[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7B68AGG0SCGSJSQ37SPPMAD":3,"skill-same:01M7B68AGG0SCGSJSQ37SPPMAD":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":15,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":13,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":45,"install":46,"resources":59},"01M7B68AGG0SCGSJSQ37SPPMAD","detecting-secure-boot-bypass",null,"Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar\u002Fdbxtool, CHIPSEC, sbverify\u002Fpesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.","vikasvardhanv\u002Fjerry_skills","vikasvardhanv","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F99010657?v=4","01M7B2B0VN78W7529RQX5BR6DZ","01M7B2B0WDNTXJHRK3QNPNWRP6",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: detecting-secure-boot-bypass\ndescription: Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and\n  Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and\n  hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar\u002Fdbxtool,\n  CHIPSEC, sbverify\u002Fpesign, and Windows Confirm-SecureBootUEFI. Use when auditing\n  fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on\n  a suspected-compromised endpoint.\ndomain: cybersecurity\nsubdomain: hardware-firmware-security\ntags:\n- hardware-firmware-security\n- secure-boot\n- uefi\n- bootkit\n- dbx-revocation\n- blacklotus\n- chipsec\n- firmware-integrity\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1542.003\n---\n# Detecting Secure Boot Bypass\n\n> **Legal Notice:** Firmware and Secure Boot assessment must only be performed on systems you own or are explicitly authorized to test. CHIPSEC's write\u002Fmodify modes and EFI variable manipulation can brick hardware. Run destructive checks only in a lab. This skill is for defensive verification and authorized assessment.\n\n## Overview\n\nUEFI Secure Boot is the firmware-enforced trust chain that only permits boot components signed by keys in the platform's allow-list (db) and not present in the revocation list (dbx). Bootkits defeat this layer to gain pre-OS, persistent, kernel-level control that survives OS reinstalls and disk wipes. **BlackLotus** (2023) was the first publicly observed UEFI bootkit to bypass Secure Boot on fully patched Windows 11, abusing **CVE-2022-21894** (\"baton drop\") in a vulnerable, signed Windows boot manager to neutralize Secure Boot and disable BitLocker, HVCI, and Defender. **Bootkitty** (2024) was the first PoC UEFI bootkit targeting Linux. Microsoft's **CVE-2023-24932** addressed a related Secure Boot bypass that required a phased dbx (revocation) rollout because revoking the vulnerable boot managers can render systems unbootable if applied carelessly.\n\nThe core defensive insight is that patching the OS is **not sufficient** — the platform remains exploitable until the vulnerable, signed binaries are revoked in **dbx**. Detection therefore combines: (1) confirming Secure Boot is actually enabled, (2) verifying dbx is current and contains the relevant revocations, (3) checking the integrity and protection of Secure Boot EFI variables with CHIPSEC, (4) hashing on-disk EFI boot binaries and comparing them against the revocation list and known-bad sets, and (5) inspecting firmware\u002FESP for bootkit artifacts. This skill provides a cross-platform (Linux + Windows) workflow using `mokutil`, `efi-readvar`\u002F`dbxtool`, `chipsec`, `sbverify`\u002F`pesign`, and Windows `Confirm-SecureBootUEFI` \u002F `Get-SecureBootUEFI`.\n\n## When to Use\n\n- Verifying that an estate's Secure Boot configuration is enabled, locked, and current after the CVE-2023-24932 \u002F BlackLotus advisories.\n- Hunting for UEFI bootkit indicators on a suspected-compromised endpoint.\n- Validating that dbx revocations (e.g., vulnerable Windows boot managers, Kaspersky\u002Fother vulnerable bootloaders) have actually applied across the fleet.\n- Auditing firmware integrity and Secure Boot variable protections during a hardware security assessment.\n- Building a recurring measured\u002Fbaseline check for boot-chain tampering.\n\n## Prerequisites\n\n- Root\u002Fadministrator on the target (firmware reads require privilege).\n- Linux tooling:\n  ```bash\n  sudo apt install mokutil efitools sbsigntool dbxtool      # Debian\u002FUbuntu\n  sudo dnf install mokutil efitools sbsigntools dbxtool     # Fedora\u002FRHEL\n  ```\n- CHIPSEC (run from a live USB or controlled host; loads a kernel driver):\n  ```bash\n  pip install chipsec        # or build from https:\u002F\u002Fgithub.com\u002Fchipsec\u002Fchipsec\n  ```\n- Windows tooling: PowerShell (built-in `Confirm-SecureBootUEFI`, `Get-SecureBootUEFI`), and optionally the UEFI dbx update package from Microsoft.\n- The current `dbxupdate` files from https:\u002F\u002Fuefi.org\u002Frevocationlistfile to compare against.\n\n## Objectives\n\n- Confirm Secure Boot is enabled and in user (not setup) mode.\n- Enumerate db, dbx, KEK, and PK contents and assess freshness of dbx.\n- Verify the relevant CVE revocations are present in dbx.\n- Validate Secure Boot EFI variables are authenticated and protected (CHIPSEC).\n- Hash ESP boot binaries and check them against dbx and known-bad hash sets.\n- Identify bootkit artifacts and report exploitable gaps with remediation.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | Relevance |\n|--------------|----------------|-----------|\n| T1542.003 | Pre-OS Boot: Bootkit | Core technique — bootkit subverts the boot chain below the OS. |\n| T1542 | Pre-OS Boot | Parent technique covering firmware\u002Fboot-component tampering. |\n| T1542.001 | Pre-OS Boot: System Firmware | Adjacent: firmware modification used to persist or weaken Secure Boot. |\n| T1014 | Rootkit | Bootkits provide rootkit-level concealment and persistence. |\n| T1562.001 | Impair Defenses: Disable or Modify Tools | BlackLotus disables BitLocker\u002FHVCI\u002FDefender after bypassing Secure Boot. |\n\n## Workflow\n\n### 1. Confirm Secure Boot state (Linux)\nA disabled or setup-mode platform offers no protection.\n```bash\nmokutil --sb-state                       # \"SecureBoot enabled\" expected\nbootctl status | grep -i \"secure boot\"   # systemd-boot view\n# 6 = enabled+user mode on the EFI SecureBoot\u002FSetupMode vars:\nod -An -t u1 \u002Fsys\u002Ffirmware\u002Fefi\u002Fefivars\u002FSecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c\n```\n\n### 2. Confirm Secure Boot state (Windows)\n```powershell\nConfirm-SecureBootUEFI        # $true if enabled\n# Inspect the raw dbx variable from Windows:\n[System.BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) | Out-File dbx.hex\n```\n\n### 3. Enumerate the Secure Boot databases\nList db (allowed), dbx (revoked), KEK, and PK.\n```bash\nefi-readvar                      # dumps PK, KEK, db, dbx\nefi-readvar -v dbx -o dbx.esl    # export dbx to a file for offline analysis\nmokutil --list-enrolled          # MOK (shim) enrolled keys\nmokutil --db                     # platform db entries via shim\n```\n\n### 4. Assess dbx freshness and applied revocations\nCompare on-system dbx to the current official UEFI revocation list.\n```bash\ndbxtool --list                                   # current dbx entries + count\n# Download latest dbxupdate from uefi.org\u002Frevocationlistfile, then:\ndbxtool --dbx .\u002FDBXUpdate.bin --apply --dry-run  # show what WOULD be added (no write)\n```\nA low dbx entry count or absence of recent revocations indicates the platform is behind and likely still vulnerable to known bypasses.\n\n### 5. Check Secure Boot variable protection with CHIPSEC\nVerify the SB key variables are authenticated and not freely writable.\n```bash\n# Verify Secure Boot is enabled and the SB variables are properly protected:\nsudo chipsec_main -m common.secureboot.variables\n\n# Check S3 resume boot-script protections (an SMM\u002Ffirmware bypass vector):\nsudo chipsec_main -m common.uefi.s3bootscript\n\n# Dump SPI flash for offline firmware diffing:\nsudo chipsec_util spi dump rom.bin\n```\n\n### 6. Hash ESP boot binaries and check signatures\nVerify bootloaders are signed and not present in dbx.\n```bash\n# Locate and hash EFI boot binaries\nfind \u002Fboot\u002Fefi -iname '*.efi' -exec sha256sum {} \\;\n# Validate a binary's signature against the platform db\nsbverify --list \u002Fboot\u002Fefi\u002FEFI\u002FBOOT\u002Fbootx64.efi\nsbverify --cert \u002Fetc\u002Fsecureboot\u002Fdb.crt \u002Fboot\u002Fefi\u002FEFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi\n# pesign equivalent on RHEL-family:\npesign -S -i \u002Fboot\u002Fefi\u002FEFI\u002FBOOT\u002Fbootx64.efi\n```\n\n### 7. Cross-check against known-bad bootkit hashes\nCompare collected hashes to revocation\u002Fknown-bad sets (e.g., LoFP \u002F vendor advisories).\n```bash\n# Example: confirm a binary's SHA-256 is NOT one of the revoked CVE-2022-21894 boot managers\nsha256sum \u002Fboot\u002Fefi\u002FEFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi\n# Compare against the hash list extracted from the latest dbxupdate \u002F advisory.\n```\n\n### 8. Inspect for bootkit artifacts\nLook for unauthorized ESP modifications and self-deployment markers.\n```bash\n# Unexpected files \u002F recently modified binaries on the ESP\nls -laR \u002Fboot\u002Fefi\u002FEFI\u002F\nfind \u002Fboot\u002Fefi -newermt \"-30 days\" -iname '*.efi'\n# On Windows, examine the EFI partition for rogue \\EFI\\Microsoft\\Boot entries.\n```\n\n### 9. Validate measured-boot evidence (optional pivot)\nIf a TPM is present, current PCR[7] reflects Secure Boot policy; deviations corroborate tampering.\n```bash\ntpm2_pcrread sha256:7        # Secure Boot policy PCR\n```\n\n### 10. Run the bundled assessment helper\n`agent.py` collects SB state, dbx counts, ESP binary hashes, and CHIPSEC results into one report.\n```bash\nsudo python scripts\u002Fagent.py --check-chipsec --output secureboot_report.json\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| mokutil | Secure Boot state and enrolled keys (Linux) | https:\u002F\u002Fgithub.com\u002Flcp\u002Fmokutil |\n| efitools (efi-readvar) | Dump PK\u002FKEK\u002Fdb\u002Fdbx | https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Fjejb\u002Fefitools.git |\n| dbxtool | Inspect and apply dbx updates | https:\u002F\u002Fgithub.com\u002Frhboot\u002Fdbxtool |\n| CHIPSEC | Firmware \u002F Secure Boot variable assessment | https:\u002F\u002Fgithub.com\u002Fchipsec\u002Fchipsec |\n| sbsigntool \u002F pesign | EFI binary signature verification | https:\u002F\u002Fgithub.com\u002Fjejb\u002Fsbsigntools |\n| UEFI Revocation List | Official dbx update files | https:\u002F\u002Fuefi.org\u002Frevocationlistfile |\n| Microsoft KB CVE-2023-24932 | Secure Boot bypass guidance | https:\u002F\u002Fsupport.microsoft.com\u002Ftopic\u002Fkb5025885 |\n| ESET BlackLotus analysis | Bootkit technical writeup | https:\u002F\u002Fwww.welivesecurity.com\u002F2023\u002F03\u002F01\u002Fblacklotus-uefi-bootkit-myth-confirmed\u002F |\n\n## Validation Criteria\n\n- [ ] Secure Boot confirmed enabled and in user mode on the target.\n- [ ] PK\u002FKEK\u002Fdb\u002Fdbx enumerated and exported for analysis.\n- [ ] dbx compared against the current official UEFI revocation list.\n- [ ] CVE-2022-21894 \u002F CVE-2023-24932 revocations confirmed present (or gap flagged).\n- [ ] CHIPSEC `secureboot.variables` and `s3bootscript` modules run.\n- [ ] ESP boot binaries hashed and signature-verified.\n- [ ] Hashes cross-checked against known-bad \u002F revoked sets.\n- [ ] ESP inspected for unauthorized or recently modified binaries.\n- [ ] Findings documented with remediation (dbx update \u002F firmware update) per host.\n","# Detecting Secure Boot Bypass\n\n> **Legal Notice:** Firmware and Secure Boot assessment must only be performed on systems you own or are explicitly authorized to test. CHIPSEC's write\u002Fmodify modes and EFI variable manipulation can brick hardware. Run destructive checks only in a lab. This skill is for defensive verification and authorized assessment.\n\n## Overview\n\nUEFI Secure Boot is the firmware-enforced trust chain that only permits boot components signed by keys in the platform's allow-list (db) and not present in the revocation list (dbx). Bootkits defeat this layer to gain pre-OS, persistent, kernel-level control that survives OS reinstalls and disk wipes. **BlackLotus** (2023) was the first publicly observed UEFI bootkit to bypass Secure Boot on fully patched Windows 11, abusing **CVE-2022-21894** (\"baton drop\") in a vulnerable, signed Windows boot manager to neutralize Secure Boot and disable BitLocker, HVCI, and Defender. **Bootkitty** (2024) was the first PoC UEFI bootkit targeting Linux. Microsoft's **CVE-2023-24932** addressed a related Secure Boot bypass that required a phased dbx (revocation) rollout because revoking the vulnerable boot managers can render systems unbootable if applied carelessly.\n\nThe core defensive insight is that patching the OS is **not sufficient** — the platform remains exploitable until the vulnerable, signed binaries are revoked in **dbx**. Detection therefore combines: (1) confirming Secure Boot is actually enabled, (2) verifying dbx is current and contains the relevant revocations, (3) checking the integrity and protection of Secure Boot EFI variables with CHIPSEC, (4) hashing on-disk EFI boot binaries and comparing them against the revocation list and known-bad sets, and (5) inspecting firmware\u002FESP for bootkit artifacts. This skill provides a cross-platform (Linux + Windows) workflow using `mokutil`, `efi-readvar`\u002F`dbxtool`, `chipsec`, `sbverify`\u002F`pesign`, and Windows `Confirm-SecureBootUEFI` \u002F `Get-SecureBootUEFI`.\n\n## When to Use\n\n- Verifying that an estate's Secure Boot configuration is enabled, locked, and current after the CVE-2023-24932 \u002F BlackLotus advisories.\n- Hunting for UEFI bootkit indicators on a suspected-compromised endpoint.\n- Validating that dbx revocations (e.g., vulnerable Windows boot managers, Kaspersky\u002Fother vulnerable bootloaders) have actually applied across the fleet.\n- Auditing firmware integrity and Secure Boot variable protections during a hardware security assessment.\n- Building a recurring measured\u002Fbaseline check for boot-chain tampering.\n\n## Prerequisites\n\n- Root\u002Fadministrator on the target (firmware reads require privilege).\n- Linux tooling:\n  ```bash\n  sudo apt install mokutil efitools sbsigntool dbxtool      # Debian\u002FUbuntu\n  sudo dnf install mokutil efitools sbsigntools dbxtool     # Fedora\u002FRHEL\n  ```\n- CHIPSEC (run from a live USB or controlled host; loads a kernel driver):\n  ```bash\n  pip install chipsec        # or build from https:\u002F\u002Fgithub.com\u002Fchipsec\u002Fchipsec\n  ```\n- Windows tooling: PowerShell (built-in `Confirm-SecureBootUEFI`, `Get-SecureBootUEFI`), and optionally the UEFI dbx update package from Microsoft.\n- The current `dbxupdate` files from https:\u002F\u002Fuefi.org\u002Frevocationlistfile to compare against.\n\n## Objectives\n\n- Confirm Secure Boot is enabled and in user (not setup) mode.\n- Enumerate db, dbx, KEK, and PK contents and assess freshness of dbx.\n- Verify the relevant CVE revocations are present in dbx.\n- Validate Secure Boot EFI variables are authenticated and protected (CHIPSEC).\n- Hash ESP boot binaries and check them against dbx and known-bad hash sets.\n- Identify bootkit artifacts and report exploitable gaps with remediation.\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Technique Name | Relevance |\n|--------------|----------------|-----------|\n| T1542.003 | Pre-OS Boot: Bootkit | Core technique — bootkit subverts the boot chain below the OS. |\n| T1542 | Pre-OS Boot | Parent technique covering firmware\u002Fboot-component tampering. |\n| T1542.001 | Pre-OS Boot: System Firmware | Adjacent: firmware modification used to persist or weaken Secure Boot. |\n| T1014 | Rootkit | Bootkits provide rootkit-level concealment and persistence. |\n| T1562.001 | Impair Defenses: Disable or Modify Tools | BlackLotus disables BitLocker\u002FHVCI\u002FDefender after bypassing Secure Boot. |\n\n## Workflow\n\n### 1. Confirm Secure Boot state (Linux)\nA disabled or setup-mode platform offers no protection.\n```bash\nmokutil --sb-state                       # \"SecureBoot enabled\" expected\nbootctl status | grep -i \"secure boot\"   # systemd-boot view\n# 6 = enabled+user mode on the EFI SecureBoot\u002FSetupMode vars:\nod -An -t u1 \u002Fsys\u002Ffirmware\u002Fefi\u002Fefivars\u002FSecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c\n```\n\n### 2. Confirm Secure Boot state (Windows)\n```powershell\nConfirm-SecureBootUEFI        # $true if enabled\n# Inspect the raw dbx variable from Windows:\n[System.BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) | Out-File dbx.hex\n```\n\n### 3. Enumerate the Secure Boot databases\nList db (allowed), dbx (revoked), KEK, and PK.\n```bash\nefi-readvar                      # dumps PK, KEK, db, dbx\nefi-readvar -v dbx -o dbx.esl    # export dbx to a file for offline analysis\nmokutil --list-enrolled          # MOK (shim) enrolled keys\nmokutil --db                     # platform db entries via shim\n```\n\n### 4. Assess dbx freshness and applied revocations\nCompare on-system dbx to the current official UEFI revocation list.\n```bash\ndbxtool --list                                   # current dbx entries + count\n# Download latest dbxupdate from uefi.org\u002Frevocationlistfile, then:\ndbxtool --dbx .\u002FDBXUpdate.bin --apply --dry-run  # show what WOULD be added (no write)\n```\nA low dbx entry count or absence of recent revocations indicates the platform is behind and likely still vulnerable to known bypasses.\n\n### 5. Check Secure Boot variable protection with CHIPSEC\nVerify the SB key variables are authenticated and not freely writable.\n```bash\n# Verify Secure Boot is enabled and the SB variables are properly protected:\nsudo chipsec_main -m common.secureboot.variables\n\n# Check S3 resume boot-script protections (an SMM\u002Ffirmware bypass vector):\nsudo chipsec_main -m common.uefi.s3bootscript\n\n# Dump SPI flash for offline firmware diffing:\nsudo chipsec_util spi dump rom.bin\n```\n\n### 6. Hash ESP boot binaries and check signatures\nVerify bootloaders are signed and not present in dbx.\n```bash\n# Locate and hash EFI boot binaries\nfind \u002Fboot\u002Fefi -iname '*.efi' -exec sha256sum {} \\;\n# Validate a binary's signature against the platform db\nsbverify --list \u002Fboot\u002Fefi\u002FEFI\u002FBOOT\u002Fbootx64.efi\nsbverify --cert \u002Fetc\u002Fsecureboot\u002Fdb.crt \u002Fboot\u002Fefi\u002FEFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi\n# pesign equivalent on RHEL-family:\npesign -S -i \u002Fboot\u002Fefi\u002FEFI\u002FBOOT\u002Fbootx64.efi\n```\n\n### 7. Cross-check against known-bad bootkit hashes\nCompare collected hashes to revocation\u002Fknown-bad sets (e.g., LoFP \u002F vendor advisories).\n```bash\n# Example: confirm a binary's SHA-256 is NOT one of the revoked CVE-2022-21894 boot managers\nsha256sum \u002Fboot\u002Fefi\u002FEFI\u002FMicrosoft\u002FBoot\u002Fbootmgfw.efi\n# Compare against the hash list extracted from the latest dbxupdate \u002F advisory.\n```\n\n### 8. Inspect for bootkit artifacts\nLook for unauthorized ESP modifications and self-deployment markers.\n```bash\n# Unexpected files \u002F recently modified binaries on the ESP\nls -laR \u002Fboot\u002Fefi\u002FEFI\u002F\nfind \u002Fboot\u002Fefi -newermt \"-30 days\" -iname '*.efi'\n# On Windows, examine the EFI partition for rogue \\EFI\\Microsoft\\Boot entries.\n```\n\n### 9. Validate measured-boot evidence (optional pivot)\nIf a TPM is present, current PCR[7] reflects Secure Boot policy; deviations corroborate tampering.\n```bash\ntpm2_pcrread sha256:7        # Secure Boot policy PCR\n```\n\n### 10. Run the bundled assessment helper\n`agent.py` collects SB state, dbx counts, ESP binary hashes, and CHIPSEC results into one report.\n```bash\nsudo python scripts\u002Fagent.py --check-chipsec --output secureboot_report.json\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| mokutil | Secure Boot state and enrolled keys (Linux) | https:\u002F\u002Fgithub.com\u002Flcp\u002Fmokutil |\n| efitools (efi-readvar) | Dump PK\u002FKEK\u002Fdb\u002Fdbx | https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Fjejb\u002Fefitools.git |\n| dbxtool | Inspect and apply dbx updates | https:\u002F\u002Fgithub.com\u002Frhboot\u002Fdbxtool |\n| CHIPSEC | Firmware \u002F Secure Boot variable assessment | https:\u002F\u002Fgithub.com\u002Fchipsec\u002Fchipsec |\n| sbsigntool \u002F pesign | EFI binary signature verification | https:\u002F\u002Fgithub.com\u002Fjejb\u002Fsbsigntools |\n| UEFI Revocation List | Official dbx update files | https:\u002F\u002Fuefi.org\u002Frevocationlistfile |\n| Microsoft KB CVE-2023-24932 | Secure Boot bypass guidance | https:\u002F\u002Fsupport.microsoft.com\u002Ftopic\u002Fkb5025885 |\n| ESET BlackLotus analysis | Bootkit technical writeup | https:\u002F\u002Fwww.welivesecurity.com\u002F2023\u002F03\u002F01\u002Fblacklotus-uefi-bootkit-myth-confirmed\u002F |\n\n## Validation Criteria\n\n- [ ] Secure Boot confirmed enabled and in user mode on the target.\n- [ ] PK\u002FKEK\u002Fdb\u002Fdbx enumerated and exported for analysis.\n- [ ] dbx compared against the current official UEFI revocation list.\n- [ ] CVE-2022-21894 \u002F CVE-2023-24932 revocations confirmed present (or gap flagged).\n- [ ] CHIPSEC `secureboot.variables` and `s3bootscript` modules run.\n- [ ] ESP boot binaries hashed and signature-verified.\n- [ ] Hashes cross-checked against known-bad \u002F revoked sets.\n- [ ] ESP inspected for unauthorized or recently modified binaries.\n- [ ] Findings documented with remediation (dbx update \u002F firmware update) per host.\n",{"name":5,"tags":24,"author":33,"domain":34,"license":14,"version":35,"nist_csf":36,"subdomain":25,"description":7,"mitre_attack":38},[25,26,27,28,29,30,31,32],"hardware-firmware-security","secure-boot","uefi","bootkit","dbx-revocation","blacklotus","chipsec","firmware-integrity","mahipal","cybersecurity","1.0",[37],"DE.CM-01",[39],"T1542.003","main","1eb986d0b0ecc180291597e08eb5a58288843536","skills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv","2026-08-25 13:16:33",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add vikasvardhanv\u002Fjerry_skills --skill detecting-secure-boot-bypass",{"tool":52,"command":53},"bunx","bunx skills add vikasvardhanv\u002Fjerry_skills --skill detecting-secure-boot-bypass",{"tool":55,"command":56},"pnpm","pnpm dlx skills add vikasvardhanv\u002Fjerry_skills --skill detecting-secure-boot-bypass","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass\u002FSKILL.md",true,[60,64,70,74],{"path":61,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":15},"LICENSE","许可证",11255,{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Fapi-reference.md","REFERENCE","参考文档",2221,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass\u002Freferences\u002Fapi-reference.md",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fstandards.md",1580,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass\u002Freferences\u002Fstandards.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"scripts\u002Fagent.py","SCRIPT","脚本",5269,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fdetecting-secure-boot-bypass\u002Fscripts\u002Fagent.py",[81,89,96,103,110,117],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M7BESR1CJ3H5SP9XM8KYJZ9W","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","MIT","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[],[],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M7BES1YA6R97W7QPMFFM1PED","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M7BERNHYGY035AR00VRT03KE","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[],[],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":19},"01M7BERCK1EAKTWW7R436WAR0J","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[],[],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":19},"01M7BEQZAZAQRTXFJRY7RHV3TY","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[],[],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":19},"01M7BEQKJ45K31QK5VRAQSVJCJ","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[],[]]