[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:sce6":3,"skills:pro6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:108:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",1,39458,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",13274,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,11,7,828772,"2026-11-13 04:10:52",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1926,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":191},196852,{"records":196,"total":194,"current":545,"size":546},[197,233,257,277,301,323,343,358,374,386,400,414,432,454,473,495,513,532],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":211,"publishedAt":232},"01M6AEVPSDBD7R3ZNYHB4G36XY","hunting-for-domain-fronting-c2-traffic","Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header mismatches in proxy logs and inspecting TLS certificate discrepancies with pyOpenSSL. Use when hunting for command-and-control traffic hidden behind legitimate CDN domains, or when investigating proxy\u002FTLS logs for signs of domain fronting evasion.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-domain-fronting-c2-traffic\u002FSKILL.md",[],[212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"c2","hunting for domain fronting c2 traffic","cybersecurity","http","protocol","proxy","cdn","logs","server","threat-hunting","command-and-control","analyzing","network","network-security","tls","detection","proxy-logs","domain-fronting","tls-inspection","pyopenssl","2026-11-10 10:12:30",{"skillNo":234,"name":235,"nameZh":13,"description":236,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":237,"categories":238,"keywords":242,"publishedAt":232},"01M6AEVK8T8KYAD62T1W7JN038","hunting-for-dns-tunneling-with-zeek","Detects DNS tunneling and covert-channel data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, abnormally long query lengths, and unusual DNS record types (TXT\u002FNULL\u002FCNAME). Use when hunting for DNS-based data exfiltration or C2 covert channels in network traffic, or when triaging suspicious DNS query volume\u002Fpatterns surfaced by Zeek logs.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-dns-tunneling-with-zeek\u002FSKILL.md",[239],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000023","Skill与智能体开发",[243,244,245,246,247,214,219,248,220,221,249,250,251,223,224,252,253,254,255,256],"dns","Zeek","tunneling","hunting for dns tunneling with zeek","suspicious","monitoring","exfiltration","dns-tunneling","data-exfiltration","data","network-monitoring","entropy","mitre-t1071","covert-channel",{"skillNo":258,"name":259,"nameZh":13,"description":260,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":261,"categories":262,"keywords":263,"publishedAt":232},"01M6AEVFVWW6FS6BHSGJ4XPEZ4","hunting-for-dns-based-persistence","Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, and unauthorized zone or NS delegation changes, using passive DNS history (SecurityTrails API), Route53\u002FAzure DNS\u002FCloudflare audit logs, and zone transfer analysis. Use when investigating suspected DNS hijacking or subdomain takeover, or when threat hunting for DNS record tampering that persists across credential rotations and endpoint reimaging.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-dns-based-persistence\u002FSKILL.md",[],[264,243,265,214,266,267,268,269,270,271,219,221,272,273,274,275,276],"persistence","hunting for dns based persistence","threat hunting","azure","delegation","cloudflare","audit","transfer","passive-dns","endpoint","subdomain-takeover","dns-hijacking","securitytrails",{"skillNo":278,"name":279,"nameZh":13,"description":280,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":281,"categories":282,"keywords":284,"publishedAt":232},"01M6AEVCED0W4Y36KSDM3MPBC6","hunting-for-defense-evasion-via-timestomping","Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-defense-evasion-via-timestomping\u002FSKILL.md",[283],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[285,286,287,214,288,289,290,291,292,293,221,294,295,296,297,298,299,300],"defense","hunting for defense evasion via timestomping","python","validation","verification","content","metadata","file","forensics","mft","ntfs","hardening","defense-evasion","timestomping","ntfs-forensics","mft-analysis",{"skillNo":302,"name":303,"nameZh":13,"description":304,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":305,"categories":306,"keywords":308,"publishedAt":232},"01M6AEV9CKB6353GR945H465ZZ","hunting-for-dcsync-attacks","Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-dcsync-attacks\u002FSKILL.md",[307],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[309,310,311,214,312,313,216,248,220,314,315,316,221,317,223,318,319,320,321,322],"dcsync","hunting for dcsync attacks","directory","incident response","windows","credential-access","active-directory","mimikatz","dfir","purple-team","controller","ATT&CK","domain-controller","t1003.006",{"skillNo":324,"name":325,"nameZh":13,"description":326,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":327,"categories":328,"keywords":330,"publishedAt":232},"01M6AEV55C9PRXK5R8BPJ8V6M7","hunting-for-dcom-lateral-movement","Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects via Sysmon Event ID 1\u002F3 correlation, WMI event analysis, and RPC endpoint mapper traffic on port 135. Use when investigating suspicious mmc.exe\u002Fdllhost.exe child processes, building T1021.003 detections, or auditing DCOM exposure during purple-team exercises.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-dcom-lateral-movement\u002FSKILL.md",[329],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[331,247,214,332,220,221,224,333,334,318,335,273,320,336,337,338,339,340,341,342],"hunting for dcom lateral movement","rpc","sysmon","correlation","lateral-movement","wmi","DCOM","T1021.003","MMC20","ShellWindows","ShellBrowserWindow","COM-objects",{"skillNo":344,"name":345,"nameZh":13,"description":346,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":347,"categories":348,"keywords":350,"publishedAt":232},"01M6AEV0TWWWEBY3D5CD43D41J","hunting-for-data-staging-before-exfiltration","Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR\u002FSysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1\u002F11) for 7-Zip\u002FRAR\u002Ftar archive creation, unusual temp or hidden folder access, and anomalous consolidation of files from multiple directories. Use when hunting for pre-exfiltration staging behavior, building detection rules for archiver abuse, or validating monitoring coverage for T1074.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-data-staging-before-exfiltration\u002FSKILL.md",[349],{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[249,252,351,214,352,288,289,292,248,221,223,333,296,320,227,353,354,355,356,357],"hunting for data staging before exfiltration","telemetry","edr","dlp","data-staging","t1074","archive-detection",{"skillNo":359,"name":360,"nameZh":13,"description":361,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":362,"categories":363,"keywords":366,"publishedAt":232},"01M6AETXM3S8KZYCBMKYMW45CK","hunting-for-data-exfiltration-indicators","Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large\u002Ffrequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-data-exfiltration-indicators\u002FSKILL.md",[364,365],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[249,252,367,368,369,214,312,370,352,292,371,221,243,251,223,224,244,372,373,354],"indicators","hunting for data exfiltration indicators","personal","storage","mitre-attack","network-analysis","suricata",{"skillNo":375,"name":376,"nameZh":13,"description":377,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":378,"categories":379,"keywords":381,"publishedAt":232},"01M6AETT4PY5EV4NFC38HXT0JK","hunting-for-command-and-control-beaconing","Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-command-and-control-beaconing\u002FSKILL.md",[380],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[382,383,214,384,288,216,290,291,292,371,221,212,224,372,385,227],"beaconing","hunting for command and control beaconing","infrastructure","proactive-detection",{"skillNo":387,"name":388,"nameZh":13,"description":389,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":390,"categories":391,"keywords":392,"publishedAt":232},"01M6AETPSX2A8MA3W8VQBAQC8X","hunting-for-cobalt-strike-beacons","Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3\u002FJA3S\u002FJARM fingerprints, HTTP malleable C2 profile pattern matching, and beacon jitter\u002Finterval analysis, built with Zeek network logs, Suricata IDS rules, and Python PCAP analysis. Use when hunting for Cobalt Strike beacon callbacks in network traffic or building detection rules for this C2 framework.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-cobalt-strike-beacons\u002FSKILL.md",[],[393,287,214,215,219,293,221,394,395,212,222,396,224,244,397,373,226,227,398,399],"hunting for cobalt strike beacons","cobalt-strike","beacon","network-forensics","ids","ja3","jarm",{"skillNo":401,"name":402,"nameZh":13,"description":403,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":404,"categories":405,"keywords":407,"publishedAt":232},"01M6AETJTR1Q2ZPDETZZ7BZXV5","hunting-for-beaconing-with-frequency-analysis","Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-beaconing-with-frequency-analysis\u002FSKILL.md",[406],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[408,214,288,216,290,291,292,221,212,409,222,224,227,382,410,411,412,413,255],"hunting for beaconing with frequency analysis","c2-detection","frequency-analysis","network-traffic","RITA","jitter-detection",{"skillNo":415,"name":416,"nameZh":13,"description":417,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":418,"categories":419,"keywords":420,"publishedAt":232},"01M6AETEX9PR8W5TRYC1823C0Z","hunting-for-anomalous-powershell-execution","Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block analysis, encoded command detection, or AMSI bypass identification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-for-anomalous-powershell-execution\u002FSKILL.md",[],[421,422,423,424,247,214,266,313,425,221,223,426,427,227,428,429,430,431],"powershell","execution","hunting for anomalous powershell execution","malicious","logging","Script-Block-Logging","obfuscation","t1003","amsi","evtx","event-4104",{"skillNo":433,"name":434,"nameZh":13,"description":435,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":436,"categories":437,"keywords":439,"publishedAt":232},"01M6AETBH55EBN6H4SEY9GD6V7","hunting-evtx-with-chainsaw","Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword\u002Fregex search, plus analyze shimcache, SRUM, and event-log gaps, outputting colorized tables, CSV, or JSON. Use during first-response triage for offline, SIEM-free detection over Windows event logs, or to quickly confirm a hunt hypothesis and produce reporting output.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-evtx-with-chainsaw\u002FSKILL.md",[438],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[430,440,441,214,442,313,443,444,445,446,219,447,221,317,448,449,450,451,452,453],"chainsaw","hunting evtx with chainsaw","siem","run","produce","search","offline","reporting","T1059.001","event-logs","sigma","windows-event-logs","t1059","shimcache",{"skillNo":455,"name":456,"nameZh":13,"description":457,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":458,"categories":459,"keywords":460,"publishedAt":232},"01M6AET7HXVXSSGG15JWWRT7S2","hunting-credential-stuffing-attacks","Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-credential-stuffing-attacks\u002FSKILL.md",[],[461,462,214,463,464,219,465,221,466,223,252,227,467,468,428,469,452,470,471,472],"hunting credential stuffing attacks","security","auth","authentication","security-operations","splunk","credential-stuffing","account-takeover","t1078","authentication-logs","login-anomaly","asn-analysis",{"skillNo":474,"name":475,"nameZh":13,"description":476,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":477,"categories":478,"keywords":480,"publishedAt":232},"01M6AET3Z5YNY8ASN3PDP18QHV","hunting-bootkits-in-efi-system-partition","Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware\u002Fbootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-bootkits-in-efi-system-partition\u002FSKILL.md",[479],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[481,424,462,214,482,483,293,221,484,485,486,487,488,489,490,320,491,492,493,494],"hunting bootkits in efi system partition","secure","boot","bootkit","UEFI","yara","firmware","Secure-Boot","ESP","hardware-firmware-security","blacklotus","efi-system-partition","firmware-forensics","measured-boot",{"skillNo":496,"name":497,"nameZh":13,"description":498,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":499,"categories":500,"keywords":502,"publishedAt":232},"01M6AET0GAWKT5FKPAQ4NM5PS2","hunting-advanced-persistent-threats","Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhunting-advanced-persistent-threats\u002FSKILL.md",[501],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[503,504,214,266,352,505,219,506,221,507,508,509,224,244,510,273,320,353,511,512],"hunting advanced persistent threats","memory","apt","threat-intelligence","MITRE-ATT&CK","NIST-CSF","Enterprise","NIST","osquery","TTP",{"skillNo":514,"name":515,"nameZh":13,"description":516,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":517,"categories":518,"keywords":521,"publishedAt":232},"01M6AESWXJVBHGS33XV0VYSNBW","hardening-windows-endpoint-with-cis-benchmark","Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-windows-endpoint-with-cis-benchmark\u002FSKILL.md",[519,520],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":89,"categoryName":90,"taxonomyType":53,"taxonomyTypeDesc":54},[313,522,296,273,523,462,214,524,270,525,526,527,528,529,530,452,531],"benchmark","hardening windows endpoint with cis benchmark","pr","compliance","endpoint-security","cis-benchmark","windows-security","gpo","t1055","baseline-configuration",{"skillNo":533,"name":534,"nameZh":13,"description":535,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":536,"categories":537,"keywords":539,"publishedAt":232},"01M6AESSFQ47729HF3NYNDST4E","hardening-linux-endpoint-with-cis-benchmark","Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fhardening-linux-endpoint-with-cis-benchmark\u002FSKILL.md",[538],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[540,522,296,273,541,462,214,524,384,270,220,525,542,526,527,530,452,543,544],"linux","hardening linux endpoint with cis benchmark","linux-security","Ubuntu","RHEL",108,18]