[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HDF76XY1X36SM3GE6M19PS":3,"skill-same:01M6HDF76XY1X36SM3GE6M19PS":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6HDF76XY1X36SM3GE6M19PS","conducting-malware-incident-response",null,"Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment,...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fconducting-malware-incident-response\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"incident response","malware","incident","conducting malware incident response","consistency","cybersecurity","full","infection","across","message","conversion","command","analysis","endpoint","endpoint-remediation","eradication","remediation","malware-response","Enterprise","MITRE-ATT&CK","2026-11-10 10:12:30",false,"---\nname: conducting-malware-incident-response\ndescription: Responds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment,...\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- malware-response\n- malware-analysis\n- eradication\n- endpoint-remediation\n- MITRE-ATT&CK\nmitre_attack:\n- T1204\n- T1027\n- T1055\n- T1059\n- T1486\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\ncategory: conducting-malware-incident-response\n---\n# Conducting-Malware-Incident-Response\n\n## Overview\nResponds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment, analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal, worm containment, malware triage, or infected endpoint remediation.\n\n\n\n# Conducting Malware Incident Response\n\n## When to Use\n\n- EDR or antivirus detects malware execution on one or more endpoints\n- A user reports suspicious system behavior indicative of malware infection\n- Threat intelligence indicates a malware campaign targeting the organization's industry\n- Network monitoring detects beaconing traffic consistent with known malware C2 patterns\n- A file detonation in a sandbox returns a malicious verdict\n\n**Do not use** for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.\n\n## Prerequisites\n\n- EDR platform with process tree visibility and host isolation capability\n- Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)\n- Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)\n- Forensic imaging tools for evidence preservation (FTK Imager, KAPE)\n- Clean system images or gold images for endpoint rebuild\n- MITRE ATT&CK framework reference for technique mapping\n\n## Workflow\n\n### Step 1: Detect and Confirm Malware Presence\n\nValidate the malware alert and gather initial indicators:\n\n- Review EDR alert details: detection name, file path, hash (SHA-256), process tree\n- Check if the detection is a known malware family or generic heuristic detection\n- Query the file hash against VirusTotal, MalwareBazaar, and internal threat intelligence\n- Examine the process execution chain to determine how the malware was delivered\n\n```\nDetection Summary:\nFile:        C:\\Users\\jsmith\\AppData\\Local\\Temp\\update.exe\nSHA-256:     a1b2c3d4e5f6...\nDetection:   CrowdStrike: Malware\u002FQakbot | VirusTotal: 58\u002F72 engines\nParent:      WINWORD.EXE → cmd.exe → powershell.exe → update.exe\nDelivery:    Email attachment (Invoice-Nov2025.docm)\nNetwork:     HTTPS POST to 185.220.101[.]42:443 every 60s\nPersistence: Scheduled Task \"WindowsUpdate\" → update.exe\n```\n\n### Step 2: Scope the Infection\n\nDetermine how many systems are affected and the malware's propagation method:\n\n- Use EDR to search for the malware hash, filename, and behavioral indicators across all endpoints\n- Check for network-based spreading (SMB, WMI, PsExec, exploitation)\n- Query email gateway logs for all recipients of the delivery email\n- Search for C2 communications to the identified infrastructure from other internal hosts\n- Check for persistence mechanisms on all identified infected hosts\n\n### Step 3: Contain Infected Systems\n\nExecute containment per the active breach containment procedures:\n\n- Network-isolate infected endpoints via EDR containment\n- Block malware C2 infrastructure at firewall and DNS\n- Block the malware hash in EDR prevention policy organization-wide\n- Quarantine the delivery email from all mailboxes (if email-delivered)\n- Disable compromised user accounts if credential theft is suspected\n\n### Step 4: Analyze the Malware\n\nPerform sufficient analysis to support complete eradication:\n\n- Submit the sample to a sandbox for dynamic analysis (behavioral report, dropped files, network IOCs)\n- Identify all persistence mechanisms: registry keys, scheduled tasks, services, WMI subscriptions, startup folders\n- Document all file system artifacts: dropped files, modified files, created directories\n- Extract network IOCs: C2 domains, IPs, URLs, user agents, JA3\u002FJA3S hashes\n- Map observed behaviors to MITRE ATT&CK techniques\n\n```\nMalware Analysis Summary - Qakbot Variant\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nInitial Access:   T1566.001 - Spearphishing Attachment (.docm)\nExecution:        T1059.001 - PowerShell (encoded downloader)\nPersistence:      T1053.005 - Scheduled Task\nDefense Evasion:  T1055.012 - Process Hollowing (explorer.exe)\nC2:               T1071.001 - HTTPS with custom headers\nCollection:       T1005 - Data from Local System (browser credentials)\nExfiltration:     T1041 - Exfiltration Over C2 Channel\n\nArtifacts:\n- C:\\Users\\*\\AppData\\Local\\Temp\\update.exe (dropper)\n- C:\\ProgramData\\Microsoft\\{GUID}\\config.dll (payload)\n- HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\{random} (backup persistence)\n- Scheduled Task: \"WindowsUpdate\" (primary persistence)\n```\n\n### Step 5: Eradicate the Malware\n\nRemove all malware artifacts from every infected system:\n\n- Terminate malicious processes and injected threads\n- Delete malware files from all identified paths\n- Remove persistence mechanisms (scheduled tasks, registry keys, services, WMI subscriptions)\n- Clear browser credential stores if credential harvesting was confirmed\n- Run a full EDR scan to verify no artifacts remain\n- If eradication confidence is low, reimage the system from a known-clean gold image\n\n### Step 6: Recover and Validate\n\nRestore systems to production and verify clean status:\n\n- Reconnect contained systems to the network in stages\n- Monitor for 72 hours for any recurrence of malware indicators\n- Force password resets for all users on infected endpoints\n- Verify that C2 traffic has completely ceased across the environment\n- Update detection rules based on newly discovered IOCs from the investigation\n- Distribute IOCs to threat intelligence sharing partners (ISAC, MISP)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.g., Qakbot, Emotet, Cobalt Strike) |\n| **Process Hollowing** | Technique where malware creates a legitimate process in a suspended state, replaces its memory with malicious code, then resumes execution |\n| **Beacon** | Periodic network communication from malware to its C2 server, typically with a set interval and jitter for detection evasion |\n| **Dropper** | Initial malware component that downloads or unpacks the primary payload; often delivered via phishing |\n| **Persistence Mechanism** | Method used by malware to survive system reboots (registry run keys, scheduled tasks, services, WMI event subscriptions) |\n| **IOC (Indicator of Compromise)** | Observable artifact such as file hash, IP address, domain, or registry key that indicates malware presence |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon \u002F Microsoft Defender for Endpoint**: EDR platforms for detection, containment, and threat hunting\n- **ANY.RUN \u002F Joe Sandbox**: Interactive malware sandboxes for dynamic behavioral analysis\n- **VirusTotal \u002F MalwareBazaar**: Malware intelligence platforms for sample identification and IOC enrichment\n- **KAPE (Kroll Artifact Parser and Extractor)**: Forensic triage tool for rapid artifact collection from infected endpoints\n- **YARA**: Pattern-matching engine for creating custom malware detection rules based on observed indicators\n\n## Common Scenarios\n\n### Scenario: Emotet Loader Leading to Cobalt Strike Deployment\n\n**Context**: EDR detects a macro-enabled document that spawns PowerShell, downloads an Emotet DLL, which subsequently loads a Cobalt Strike beacon. Three hosts are infected within 45 minutes.\n\n**Approach**:\n1. Immediately isolate all three hosts and block C2 IPs at the perimeter\n2. Search email gateway for all recipients of the original phishing email and quarantine it\n3. Sweep all endpoints for the Emotet DLL hash and Cobalt Strike beacon indicators\n4. Analyze the Cobalt Strike beacon configuration to extract watermark, C2 profile, and staging URLs\n5. Check for credential harvesting (Mimikatz\u002FLSASS dump) and lateral movement artifacts\n6. Eradicate all malware artifacts and reset credentials for affected users\n\n**Pitfalls**:\n- Focusing only on Emotet and missing the Cobalt Strike second-stage payload\n- Failing to extract and block the Cobalt Strike Malleable C2 profile indicators\n- Not checking for additional persistence beyond the initial detection (Emotet often installs multiple backup persistence mechanisms)\n\n## Output Format\n\n```\nMALWARE INCIDENT RESPONSE REPORT\n=================================\nIncident:         INC-2025-1547\nMalware Family:   Qakbot (variant: Obama265)\nDelivery Vector:  Spearphishing attachment (Invoice-Nov2025.docm)\nFirst Detection:  2025-11-15T14:23:17Z\nScope:            4 endpoints confirmed infected\n\nINFECTION TIMELINE\n14:18 UTC - Phishing email received by jsmith@corp.example.com\n14:19 UTC - Macro executed in WINWORD.EXE\n14:20 UTC - PowerShell downloads update.exe from staging server\n14:21 UTC - update.exe establishes persistence (Scheduled Task)\n14:23 UTC - C2 beacon initiated to 185.220.101[.]42\n14:35 UTC - Lateral spread to WKSTN-087 via stolen credentials\n14:42 UTC - EDR detection fires, SOC alerted\n\nIOCs EXTRACTED\nFile Hashes:  [SHA-256 list]\nC2 Domains:   [domain list]\nC2 IPs:       [IP list]\nFile Paths:   [artifact paths]\n\nERADICATION STATUS\n[x] All malware artifacts removed from 4 hosts\n[x] Persistence mechanisms deleted\n[x] C2 infrastructure blocked\n[x] Compromised credentials reset\n[x] Email quarantined from all mailboxes\n\nRECOMMENDATIONS\n1. Deploy YARA rule for Qakbot variant detection\n2. Block macro execution in documents from external senders\n3. Implement application whitelisting on finance workstations\n```\n","# Conducting-Malware-Incident-Response\n\n## Overview\nResponds to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing eradication procedures. Covers the full lifecycle from detection through containment, analysis, removal, and recovery. Activates for requests involving malware response, malware eradication, trojan removal, worm containment, malware triage, or infected endpoint remediation.\n\n\n\n# Conducting Malware Incident Response\n\n## When to Use\n\n- EDR or antivirus detects malware execution on one or more endpoints\n- A user reports suspicious system behavior indicative of malware infection\n- Threat intelligence indicates a malware campaign targeting the organization's industry\n- Network monitoring detects beaconing traffic consistent with known malware C2 patterns\n- A file detonation in a sandbox returns a malicious verdict\n\n**Do not use** for analyzing malware samples in a research context; use dedicated malware analysis procedures for reverse engineering.\n\n## Prerequisites\n\n- EDR platform with process tree visibility and host isolation capability\n- Malware sandbox environment (Cuckoo, ANY.RUN, Joe Sandbox, Hybrid Analysis)\n- Access to threat intelligence platforms for malware family identification (VirusTotal, MalwareBazaar)\n- Forensic imaging tools for evidence preservation (FTK Imager, KAPE)\n- Clean system images or gold images for endpoint rebuild\n- MITRE ATT&CK framework reference for technique mapping\n\n## Workflow\n\n### Step 1: Detect and Confirm Malware Presence\n\nValidate the malware alert and gather initial indicators:\n\n- Review EDR alert details: detection name, file path, hash (SHA-256), process tree\n- Check if the detection is a known malware family or generic heuristic detection\n- Query the file hash against VirusTotal, MalwareBazaar, and internal threat intelligence\n- Examine the process execution chain to determine how the malware was delivered\n\n```\nDetection Summary:\nFile:        C:\\Users\\jsmith\\AppData\\Local\\Temp\\update.exe\nSHA-256:     a1b2c3d4e5f6...\nDetection:   CrowdStrike: Malware\u002FQakbot | VirusTotal: 58\u002F72 engines\nParent:      WINWORD.EXE → cmd.exe → powershell.exe → update.exe\nDelivery:    Email attachment (Invoice-Nov2025.docm)\nNetwork:     HTTPS POST to 185.220.101[.]42:443 every 60s\nPersistence: Scheduled Task \"WindowsUpdate\" → update.exe\n```\n\n### Step 2: Scope the Infection\n\nDetermine how many systems are affected and the malware's propagation method:\n\n- Use EDR to search for the malware hash, filename, and behavioral indicators across all endpoints\n- Check for network-based spreading (SMB, WMI, PsExec, exploitation)\n- Query email gateway logs for all recipients of the delivery email\n- Search for C2 communications to the identified infrastructure from other internal hosts\n- Check for persistence mechanisms on all identified infected hosts\n\n### Step 3: Contain Infected Systems\n\nExecute containment per the active breach containment procedures:\n\n- Network-isolate infected endpoints via EDR containment\n- Block malware C2 infrastructure at firewall and DNS\n- Block the malware hash in EDR prevention policy organization-wide\n- Quarantine the delivery email from all mailboxes (if email-delivered)\n- Disable compromised user accounts if credential theft is suspected\n\n### Step 4: Analyze the Malware\n\nPerform sufficient analysis to support complete eradication:\n\n- Submit the sample to a sandbox for dynamic analysis (behavioral report, dropped files, network IOCs)\n- Identify all persistence mechanisms: registry keys, scheduled tasks, services, WMI subscriptions, startup folders\n- Document all file system artifacts: dropped files, modified files, created directories\n- Extract network IOCs: C2 domains, IPs, URLs, user agents, JA3\u002FJA3S hashes\n- Map observed behaviors to MITRE ATT&CK techniques\n\n```\nMalware Analysis Summary - Qakbot Variant\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nInitial Access:   T1566.001 - Spearphishing Attachment (.docm)\nExecution:        T1059.001 - PowerShell (encoded downloader)\nPersistence:      T1053.005 - Scheduled Task\nDefense Evasion:  T1055.012 - Process Hollowing (explorer.exe)\nC2:               T1071.001 - HTTPS with custom headers\nCollection:       T1005 - Data from Local System (browser credentials)\nExfiltration:     T1041 - Exfiltration Over C2 Channel\n\nArtifacts:\n- C:\\Users\\*\\AppData\\Local\\Temp\\update.exe (dropper)\n- C:\\ProgramData\\Microsoft\\{GUID}\\config.dll (payload)\n- HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\{random} (backup persistence)\n- Scheduled Task: \"WindowsUpdate\" (primary persistence)\n```\n\n### Step 5: Eradicate the Malware\n\nRemove all malware artifacts from every infected system:\n\n- Terminate malicious processes and injected threads\n- Delete malware files from all identified paths\n- Remove persistence mechanisms (scheduled tasks, registry keys, services, WMI subscriptions)\n- Clear browser credential stores if credential harvesting was confirmed\n- Run a full EDR scan to verify no artifacts remain\n- If eradication confidence is low, reimage the system from a known-clean gold image\n\n### Step 6: Recover and Validate\n\nRestore systems to production and verify clean status:\n\n- Reconnect contained systems to the network in stages\n- Monitor for 72 hours for any recurrence of malware indicators\n- Force password resets for all users on infected endpoints\n- Verify that C2 traffic has completely ceased across the environment\n- Update detection rules based on newly discovered IOCs from the investigation\n- Distribute IOCs to threat intelligence sharing partners (ISAC, MISP)\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.g., Qakbot, Emotet, Cobalt Strike) |\n| **Process Hollowing** | Technique where malware creates a legitimate process in a suspended state, replaces its memory with malicious code, then resumes execution |\n| **Beacon** | Periodic network communication from malware to its C2 server, typically with a set interval and jitter for detection evasion |\n| **Dropper** | Initial malware component that downloads or unpacks the primary payload; often delivered via phishing |\n| **Persistence Mechanism** | Method used by malware to survive system reboots (registry run keys, scheduled tasks, services, WMI event subscriptions) |\n| **IOC (Indicator of Compromise)** | Observable artifact such as file hash, IP address, domain, or registry key that indicates malware presence |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon \u002F Microsoft Defender for Endpoint**: EDR platforms for detection, containment, and threat hunting\n- **ANY.RUN \u002F Joe Sandbox**: Interactive malware sandboxes for dynamic behavioral analysis\n- **VirusTotal \u002F MalwareBazaar**: Malware intelligence platforms for sample identification and IOC enrichment\n- **KAPE (Kroll Artifact Parser and Extractor)**: Forensic triage tool for rapid artifact collection from infected endpoints\n- **YARA**: Pattern-matching engine for creating custom malware detection rules based on observed indicators\n\n## Common Scenarios\n\n### Scenario: Emotet Loader Leading to Cobalt Strike Deployment\n\n**Context**: EDR detects a macro-enabled document that spawns PowerShell, downloads an Emotet DLL, which subsequently loads a Cobalt Strike beacon. Three hosts are infected within 45 minutes.\n\n**Approach**:\n1. Immediately isolate all three hosts and block C2 IPs at the perimeter\n2. Search email gateway for all recipients of the original phishing email and quarantine it\n3. Sweep all endpoints for the Emotet DLL hash and Cobalt Strike beacon indicators\n4. Analyze the Cobalt Strike beacon configuration to extract watermark, C2 profile, and staging URLs\n5. Check for credential harvesting (Mimikatz\u002FLSASS dump) and lateral movement artifacts\n6. Eradicate all malware artifacts and reset credentials for affected users\n\n**Pitfalls**:\n- Focusing only on Emotet and missing the Cobalt Strike second-stage payload\n- Failing to extract and block the Cobalt Strike Malleable C2 profile indicators\n- Not checking for additional persistence beyond the initial detection (Emotet often installs multiple backup persistence mechanisms)\n\n## Output Format\n\n```\nMALWARE INCIDENT RESPONSE REPORT\n=================================\nIncident:         INC-2025-1547\nMalware Family:   Qakbot (variant: Obama265)\nDelivery Vector:  Spearphishing attachment (Invoice-Nov2025.docm)\nFirst Detection:  2025-11-15T14:23:17Z\nScope:            4 endpoints confirmed infected\n\nINFECTION TIMELINE\n14:18 UTC - Phishing email received by jsmith@corp.example.com\n14:19 UTC - Macro executed in WINWORD.EXE\n14:20 UTC - PowerShell downloads update.exe from staging server\n14:21 UTC - update.exe establishes persistence (Scheduled Task)\n14:23 UTC - C2 beacon initiated to 185.220.101[.]42\n14:35 UTC - Lateral spread to WKSTN-087 via stolen credentials\n14:42 UTC - EDR detection fires, SOC alerted\n\nIOCs EXTRACTED\nFile Hashes:  [SHA-256 list]\nC2 Domains:   [domain list]\nC2 IPs:       [IP list]\nFile Paths:   [artifact paths]\n\nERADICATION STATUS\n[x] All malware artifacts removed from 4 hosts\n[x] Persistence mechanisms deleted\n[x] C2 infrastructure blocked\n[x] Compromised credentials reset\n[x] Email quarantined from all mailboxes\n\nRECOMMENDATIONS\n1. Deploy YARA rule for Qakbot variant detection\n2. Block macro execution in documents from external senders\n3. Implement application whitelisting on finance workstations\n```\n",{"name":5,"tags":44,"author":46,"domain":24,"license":15,"version":47,"category":5,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54,"d3fend_techniques":60},[36,45,34,33,38],"malware-analysis","mahipal","1.0.0",[49,50,51,52],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response",[55,56,57,58,59],"T1204","T1027","T1055","T1059","T1486",[61,62,63,64,65],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fconducting-malware-incident-response",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill conducting-malware-incident-response",{"tool":80,"command":81},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill conducting-malware-incident-response",{"tool":83,"command":84},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill conducting-malware-incident-response","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fconducting-malware-incident-response\u002FSKILL.md",true,[88,93,99],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fconducting-malware-incident-response\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",1763,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fconducting-malware-incident-response\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",7313,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fconducting-malware-incident-response\u002Fscripts\u002Fagent.py",[106,135,160,180,196,217],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":117,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[118,119,120,121,122,123,24,124,125,126,53,127,128,129,130,131,132,21,133,134],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","ransomware","detection","t1078","t1490","disaster-recovery","restore","disaster recovery","ransomware response",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[142,143,144,145,146,24,147,148,149,150,151,35,152,153,154,155,156,157,158,159],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[167,168,21,24,169,170,171,129,130,31,172,173,174,175,176,29,177,178,179,23],"security","triaging security incident","actions","soc","NIST","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","isolation","scope","impact",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[167,187,188,168,21,146,24,189,170,53,190,191,129,130,192,172,155,193,194,195],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[167,203,204,205,206,207,24,208,209,210,170,211,129,212,213,214,175,215,21,216],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":223,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[224,225,226,227,24,228,229,230,231,232,233,212,30,234,215,235,216,236,237,238],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","exploit","intelligence","domains","kit","hosts"]