[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73DMVC33JHP6BYCVB8214XJ":3,"skill-same:01M73DMVC33JHP6BYCVB8214XJ":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M73DMVC33JHP6BYCVB8214XJ","mapping-mitre-attack-techniques",null,"Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: mapping-mitre-attack-techniques\ndescription: 'Maps observed adversary behaviors, security alerts, and detection rules\n  to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and\n  guide control prioritization. Use when building an ATT&CK-based coverage heatmap,\n  tagging SIEM alerts with technique IDs, aligning security controls to adversary\n  playbooks, or reporting threat exposure to executives. Activates for requests involving\n  ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.\n\n  '\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- MITRE-ATT&CK\n- ATT&CK-Navigator\n- Sigma\n- D3FEND\n- TTP\n- detection-engineering\n- NIST-CSF\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1685.002\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n# Mapping MITRE ATT&CK Techniques\n\n## When to Use\n\nUse this skill when:\n- Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses\n- Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting\n- Aligning your security program roadmap to specific adversary groups known to target your sector\n\n**Do not use** this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.\n\n## Prerequisites\n\n- Access to MITRE ATT&CK knowledge base (https:\u002F\u002Fattack.mitre.org) or local ATT&CK STIX data bundle\n- ATT&CK Navigator web app or local installation (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F)\n- Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage\n- ATT&CK Python library: `pip install mitreattack-python`\n\n## Workflow\n\n### Step 1: Obtain Current ATT&CK Data\n\nDownload the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):\n```bash\ncurl -o enterprise-attack.json \\\n  https:\u002F\u002Fraw.githubusercontent.com\u002Fmitre\u002Fcti\u002Fmaster\u002Fenterprise-attack\u002Fenterprise-attack.json\n```\n\nUse the mitreattack-python library to query techniques programmatically:\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nmitre = MitreAttackData(\"enterprise-attack.json\")\ntechniques = mitre.get_techniques(remove_revoked_deprecated=True)\nfor t in techniques[:5]:\n    print(t[\"external_references\"][0][\"external_id\"], t[\"name\"])\n```\n\n### Step 2: Map Existing Detections to Techniques\n\nFor each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging:\n```yaml\ntags:\n  - attack.execution\n  - attack.t1059.001  # PowerShell\n  - attack.t1059.003  # Windows Command Shell\n```\n\nCreate a coverage matrix: list each technique ID and mark as: Detected (alert fires), Logged (data present but no alert), Blind (no data source).\n\n### Step 3: Prioritize Coverage Gaps Using Threat Intelligence\n\nCross-reference coverage gaps with adversary groups targeting your sector. Use ATT&CK Groups data:\n```python\ngroups = mitre.get_groups()\napt29 = mitre.get_object_by_attack_id(\"G0016\", \"groups\")\napt29_techniques = mitre.get_techniques_used_by_group(apt29)\nfor t in apt29_techniques:\n    print(t[\"object\"][\"external_references\"][0][\"external_id\"])\n```\n\nPrioritize adding detection for techniques used by high-priority threat groups where your coverage is blind.\n\n### Step 4: Build Navigator Heatmap\n\nExport coverage scores as ATT&CK Navigator JSON layer:\n```python\nimport json\n\nlayer = {\n    \"name\": \"SOC Detection Coverage Q1 2025\",\n    \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"techniques\": [\n        {\"techniqueID\": \"T1059.001\", \"score\": 100, \"comment\": \"Splunk rule: PS_Encoded_Command\"},\n        {\"techniqueID\": \"T1071.001\", \"score\": 50, \"comment\": \"Logged only, no alert\"},\n        {\"techniqueID\": \"T1055\", \"score\": 0, \"comment\": \"No coverage — blind spot\"}\n    ],\n    \"gradient\": {\"colors\": [\"#ff6666\", \"#ffe766\", \"#8ec843\"], \"minValue\": 0, \"maxValue\": 100}\n}\nwith open(\"coverage_layer.json\", \"w\") as f:\n    json.dump(layer, f)\n```\n\nImport layer into ATT&CK Navigator (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F) for visualization.\n\n### Step 5: Generate Executive Coverage Report\n\nSummarize coverage by tactic category (Initial Access, Execution, Persistence, etc.) with counts and percentages. Provide a risk-ranked list of top 10 blind-spot techniques based on adversary group usage frequency. Recommend data source additions (e.g., \"Enable PowerShell Script Block Logging to address 12 Execution sub-technique gaps\").\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **ATT&CK Technique** | Specific adversary method identified by T-number (e.g., T1059 = Command and Scripting Interpreter) |\n| **Sub-technique** | More granular variant of a technique (e.g., T1059.001 = PowerShell, T1059.003 = Windows Command Shell) |\n| **Tactic** | Adversary goal category in ATT&CK: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C&C, Exfiltration, Impact |\n| **Data Source** | ATT&CK v10+ component identifying telemetry required to detect a technique (e.g., Process Creation, Network Traffic) |\n| **Coverage Score** | Numeric (0–100) representing detection completeness for a technique: 0=blind, 50=logged only, 100=alerted |\n| **MITRE D3FEND** | Defensive countermeasure ontology complementing ATT&CK — maps defensive techniques to attack techniques they mitigate |\n\n## Tools & Systems\n\n- **ATT&CK Navigator**: Browser-based heatmap visualization tool for layering coverage scores and annotations on the ATT&CK matrix\n- **mitreattack-python**: Official MITRE Python library for programmatic access to ATT&CK STIX data (techniques, groups, software, mitigations)\n- **Atomic Red Team**: MITRE-aligned test library providing atomic test cases to validate detection for each technique\n- **Sigma**: Detection rule format with ATT&CK tagging support; translatable to Splunk, Sentinel, QRadar, Elastic\n- **ATT&CK Workbench**: Self-hosted ATT&CK knowledge base for organizations maintaining custom technique extensions\n\n## Common Pitfalls\n\n- **Over-claiming coverage**: Logging a data source (e.g., process creation events) does not mean the associated technique is detected — a rule must actually fire on malicious patterns.\n- **Mapping at tactic level only**: Tagging a rule as \"attack.execution\" without a specific technique ID prevents granular gap analysis.\n- **Ignoring sub-techniques**: Many adversaries use specific sub-techniques. Coverage of T1059 (parent) doesn't imply coverage of T1059.005 (Visual Basic).\n- **Static mapping without updates**: ATT&CK releases major versions annually. Coverage maps go stale as techniques are added, revised, or deprecated.\n- **Not mapping to adversary groups**: Generic coverage maps don't distinguish between techniques used by APTs targeting your sector vs. commodity malware.\n","# Mapping MITRE ATT&CK Techniques\n\n## When to Use\n\nUse this skill when:\n- Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses\n- Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting\n- Aligning your security program roadmap to specific adversary groups known to target your sector\n\n**Do not use** this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.\n\n## Prerequisites\n\n- Access to MITRE ATT&CK knowledge base (https:\u002F\u002Fattack.mitre.org) or local ATT&CK STIX data bundle\n- ATT&CK Navigator web app or local installation (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F)\n- Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage\n- ATT&CK Python library: `pip install mitreattack-python`\n\n## Workflow\n\n### Step 1: Obtain Current ATT&CK Data\n\nDownload the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):\n```bash\ncurl -o enterprise-attack.json \\\n  https:\u002F\u002Fraw.githubusercontent.com\u002Fmitre\u002Fcti\u002Fmaster\u002Fenterprise-attack\u002Fenterprise-attack.json\n```\n\nUse the mitreattack-python library to query techniques programmatically:\n```python\nfrom mitreattack.stix20 import MitreAttackData\n\nmitre = MitreAttackData(\"enterprise-attack.json\")\ntechniques = mitre.get_techniques(remove_revoked_deprecated=True)\nfor t in techniques[:5]:\n    print(t[\"external_references\"][0][\"external_id\"], t[\"name\"])\n```\n\n### Step 2: Map Existing Detections to Techniques\n\nFor each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging:\n```yaml\ntags:\n  - attack.execution\n  - attack.t1059.001  # PowerShell\n  - attack.t1059.003  # Windows Command Shell\n```\n\nCreate a coverage matrix: list each technique ID and mark as: Detected (alert fires), Logged (data present but no alert), Blind (no data source).\n\n### Step 3: Prioritize Coverage Gaps Using Threat Intelligence\n\nCross-reference coverage gaps with adversary groups targeting your sector. Use ATT&CK Groups data:\n```python\ngroups = mitre.get_groups()\napt29 = mitre.get_object_by_attack_id(\"G0016\", \"groups\")\napt29_techniques = mitre.get_techniques_used_by_group(apt29)\nfor t in apt29_techniques:\n    print(t[\"object\"][\"external_references\"][0][\"external_id\"])\n```\n\nPrioritize adding detection for techniques used by high-priority threat groups where your coverage is blind.\n\n### Step 4: Build Navigator Heatmap\n\nExport coverage scores as ATT&CK Navigator JSON layer:\n```python\nimport json\n\nlayer = {\n    \"name\": \"SOC Detection Coverage Q1 2025\",\n    \"versions\": {\"attack\": \"14\", \"navigator\": \"4.9\", \"layer\": \"4.5\"},\n    \"domain\": \"enterprise-attack\",\n    \"techniques\": [\n        {\"techniqueID\": \"T1059.001\", \"score\": 100, \"comment\": \"Splunk rule: PS_Encoded_Command\"},\n        {\"techniqueID\": \"T1071.001\", \"score\": 50, \"comment\": \"Logged only, no alert\"},\n        {\"techniqueID\": \"T1055\", \"score\": 0, \"comment\": \"No coverage — blind spot\"}\n    ],\n    \"gradient\": {\"colors\": [\"#ff6666\", \"#ffe766\", \"#8ec843\"], \"minValue\": 0, \"maxValue\": 100}\n}\nwith open(\"coverage_layer.json\", \"w\") as f:\n    json.dump(layer, f)\n```\n\nImport layer into ATT&CK Navigator (https:\u002F\u002Fmitre-attack.github.io\u002Fattack-navigator\u002F) for visualization.\n\n### Step 5: Generate Executive Coverage Report\n\nSummarize coverage by tactic category (Initial Access, Execution, Persistence, etc.) with counts and percentages. Provide a risk-ranked list of top 10 blind-spot techniques based on adversary group usage frequency. Recommend data source additions (e.g., \"Enable PowerShell Script Block Logging to address 12 Execution sub-technique gaps\").\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **ATT&CK Technique** | Specific adversary method identified by T-number (e.g., T1059 = Command and Scripting Interpreter) |\n| **Sub-technique** | More granular variant of a technique (e.g., T1059.001 = PowerShell, T1059.003 = Windows Command Shell) |\n| **Tactic** | Adversary goal category in ATT&CK: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C&C, Exfiltration, Impact |\n| **Data Source** | ATT&CK v10+ component identifying telemetry required to detect a technique (e.g., Process Creation, Network Traffic) |\n| **Coverage Score** | Numeric (0–100) representing detection completeness for a technique: 0=blind, 50=logged only, 100=alerted |\n| **MITRE D3FEND** | Defensive countermeasure ontology complementing ATT&CK — maps defensive techniques to attack techniques they mitigate |\n\n## Tools & Systems\n\n- **ATT&CK Navigator**: Browser-based heatmap visualization tool for layering coverage scores and annotations on the ATT&CK matrix\n- **mitreattack-python**: Official MITRE Python library for programmatic access to ATT&CK STIX data (techniques, groups, software, mitigations)\n- **Atomic Red Team**: MITRE-aligned test library providing atomic test cases to validate detection for each technique\n- **Sigma**: Detection rule format with ATT&CK tagging support; translatable to Splunk, Sentinel, QRadar, Elastic\n- **ATT&CK Workbench**: Self-hosted ATT&CK knowledge base for organizations maintaining custom technique extensions\n\n## Common Pitfalls\n\n- **Over-claiming coverage**: Logging a data source (e.g., process creation events) does not mean the associated technique is detected — a rule must actually fire on malicious patterns.\n- **Mapping at tactic level only**: Tagging a rule as \"attack.execution\" without a specific technique ID prevents granular gap analysis.\n- **Ignoring sub-techniques**: Many adversaries use specific sub-techniques. Coverage of T1059 (parent) doesn't imply coverage of T1059.005 (Visual Basic).\n- **Static mapping without updates**: ATT&CK releases major versions annually. Coverage maps go stale as techniques are added, revised, or deprecated.\n- **Not mapping to adversary groups**: Generic coverage maps don't distinguish between techniques used by APTs targeting your sector vs. commodity malware.\n",{"name":5,"tags":25,"author":33,"domain":34,"source":35,"license":15,"version":36,"nist_csf":37,"subdomain":42,"description":43,"nist_ai_rmf":44,"mitre_attack":48,"source_commit":54,"atlas_techniques":55,"d3fend_techniques":59},[26,27,28,29,30,31,32],"MITRE-ATT&CK","ATT&CK-Navigator","Sigma","D3FEND","TTP","detection-engineering","NIST-CSF","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0.0",[38,39,40,41],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02","threat-intelligence","Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.\n",[45,46,47],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[49,50,51,52,53],"T1591","T1592","T1593","T1589","T1685.002","04450304b12645cb2b974ab96d28c0664758a88d",[56,57,58],"AML.T0070","AML.T0066","AML.T0082",[60,61,62,63,64],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fmapping-mitre-attack-techniques",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-14 13:24:09",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill mapping-mitre-attack-techniques",{"tool":81,"command":82},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill mapping-mitre-attack-techniques",{"tool":84,"command":85},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill mapping-mitre-attack-techniques","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fmapping-mitre-attack-techniques\u002FSKILL.md",true,[89,93,99],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",2708,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fmapping-mitre-attack-techniques\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",7754,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fmapping-mitre-attack-techniques\u002Fscripts\u002Fagent.py",[106,114,121,129,137,145],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":125,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":141,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":146,"name":147,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]