[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ETDPE77F24PHRS8FXF7CSF":3,"skill-same:01M6ETDPE77F24PHRS8FXF7CSF":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6ETDPE77F24PHRS8FXF7CSF","detecting-lateral-movement-with-zeek",null,"Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","Zeek","detecting lateral movement with zeek","analysis","remote","id","connections","files","log","cm","log analysis","bro","cybersecurity","execution","smb","network-security","network-forensics","file","rpc","pr","2026-11-10 10:12:30",false,"---\nname: detecting-lateral-movement-with-zeek\ndescription: 'Detect lateral movement in network traffic using Zeek (formerly Bro)\n  log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log,\n  and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote\n  service execution, and anomalous internal connections.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- zeek\n- lateral-movement\n- smb\n- dce-rpc\n- ntlm-spray\n- network-forensics\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1021\n---\n\n# Detecting Lateral Movement with Zeek\n\nAnalyze Zeek network logs to identify lateral movement techniques including\nSMB admin share access, DCE\u002FRPC remote service creation, NTLM account spray,\nKerberos ticket anomalies, and large internal data transfers indicative\nof staging or exfiltration between hosts.\n\n## When to Use\n\n- Hunting for lateral movement after an initial compromise indicator is found on one endpoint\n- Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network\n- Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)\n- Detecting remote service execution via DCE\u002FRPC (PsExec, schtasks, WMI lateral patterns)\n- Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment\n- Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source\n\n**Do not use** as a standalone detection mechanism. Zeek sees network traffic only; combine with endpoint telemetry (Sysmon, EDR) for full visibility. Encrypted SMB3 traffic may limit Zeek's visibility into file-level details.\n\n## Prerequisites\n\n- Zeek 6.0+ deployed on a network tap or SPAN port monitoring internal VLAN traffic\n- Zeek SMB analyzer enabled (loaded by default: `@load base\u002Fprotocols\u002Fsmb`)\n- Zeek DCE\u002FRPC analyzer enabled (`@load base\u002Fprotocols\u002Fdce-rpc`)\n- Zeek Kerberos analyzer enabled (`@load base\u002Fprotocols\u002Fkrb`)\n- Python 3.8+ (standard library only)\n- Access to Zeek log directory (default: `\u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F`)\n- Familiarity with Zeek TSV log format (fields separated by `\\t`, header lines prefixed with `#`)\n\n## Workflow\n\n### Step 1: Verify Zeek Log Collection\n\nConfirm that Zeek is producing the required log files for lateral movement detection:\n\n```bash\n# Check that all required analyzers are producing logs\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fkerberos.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Quick field check on conn.log\nzeek-cut id.orig_h id.resp_h id.resp_p proto service \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | head -20\n```\n\n### Step 2: Parse conn.log for Internal Lateral Patterns\n\nIdentify connections between internal hosts on lateral-movement-associated ports:\n\n```bash\n# Extract SMB connections (port 445) between internal hosts\nzeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$5 == 445 && $7 == \"smb\"'\n\n# Extract DCE\u002FRPC connections (port 135)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 135'\n\n# Extract WinRM connections (port 5985\u002F5986)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 5985 || $4 == 5986'\n```\n\n### Step 3: Analyze SMB Admin Share Access\n\nDetect access to administrative shares (C$, ADMIN$, IPC$) which is the primary vector for tools like PsExec:\n\n```bash\n# Check smb_mapping.log for admin share access\nzeek-cut ts id.orig_h id.resp_h path share_type \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log \\\n  | grep -iE '(C\\$|ADMIN\\$|IPC\\$)'\n\n# Check smb_files.log for file writes to admin shares\nzeek-cut ts id.orig_h id.resp_h action path name size \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log \\\n  | grep -i 'SMB::FILE_WRITE'\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts on admin share access:\n\n```zeek\n@load base\u002Fprotocols\u002Fsmb\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    Admin_Share_Access\n};\n\nevent smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) {\n    if ( \u002F\\$\u002F in path )\n        NOTICE([$note=Admin_Share_Access,\n                $msg=fmt(\"Admin share access: %s -> %s (%s)\", c$id$orig_h, c$id$resp_h, path),\n                $conn=c]);\n}\n```\n\n### Step 4: Detect DCE\u002FRPC Remote Service Operations\n\nMonitor for remote service creation and scheduled task registration via DCE\u002FRPC:\n\n```bash\n# Look for service control manager operations (PsExec pattern)\nzeek-cut ts id.orig_h id.resp_h endpoint operation \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log \\\n  | grep -iE '(svcctl|atsvc|ITaskSchedulerService)'\n```\n\n### Step 5: Detect NTLM Account Spray\n\nAnalyze ntlm.log for authentication anomalies indicating credential reuse.\nZeek's ntlm.log does not expose password hashes, so this detection identifies\na single account authenticating to many hosts in a short window — the network\nsignature of credential spraying tools like CrackMapExec:\n\n```bash\n# Extract NTLM authentications\nzeek-cut ts id.orig_h id.resp_h username domainname server_nb_computer_name success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Failed NTLM authentications (brute force or credential testing)\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | awk '$5 == \"F\"'\n\n# Sort by timestamp for timeline analysis\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | sort -k1,1\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts when a single\naccount touches more hosts than the threshold in a rolling window:\n\n```zeek\n@load base\u002Fprotocols\u002Fntlm\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    NTLM_Account_Spray\n};\n\nglobal ntlm_tracker: table[string] of set[addr] &create_expire=5min;\nconst spray_threshold = 3 &redef;\n\nevent ntlm_log(rec: NTLM::Info) {\n    if ( ! rec?$username || rec$username == \"-\" )\n        return;\n    if ( rec$username !in ntlm_tracker )\n        ntlm_tracker[rec$username] = set();\n    add ntlm_tracker[rec$username][rec$id$resp_h];\n    if ( |ntlm_tracker[rec$username]| >= spray_threshold )\n        NOTICE([$note=NTLM_Account_Spray,\n                $msg=fmt(\"NTLM account spray: %s -> %d hosts\", rec$username, |ntlm_tracker[rec$username]|),\n                $sub=rec$username,\n                $conn=rec$id]);\n}\n```\n\n### Step 6: Run the Automated Analysis Agent\n\nUse the provided agent.py for comprehensive lateral movement detection:\n\n```bash\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002F2026-03-18\u002F  # Analyze a specific date\n```\n\n## Verification\n\n- Confirm conn.log captures internal SMB (port 445) and DCE\u002FRPC (port 135) connections with correct field parsing\n- Verify smb_mapping.log correctly logs admin share paths (C$, ADMIN$, IPC$)\n- Test with a known PsExec execution in a lab: expect to see SMB FILE_WRITE of the service binary followed by DCE\u002FRPC svcctl CreateService\n- Validate NTLM log parsing by performing a test authentication and confirming username, domain, and success fields are captured; verify the NTLM Account Spray Zeek script generates a `notice.log` entry when the spray threshold is exceeded\n- Cross-reference Zeek alerts with Sysmon Event ID 1 (Process Creation) on the target host to confirm end-to-end detection\n- Verify the agent correctly handles both TSV and JSON Zeek log formats\n","# Detecting Lateral Movement with Zeek\n\nAnalyze Zeek network logs to identify lateral movement techniques including\nSMB admin share access, DCE\u002FRPC remote service creation, NTLM account spray,\nKerberos ticket anomalies, and large internal data transfers indicative\nof staging or exfiltration between hosts.\n\n## When to Use\n\n- Hunting for lateral movement after an initial compromise indicator is found on one endpoint\n- Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network\n- Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)\n- Detecting remote service execution via DCE\u002FRPC (PsExec, schtasks, WMI lateral patterns)\n- Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment\n- Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source\n\n**Do not use** as a standalone detection mechanism. Zeek sees network traffic only; combine with endpoint telemetry (Sysmon, EDR) for full visibility. Encrypted SMB3 traffic may limit Zeek's visibility into file-level details.\n\n## Prerequisites\n\n- Zeek 6.0+ deployed on a network tap or SPAN port monitoring internal VLAN traffic\n- Zeek SMB analyzer enabled (loaded by default: `@load base\u002Fprotocols\u002Fsmb`)\n- Zeek DCE\u002FRPC analyzer enabled (`@load base\u002Fprotocols\u002Fdce-rpc`)\n- Zeek Kerberos analyzer enabled (`@load base\u002Fprotocols\u002Fkrb`)\n- Python 3.8+ (standard library only)\n- Access to Zeek log directory (default: `\u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F`)\n- Familiarity with Zeek TSV log format (fields separated by `\\t`, header lines prefixed with `#`)\n\n## Workflow\n\n### Step 1: Verify Zeek Log Collection\n\nConfirm that Zeek is producing the required log files for lateral movement detection:\n\n```bash\n# Check that all required analyzers are producing logs\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fkerberos.log\nls -la \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Quick field check on conn.log\nzeek-cut id.orig_h id.resp_h id.resp_p proto service \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | head -20\n```\n\n### Step 2: Parse conn.log for Internal Lateral Patterns\n\nIdentify connections between internal hosts on lateral-movement-associated ports:\n\n```bash\n# Extract SMB connections (port 445) between internal hosts\nzeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$5 == 445 && $7 == \"smb\"'\n\n# Extract DCE\u002FRPC connections (port 135)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 135'\n\n# Extract WinRM connections (port 5985\u002F5986)\nzeek-cut ts id.orig_h id.resp_h id.resp_p service \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log \\\n  | awk '$4 == 5985 || $4 == 5986'\n```\n\n### Step 3: Analyze SMB Admin Share Access\n\nDetect access to administrative shares (C$, ADMIN$, IPC$) which is the primary vector for tools like PsExec:\n\n```bash\n# Check smb_mapping.log for admin share access\nzeek-cut ts id.orig_h id.resp_h path share_type \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_mapping.log \\\n  | grep -iE '(C\\$|ADMIN\\$|IPC\\$)'\n\n# Check smb_files.log for file writes to admin shares\nzeek-cut ts id.orig_h id.resp_h action path name size \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fsmb_files.log \\\n  | grep -i 'SMB::FILE_WRITE'\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts on admin share access:\n\n```zeek\n@load base\u002Fprotocols\u002Fsmb\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    Admin_Share_Access\n};\n\nevent smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) {\n    if ( \u002F\\$\u002F in path )\n        NOTICE([$note=Admin_Share_Access,\n                $msg=fmt(\"Admin share access: %s -> %s (%s)\", c$id$orig_h, c$id$resp_h, path),\n                $conn=c]);\n}\n```\n\n### Step 4: Detect DCE\u002FRPC Remote Service Operations\n\nMonitor for remote service creation and scheduled task registration via DCE\u002FRPC:\n\n```bash\n# Look for service control manager operations (PsExec pattern)\nzeek-cut ts id.orig_h id.resp_h endpoint operation \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdce_rpc.log \\\n  | grep -iE '(svcctl|atsvc|ITaskSchedulerService)'\n```\n\n### Step 5: Detect NTLM Account Spray\n\nAnalyze ntlm.log for authentication anomalies indicating credential reuse.\nZeek's ntlm.log does not expose password hashes, so this detection identifies\na single account authenticating to many hosts in a short window — the network\nsignature of credential spraying tools like CrackMapExec:\n\n```bash\n# Extract NTLM authentications\nzeek-cut ts id.orig_h id.resp_h username domainname server_nb_computer_name success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log\n\n# Failed NTLM authentications (brute force or credential testing)\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | awk '$5 == \"F\"'\n\n# Sort by timestamp for timeline analysis\nzeek-cut ts id.orig_h id.resp_h username success \\\n  \u003C \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fntlm.log \\\n  | sort -k1,1\n```\n\nDeploy the following Zeek script to generate `notice.log` alerts when a single\naccount touches more hosts than the threshold in a rolling window:\n\n```zeek\n@load base\u002Fprotocols\u002Fntlm\n@load base\u002Fframeworks\u002Fnotice\n\nredef enum Notice::Type += {\n    NTLM_Account_Spray\n};\n\nglobal ntlm_tracker: table[string] of set[addr] &create_expire=5min;\nconst spray_threshold = 3 &redef;\n\nevent ntlm_log(rec: NTLM::Info) {\n    if ( ! rec?$username || rec$username == \"-\" )\n        return;\n    if ( rec$username !in ntlm_tracker )\n        ntlm_tracker[rec$username] = set();\n    add ntlm_tracker[rec$username][rec$id$resp_h];\n    if ( |ntlm_tracker[rec$username]| >= spray_threshold )\n        NOTICE([$note=NTLM_Account_Spray,\n                $msg=fmt(\"NTLM account spray: %s -> %d hosts\", rec$username, |ntlm_tracker[rec$username]|),\n                $sub=rec$username,\n                $conn=rec$id]);\n}\n```\n\n### Step 6: Run the Automated Analysis Agent\n\nUse the provided agent.py for comprehensive lateral movement detection:\n\n```bash\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\npython3 agent.py \u002Fopt\u002Fzeek\u002Flogs\u002F2026-03-18\u002F  # Analyze a specific date\n```\n\n## Verification\n\n- Confirm conn.log captures internal SMB (port 445) and DCE\u002FRPC (port 135) connections with correct field parsing\n- Verify smb_mapping.log correctly logs admin share paths (C$, ADMIN$, IPC$)\n- Test with a known PsExec execution in a lab: expect to see SMB FILE_WRITE of the service binary followed by DCE\u002FRPC svcctl CreateService\n- Validate NTLM log parsing by performing a test authentication and confirming username, domain, and success fields are captured; verify the NTLM Account Spray Zeek script generates a `notice.log` entry when the spray threshold is exceeded\n- Cross-reference Zeek alerts with Sysmon Event ID 1 (Process Creation) on the target host to confirm end-to-end detection\n- Verify the agent correctly handles both TSV and JSON Zeek log formats\n",{"name":5,"tags":49,"author":54,"domain":36,"license":15,"version":55,"nist_csf":56,"subdomain":39,"description":61,"mitre_attack":62},[50,51,38,52,53,40],"zeek","lateral-movement","dce-rpc","ntlm-spray","mahipal","1.0",[57,58,59,60],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.\n",[63,64,65,66,67],"T1046","T1040","T1557","T1071","T1021","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill detecting-lateral-movement-with-zeek",{"tool":82,"command":83},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill detecting-lateral-movement-with-zeek",{"tool":85,"command":86},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill detecting-lateral-movement-with-zeek","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",4437,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",4465,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",818,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",4831,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",19431,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",5682,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-lateral-movement-with-zeek\u002Fscripts\u002Fprocess.py",[126,165,174,183,205,230],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":147,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[133,136,139,142],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,31,164,24],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","youtube",{"skillNo":166,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[169,170,171,172],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,31,164,24],{"skillNo":175,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[178,179,180,181],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,31,164,24],{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[190,191,192,193,194,195,196,197,198,199,200,201,202,203,204],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,216,217,218,27,219,220,221,222,159,160,223,224,225,226,227,228,229],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":246,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[236,239,242,243],{"categoryNo":237,"categoryName":238,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":240,"categoryName":241,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":244,"categoryName":245,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000036","内容创作者",[247,248,249,250,251,252,253,254,156,255,159,160,161,256,257,258,259,260,204,261],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]