level implant detected)\n\nBOOTKIT ATTRIBUTION\nFamily:           BlackLotus\nConfidence:       HIGH\nPersistence:      ESP-based (not SPI flash)\nBypass Method:    CVE-2022-21894 (baton drop)\nMITRE ATT&CK:    T1542.003 (Bootkit), T1553.006 (Code Signing Policy Modification)\n\nINDICATORS OF COMPROMISE\n- ESP:\u002Fsystem32\u002F directory (empty, post-cleanup artifact)\n- ESP:\u002FEFI\u002FMicrosoft\u002FBoot\u002Fgrubx64.efi (unauthorized, BlackLotus loader)\n- Modified bootmgfw.efi (re-signed with attacker MOK)\n- HVCI disabled via registry: DeviceGuard\\...\\Enabled = 0\n- Unauthorized MOK enrollment in UEFI variable store\n- MeasuredBoot log shows EV_EFI_Boot_Services_Application for grubx64.efi\n\nREMEDIATION\n1. Replace bootmgfw.efi with authentic copy from Windows installation media\n2. Delete unauthorized grubx64.efi and system32\u002F directory from ESP\n3. Reset Secure Boot keys to factory defaults (clear MOK, restore PK\u002FKEK\u002Fdb)\n4. Enable BIOS write protection and verify SPI flash lock bits\n5. Apply firmware update to latest version (patches CVE-2022-21894)\n6. Enable HVCI and verify via Group Policy\n7. Reimport only trusted certificates into Secure Boot db\n8. Monitor MeasuredBoot logs for anomalous boot component loading\n```\n","# Analyzing UEFI Bootkit Persistence\n\n## When to Use\n\n- A compromised system re-establishes C2 communication after OS reinstallation or disk replacement\n- Secure Boot has been tampered with, disabled, or shows unexpected Machine Owner Key (MOK) enrollment\n- Firmware integrity verification fails against vendor-provided baselines\n- Memory forensics reveals rootkit components loading during early boot phase\n- Investigating advanced persistent threat (APT) campaigns known to deploy UEFI implants\n- Auditing firmware security posture for enterprise endpoint hardening\n\n**Do not use** for standard MBR-based bootkits on legacy BIOS systems without UEFI; use MBR\u002FVBR bootkit analysis instead.\n\n## Prerequisites\n\n- chipsec framework for SPI flash dumping, UEFI variable inspection, and firmware security modules\n- UEFITool \u002F UEFIExtract for firmware volume parsing and DXE driver extraction\n- Python 3.8+ with struct, hashlib, subprocess, and os modules\n- Bootable Linux live USB for offline analysis (avoid running compromised OS)\n- Volatility 3 for memory forensics of boot-phase artifacts\n- YARA with UEFI malware rule sets for pattern-based detection\n- Access to vendor firmware baselines for integrity comparison\n\n## Workflow\n\n### Step 1: Dump SPI Flash Firmware\n\nAcquire the UEFI firmware from the SPI flash chip for offline analysis:\n\n```bash\n# Using chipsec to dump SPI flash contents\npython chipsec_util.py spi dump firmware_dump.rom\n\n# Using flashrom as an alternative\nflashrom -p internal -r firmware_dump.rom\n\n# Verify dump integrity\nsha256sum firmware_dump.rom\n\n# Read SPI flash descriptor information\npython chipsec_util.py spi info\n\n# Check SPI flash region access permissions\npython chipsec_main.py -m common.spi_access\n\n# Verify BIOS write protection is enabled\npython chipsec_main.py -m common.bios_wp\n\n# Check SPI flash controller lock\npython chipsec_main.py -m common.spi_lock\n```\n\n### Step 2: Inspect UEFI Variables\n\nEnumerate and analyze UEFI variables for unauthorized modifications:\n\n```bash\n# List all UEFI variables on a live system\npython chipsec_util.py uefi var-list\n\n# List UEFI variables from a SPI flash dump\npython chipsec_util.py uefi var-list-spi firmware_dump.rom\n\n# Read specific Secure Boot variables\npython chipsec_util.py uefi var-read SecureBoot 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read SetupMode 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read PK 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read KEK 8BE4DF61-93CA-11D2-AA0D-00E098032B8C\npython chipsec_util.py uefi var-read db D719B2CB-3D3A-4596-A3BC-DAD00E67656F\n\n# Dump UEFI key databases for analysis\npython chipsec_util.py uefi keys\n\n# Check Secure Boot configuration module\npython chipsec_main.py -m common.secureboot.variables\n```\n\n### Step 3: Analyze EFI System Partition (ESP)\n\nInspect the ESP for unauthorized or modified boot components:\n\n```bash\n# Mount ESP (typically the first FAT32 partition, ~100-500MB)\nmkdir \u002Fmnt\u002Fesp\nmount \u002Fdev\u002Fsda1 \u002Fmnt\u002Fesp\n\n# List all files on ESP with timestamps\nfind \u002Fmnt\u002Fesp -type f -exec ls -la {} \\;\n\n# Check for BlackLotus indicators - custom directory under ESP:\u002Fsystem32\u002F\nls -la \u002Fmnt\u002Fesp\u002Fsystem32\u002F 2>\u002Fdev\u002Fnull\n\n# Verify Windows Boot Manager signature\nsigcheck -a \u002Fmnt\u002Fesp\u002FEFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi\n\n# Hash all EFI binaries for comparison against known-good values\nfind \u002Fmnt\u002Fesp -name \"*.efi\" -exec sha256sum {} \\;\n\n# Check for unauthorized .efi files outside standard directories\nfind \u002Fmnt\u002Fesp -name \"*.efi\" | grep -v \"Microsoft\\|Boot\\|ubuntu\\|grub\"\n\n# Look for grubx64.efi planted by BlackLotus\nfind \u002Fmnt\u002Fesp -name \"grubx64.efi\" -exec sha256sum {} \\;\n\n# Examine MeasuredBoot logs for anomalies (Windows)\n# Logs located at C:\\Windows\\Logs\\MeasuredBoot\\\n```\n\n### Step 4: Scan Firmware for Known Bootkit Signatures\n\nAnalyze the firmware dump for known UEFI malware patterns:\n\n```bash\n# Extract all firmware modules with UEFIExtract\nUEFIExtract firmware_dump.rom all\n\n# Generate firmware module whitelist from vendor baseline\npython chipsec_main.py -m tools.uefi.whitelist -a generate,baseline.json,firmware_vendor.rom\n\n# Compare current firmware against whitelist\npython chipsec_main.py -m tools.uefi.whitelist -a check,baseline.json,firmware_dump.rom\n\n# Scan firmware with UEFI-specific YARA rules\nyara -r uefi_bootkits.yar firmware_dump.rom\n\n# Scan extracted modules individually\nfind firmware_dump.rom.dump -name \"*.efi\" -exec yara -r uefi_bootkits.yar {} \\;\n\n# Check for modified CORE_DXE module (targeted by MoonBounce, CosmicStrand)\n# Compare GUID and hash against vendor baseline\n```\n\n### Step 5: Detect Secure Boot Bypass Mechanisms\n\nCheck for known Secure Boot bypass techniques:\n\n```bash\n# Check if Secure Boot is enabled\npython chipsec_main.py -m common.secureboot.variables\n\n# Verify SMM (System Management Mode) protections\npython chipsec_main.py -m common.smm\n\n# Check SMM BIOS write protection\npython chipsec_main.py -m common.bios_smi\n\n# On Windows - check boot configuration for bypass indicators\nbcdedit \u002Fenum firmware\nbcdedit \u002Fv\n\n# Check for testsigning\u002Fnointegritychecks\u002Fdebug flags\nbcdedit | findstr \u002Fi \"testsigning nointegritychecks debug\"\n\n# Verify HVCI (Hypervisor-enforced Code Integrity) is not disabled\n# BlackLotus sets HKLM:\\...\\DeviceGuard\\...\\HypervisorEnforcedCodeIntegrity Enabled=0\nreg query \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\" \u002Fv Enabled\n\n# Check Secure Boot state via PowerShell\n# Confirm-SecureBootUEFI returns True if properly enabled\n```\n\n### Step 6: Perform Boot Chain Integrity Verification\n\nVerify every component in the boot chain from firmware through kernel:\n\n```bash\n# Verify firmware integrity against vendor hash\nsha256sum firmware_dump.rom\n# Compare with vendor-published hash\n\n# Verify bootloader signatures\nsigcheck -a C:\\Windows\\Boot\\EFI\\bootmgfw.efi\nsigcheck -a C:\\Windows\\System32\\winload.efi\nsigcheck -a C:\\Windows\\System32\\ntoskrnl.exe\n\n# Check for unsigned or invalid boot drivers\nsigcheck -u -e C:\\Windows\\System32\\drivers\\\n\n# Analyze Measured Boot logs for unexpected EFI_Boot_Services_Application entries\n# BlackLotus components appear as EV_EFI_Boot_Services_Application\n\n# Memory forensics for boot-phase artifacts\nvol3 -f memory.dmp windows.modules\nvol3 -f memory.dmp windows.driverscan\n```\n\n### Step 7: Document UEFI Bootkit Analysis Findings\n\nCompile a comprehensive analysis report:\n\n```\nReport should include:\n- Firmware version, vendor, and platform identification\n- SPI flash protection status (write protect, lock bits, access control)\n- Secure Boot configuration and any bypass indicators detected\n- UEFI variable anomalies (unauthorized keys, modified db\u002Fdbx, MOK enrollment)\n- ESP contents inventory with hash verification against known-good baselines\n- Firmware module comparison against vendor whitelist (added, modified, removed)\n- Known bootkit family attribution with confidence level\n- Boot chain integrity verification results for each component\n- Remediation steps (reflash, key rotation, hardware replacement)\n- MITRE ATT&CK mapping (T1542.001 - System Firmware, T1542.003 - Bootkit)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **UEFI Bootkit** | Malware that persists in UEFI firmware or the boot process, executing before the operating system loads and surviving OS reinstallation |\n| **SPI Flash** | Serial Peripheral Interface flash memory chip on the motherboard storing UEFI firmware; firmware-level bootkits like LoJax and MoonBounce modify SPI flash contents |\n| **EFI System Partition (ESP)** | FAT32 partition containing EFI bootloaders and drivers; bootkits like BlackLotus and ESPecter modify files on the ESP for persistence |\n| **Secure Boot** | UEFI security feature that verifies digital signatures of boot components; can be bypassed via vulnerabilities (CVE-2022-21894) or MOK enrollment |\n| **DXE Driver** | Driver Execution Environment driver loaded during UEFI boot; firmware implants inject malicious DXE drivers that execute before the OS |\n| **Machine Owner Key (MOK)** | User-installable Secure Boot key; BlackLotus enrolls attacker-controlled MOKs to sign malicious bootloaders |\n| **chipsec** | Intel platform security assessment framework for analyzing SPI flash, UEFI variables, Secure Boot, and hardware security configurations |\n| **HVCI** | Hypervisor-enforced Code Integrity, a Windows security feature that bootkits disable to load unsigned kernel drivers |\n\n## Tools & Systems\n\n- **chipsec**: Intel framework for dumping SPI flash, reading UEFI variables, verifying firmware write protection, and Secure Boot configuration auditing\n- **UEFITool**: Open-source UEFI firmware image parser for inspecting firmware volumes, extracting DXE drivers, and comparing module GUIDs\n- **sigcheck**: Sysinternals utility for verifying digital signatures of EFI binaries and boot chain components\n- **flashrom**: Open-source SPI flash programmer for reading and writing firmware chips on supported platforms\n- **YARA**: Pattern matching engine used with UEFI-specific rule sets to detect known bootkit signatures in firmware dumps\n\n## Common Scenarios\n\n### Scenario: Investigating Persistent Compromise Surviving OS Reinstallation\n\n**Context**: An enterprise endpoint was reimaged after a confirmed breach, but identical C2 beaconing resumed within hours. The endpoint has UEFI firmware with Secure Boot enabled, and a TPM 2.0 chip. The security team suspects a UEFI-level implant similar to BlackLotus or LoJax.\n\n**Approach**:\n1. Boot the system from a trusted Linux live USB to avoid executing any compromised OS components\n2. Dump SPI flash firmware using `chipsec_util.py spi dump` for offline analysis\n3. Mount the ESP and hash all `.efi` files for comparison against known-good values from identical hardware\n4. Check for the `ESP:\u002Fsystem32\u002F` directory (BlackLotus indicator) and unauthorized `grubx64.efi`\n5. Extract firmware modules with UEFIExtract and compare GUID inventory against vendor baseline\n6. Verify Secure Boot variables -- look for unauthorized MOK enrollment or modified db\u002Fdbx\n7. Check SPI flash write protection and lock bits using chipsec modules\n8. Scan firmware dump and extracted modules with UEFI-specific YARA rules\n9. If BlackLotus is suspected, check registry for HVCI disabled and MeasuredBoot logs for anomalous entries\n\n**Pitfalls**:\n- Running analysis from the compromised OS (rootkit components hide from live analysis)\n- Only checking the ESP without examining SPI flash firmware (misses firmware-level implants like LoJax, MoonBounce)\n- Assuming Secure Boot prevents all bootkits (CVE-2022-21894 and other bypasses exist)\n- Not preserving the original firmware dump before remediation (critical forensic evidence)\n- Reflashing firmware without verifying the vendor image is authentic and unmodified\n\n## Output Format\n\n```\nUEFI BOOTKIT PERSISTENCE ANALYSIS REPORT\n============================================\nSystem:           Lenovo ThinkPad X1 Carbon Gen 11\nFirmware:         N3HET82W (1.54) - Lenovo UEFI BIOS\nPlatform:         Intel 13th Gen (Raptor Lake)\nTPM:              2.0 (Infineon SLB 9672)\nSecure Boot:      ENABLED (BYPASSED via CVE-2022-21894)\nAnalysis Method:  Linux live USB + chipsec + UEFITool\n\nSPI FLASH PROTECTION STATUS\nBIOS Write Protection:    DISABLED [!]\nSPI Flash Lock (FLOCKDN): SET [OK]\nSMM BIOS Write Protect:   DISABLED [!]\nSPI Protected Ranges:     Region 0 only (descriptor)\n\nUEFI VARIABLE ANALYSIS\nSecureBoot:        Enabled (value=1)\nSetupMode:         Disabled (value=0)\nPK:                Lenovo Ltd. (legitimate)\nKEK:               Microsoft + Lenovo (legitimate)\ndb:                MODIFIED - contains unauthorized entry [!]\n  [!] Unknown certificate: CN=Secure Boot Signing, O=Unknown\n  [!] Not present in vendor baseline db\nMOK:               1 unauthorized key enrolled [!]\n  [!] MOK enrolled: CN=shim, self-signed, not from distro vendor\n\nESP PARTITION ANALYSIS\nTotal EFI binaries:     12\nVerified (signed):      9\nModified (hash mismatch): 2 [!]\nUnauthorized:           1 [!]\n\n  [!] EFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi - MODIFIED\n      Expected SHA-256: a3f2c8...\n      Current SHA-256:  7b1e4d...\n      Signature:        Valid (signed with unauthorized MOK)\n\n  [!] EFI\u002FMicrosoft\u002FBoot\u002Fgrubx64.efi - UNAUTHORIZED\n      SHA-256:  e9c1a7...\n      Not present in vendor baseline\n      Matches BlackLotus stage-2 loader signature\n\n  [!] system32\u002F directory present on ESP (BlackLotus artifact)\n      Directory empty (files deleted post-installation)\n\nFIRMWARE MODULE ANALYSIS\nTotal firmware modules:   312\nVendor baseline modules:  312\nAdded modules:            0\nModified modules:         0\nSPI flash integrity:      CLEAN (no firmware-level implant detected)\n\nBOOTKIT ATTRIBUTION\nFamily:           BlackLotus\nConfidence:       HIGH\nPersistence:      ESP-based (not SPI flash)\nBypass Method:    CVE-2022-21894 (baton drop)\nMITRE ATT&CK:    T1542.003 (Bootkit), T1553.006 (Code Signing Policy Modification)\n\nINDICATORS OF COMPROMISE\n- ESP:\u002Fsystem32\u002F directory (empty, post-cleanup artifact)\n- ESP:\u002FEFI\u002FMicrosoft\u002FBoot\u002Fgrubx64.efi (unauthorized, BlackLotus loader)\n- Modified bootmgfw.efi (re-signed with attacker MOK)\n- HVCI disabled via registry: DeviceGuard\\...\\Enabled = 0\n- Unauthorized MOK enrollment in UEFI variable store\n- MeasuredBoot log shows EV_EFI_Boot_Services_Application for grubx64.efi\n\nREMEDIATION\n1. Replace bootmgfw.efi with authentic copy from Windows installation media\n2. Delete unauthorized grubx64.efi and system32\u002F directory from ESP\n3. Reset Secure Boot keys to factory defaults (clear MOK, restore PK\u002FKEK\u002Fdb)\n4. Enable BIOS write protection and verify SPI flash lock bits\n5. Apply firmware update to latest version (patches CVE-2022-21894)\n6. Enable HVCI and verify via Group Policy\n7. Reimport only trusted certificates into Secure Boot db\n8. Monitor MeasuredBoot logs for anomalous boot component loading\n```\n",{"name":5,"tags":49,"author":50,"domain":38,"license":15,"version":51,"nist_csf":52,"subdomain":56,"description":57,"mitre_attack":58,"d3fend_techniques":64},[26,25,29,37,36,35,24],"mukul975","1.0.0",[53,54,55],"ID.RA-01","PR.PS-01","PR.PS-02","firmware-security","Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.\n",[59,60,61,62,63],"T1542.001","T1542.003","T1553.006","T1542","T1014",[65,66,67,68,69],"Platform Hardening","Restore Object","Platform Monitoring","Firmware Verification","Firmware Embedded Monitoring Code","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-uefi-bootkit-persistence",{"tool":84,"command":85},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-uefi-bootkit-persistence",{"tool":87,"command":88},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-uefi-bootkit-persistence","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence\u002FSKILL.md",true,[92,97,103,109,113],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",5768,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",22332,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-uefi-bootkit-persistence\u002Fscripts\u002Fagent.py",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Ffind-sessions.sh",2942,"https:\u002F\u002Fgithub.com\u002FmidakaID\u002FNanobot\u002Fblob\u002Fmain\u002Fnanobot\u002Fskills\u002Ftmux\u002Fscripts\u002Ffind-sessions.sh",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fwait-for-text.sh",2139,"https:\u002F\u002Fgithub.com\u002FmidakaID\u002FNanobot\u002Fblob\u002Fmain\u002Fnanobot\u002Fskills\u002Ftmux\u002Fscripts\u002Fwait-for-text.sh",[118,159,168,177,199,224],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":139,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[125,128,131,134],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[120,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":160,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[163,164,165,166],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},[120,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158],{"skillNo":169,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":176,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[172,173,174,175],{"categoryNo":126,"categoryName":127,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":137,"taxonomyTypeDesc":138},[120,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158],{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[184,185,186,187,188,189,190,191,192,193,194,195,196,197,198],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[205],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,210,211,212,33,213,214,215,216,151,152,217,218,219,220,221,222,223],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":122,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":240,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[230,233,236,237],{"categoryNo":231,"categoryName":232,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":234,"categoryName":235,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":238,"categoryName":239,"taxonomyType":137,"taxonomyTypeDesc":138},"01JBSEEDCAT000000000000036","内容创作者",[241,242,243,244,245,246,247,248,148,249,151,152,153,250,251,252,253,254,198,255],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]