[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skills:sce6":3,"skills:pro6":50,"skills:creators9":95,"skills:stats":193,"skills:all:stars:115:":195},[4,15,22,29,36,43],{"categoryNo":5,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":8,"categoryNameEn":9,"description":10,"level":11,"skillCount":12,"parentNo":13,"parentName":13,"children":14},"01JBSEEDCAT000000000000022","SCENARIO","使用场景","智能体与自动化","Agents & Automation","Skill、MCP、智能体与工作流自动化",1,39458,null,[],{"categoryNo":16,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":17,"categoryNameEn":18,"description":19,"level":11,"skillCount":20,"parentNo":13,"parentName":13,"children":21},"01JBSEEDCAT000000000000006","软件开发","Software Development","编码、测试、部署等软件研发任务",26531,[],{"categoryNo":23,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":24,"categoryNameEn":25,"description":26,"level":11,"skillCount":27,"parentNo":13,"parentName":13,"children":28},"01JBSEEDCAT000000000000014","设计创意","Design & Creative","视觉设计、品牌与多媒体创作",13569,[],{"categoryNo":30,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":31,"categoryNameEn":32,"description":33,"level":11,"skillCount":34,"parentNo":13,"parentName":13,"children":35},"01JBSEEDCAT000000000000001","办公效率","Office Productivity","日常办公文档、表格、演示与沟通类任务",6289,[],{"categoryNo":37,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":38,"categoryNameEn":39,"description":40,"level":11,"skillCount":41,"parentNo":13,"parentName":13,"children":42},"01JBSEEDCAT000000000000017","内容创作","Content Creation","写作、文案与营销内容生产",6029,[],{"categoryNo":44,"taxonomyType":6,"taxonomyTypeDesc":7,"categoryName":45,"categoryNameEn":46,"description":47,"level":11,"skillCount":48,"parentNo":13,"parentName":13,"children":49},"01JBSEEDCAT000000000000020","研究与学习","Research & Learning","资料检索、知识整理与学习辅导",5531,[],[51,60,67,74,81,88],{"categoryNo":52,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":55,"categoryNameEn":56,"description":57,"level":11,"skillCount":58,"parentNo":13,"parentName":13,"children":59},"01JBSEEDCAT000000000000030","PROFESSION","适用职业","开发工程师","Software Engineer","从事软件编码、测试与运维的工程师",13274,[],{"categoryNo":61,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":62,"categoryNameEn":63,"description":64,"level":11,"skillCount":65,"parentNo":13,"parentName":13,"children":66},"01JBSEEDCAT000000000000032","设计师","Designer","视觉、交互与品牌设计人员",7775,[],{"categoryNo":68,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":69,"categoryNameEn":70,"description":71,"level":11,"skillCount":72,"parentNo":13,"parentName":13,"children":73},"01JBSEEDCAT000000000000033","数据分析师","Data Analyst","数据分析、报表与商业智能人员",4988,[],{"categoryNo":75,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":76,"categoryNameEn":77,"description":78,"level":11,"skillCount":79,"parentNo":13,"parentName":13,"children":80},"01JBSEEDCAT000000000000036","内容创作者","Content Creator","作者、编辑与自媒体创作者",3940,[],{"categoryNo":82,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":83,"categoryNameEn":84,"description":85,"level":11,"skillCount":86,"parentNo":13,"parentName":13,"children":87},"01JBSEEDCAT000000000000035","市场营销","Marketer","市场推广、增长与品牌运营人员",3446,[],{"categoryNo":89,"taxonomyType":53,"taxonomyTypeDesc":54,"categoryName":90,"categoryNameEn":91,"description":92,"level":11,"skillCount":93,"parentNo":13,"parentName":13,"children":94},"01JBSEEDCAT000000000000037","律师与法务","Legal","合同、合规与法律事务人员",3316,[],{"records":96,"total":191,"current":11,"size":192},[97,111,120,130,140,150,160,169,179],{"accountNo":98,"login":99,"displayName":100,"avatarUrl":101,"accountType":102,"accountTypeDesc":103,"profileDescription":104,"skillCount":105,"repoCount":106,"professionCount":107,"scenarioCount":108,"totalStars":109,"updatedAt":110},"01M698VYDXZ6JW5WH3CRV650R8","microsoft","Microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","ORGANIZATION","组织","Open source projects and samples from Microsoft",4160,229,11,7,828772,"2026-11-13 04:10:52",{"accountNo":112,"login":113,"displayName":113,"avatarUrl":114,"accountType":102,"accountTypeDesc":103,"profileDescription":115,"skillCount":116,"repoCount":117,"professionCount":108,"scenarioCount":108,"totalStars":118,"updatedAt":119},"01M698P3FSAZ6B4R928ZF19KPT","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","Your personal, open source AI assistant.",362,32,437711,"2026-11-13 03:02:05",{"accountNo":121,"login":122,"displayName":123,"avatarUrl":124,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":125,"repoCount":126,"professionCount":108,"scenarioCount":127,"totalStars":128,"updatedAt":129},"01M6AC29YGCR4S2NTJFV0G8B81","openai","OpenAI","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4",171,23,6,342695,"2026-11-13 04:03:41",{"accountNo":131,"login":132,"displayName":133,"avatarUrl":134,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":135,"repoCount":136,"professionCount":137,"scenarioCount":108,"totalStars":138,"updatedAt":139},"01M6AC83E6K4FDKK7HZ8WNMQKE","apache","The Apache Software Foundation","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4",420,75,8,298176,"2026-11-13 03:14:28",{"accountNo":141,"login":142,"displayName":143,"avatarUrl":144,"accountType":102,"accountTypeDesc":103,"profileDescription":145,"skillCount":146,"repoCount":147,"professionCount":107,"scenarioCount":108,"totalStars":148,"updatedAt":149},"01M698VYEFDM0VJBZDYYJ2T83S","google","Google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","Google ❤️ Open Source",535,48,242366,"2026-11-13 04:17:09",{"accountNo":151,"login":152,"displayName":153,"avatarUrl":154,"accountType":102,"accountTypeDesc":103,"profileDescription":155,"skillCount":156,"repoCount":157,"professionCount":107,"scenarioCount":108,"totalStars":158,"updatedAt":159},"01M6AC83DS133TPXFSP1DHNCC6","github","GitHub","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","How people build software.",940,28,238441,"2026-11-13 03:57:35",{"accountNo":161,"login":162,"displayName":163,"avatarUrl":164,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":165,"repoCount":166,"professionCount":107,"scenarioCount":108,"totalStars":167,"updatedAt":168},"01M697XGDPXJAVQ8391V2BCYTE","anthropics","Anthropic","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4",674,17,231826,"2026-11-13 04:18:26",{"accountNo":170,"login":171,"displayName":172,"avatarUrl":173,"accountType":102,"accountTypeDesc":103,"profileDescription":13,"skillCount":174,"repoCount":175,"professionCount":176,"scenarioCount":108,"totalStars":177,"updatedAt":178},"01M6AC83EPDGBFN19MWYRREJD0","Significant-Gravitas","AutoGPT","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130738209?v=4",86,2,10,188014,"2026-11-13 02:38:59",{"accountNo":180,"login":181,"displayName":182,"avatarUrl":183,"accountType":184,"accountTypeDesc":185,"profileDescription":186,"skillCount":187,"repoCount":188,"professionCount":127,"scenarioCount":108,"totalStars":189,"updatedAt":190},"01M6DJCCDDG53MTYYRTXAXFG17","garrytan","Garry Tan","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F19957?v=4","USER","个人作者","Writes software, dreams. ",324,3,174614,"2026-11-13 04:05:07",1926,9,{"skillCount":194,"professionCount":107,"scenarioCount":108,"creatorCount":191},196852,{"records":196,"total":194,"current":570,"size":571},[197,233,252,276,293,311,329,353,375,394,410,431,447,469,494,510,533,558],{"skillNo":198,"name":199,"nameZh":13,"description":200,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":209,"categories":210,"keywords":211,"publishedAt":232},"01M6AEDC6EX9ME64THA75SZHA6","detecting-golden-ticket-forgery","Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies using Splunk and Elastic SIEM queries. Use when investigating suspected forged Kerberos tickets or krbtgt credential theft in Active Directory.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-golden-ticket-forgery\u002FSKILL.md",[],[212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"detecting golden ticket forgery","directory","security","cybersecurity","siem","windows","authentication","cache","active-directory","mimikatz","splunk","threat-detection","analyzing","encryption","elastic","golden-ticket","kerberos","windows-security","detection","credential-theft","2026-11-10 10:12:30",{"skillNo":234,"name":235,"nameZh":13,"description":236,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":237,"categories":238,"keywords":242,"publishedAt":232},"01M6AED8T38E5AA55ME2H3A6K9","detecting-golden-ticket-attacks-in-kerberos-logs","Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence (MITRE T1558.001) in AD environments.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-golden-ticket-attacks-in-kerberos-logs\u002FSKILL.md",[239],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000023","Skill与智能体开发",[243,228,244,213,215,245,246,247,220,248,222,225,227,249,250,251],"logs","detecting golden ticket attacks in kerberos logs","mismatched","kql","persistence","threat-hunting","controller","credential-abuse","mitre-t1558-001",{"skillNo":253,"name":254,"nameZh":13,"description":255,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":256,"categories":257,"keywords":260,"publishedAt":232},"01M6AED5ACSB4GYNDRXCJGDJST","detecting-fileless-malware-techniques","Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-malware-techniques\u002FSKILL.md",[258,259],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":75,"categoryName":76,"taxonomyType":53,"taxonomyTypeDesc":54},[261,262,263,264,215,265,266,267,268,269,270,247,271,272,230,273,274,275],"malware","detecting fileless malware techniques","writing","memory","registry","validation","land","content","metadata","file","malware-analysis","powershell","fileless","LOLBins","memory-analysis",{"skillNo":277,"name":278,"nameZh":13,"description":279,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":280,"categories":281,"keywords":283,"publishedAt":232},"01M6AED1S112JH9BG14P9801BF","detecting-fileless-attacks-on-endpoints","Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-fileless-attacks-on-endpoints\u002FSKILL.md",[282],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[284,263,214,264,215,285,265,267,247,286,261,272,287,288,289,290,230,291,292],"detecting fileless attacks on endpoints","pr","engineering","endpoint-security","detection-engineering","exploitation","endpoint","fileless-malware","memory-attacks",{"skillNo":294,"name":295,"nameZh":13,"description":296,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":297,"categories":298,"keywords":299,"publishedAt":232},"01M6AECYV7PN3ADVD50Z696MYT","detecting-exfiltration-over-dns-with-zeek","Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT\u002FNULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden in DNS queries against network traffic captured by Zeek.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-exfiltration-over-dns-with-zeek\u002FSKILL.md",[],[300,301,302,303,214,215,285,248,304,224,305,306,307,308,309,310],"dns","exfiltration","Zeek","detecting exfiltration over dns with zeek","c2","network","data","network-security","tunneling","dns-exfiltration","entropy-analysis",{"skillNo":312,"name":313,"nameZh":13,"description":314,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":315,"categories":316,"keywords":318,"publishedAt":232},"01M6AECVDSJEJZK22N90BSYQTE","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[317],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[243,290,319,320,215,321,285,266,322,270,248,323,287,324,288,325,230,326,327,328],"detecting evasion techniques in endpoint logs","suspicious","threat hunting","verification","MITRE-ATT&CK","hardening","ATT&CK","edr","defense","defense-evasion",{"skillNo":330,"name":331,"nameZh":13,"description":332,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":333,"categories":334,"keywords":340,"publishedAt":232},"01M6AECQDTPRZAZ7CGPK7DAGFW","detecting-entra-offensive-tools-in-graph-logs","Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel\u002FLog Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-entra-offensive-tools-in-graph-logs\u002FSKILL.md",[335,338,339],{"categoryNo":336,"categoryName":337,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[341,243,342,320,215,99,343,344,246,248,345,346,347,348,349,288,350,351,230,352],"graph","detecting entra offensive tools in graph logs","analytics","entra id","soc","Microsoft-Graph","entra-id","roadtools","aadinternals","reconnaissance","correlation","enumeration",{"skillNo":354,"name":355,"nameZh":13,"description":356,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":357,"categories":358,"keywords":363,"publishedAt":232},"01M6AECKTBZDD5JWX5EX5J6K3J","detecting-email-forwarding-rules-attack","Detect malicious inbox\u002Fmail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise. Use when hunting for suspicious auto-forwarding, hidden mailbox rules, or T1114-style email collection persistence after a compromised account or BEC incident.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-email-forwarding-rules-attack\u002FSKILL.md",[359,362],{"categoryNo":360,"categoryName":361,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[364,365,366,320,215,367,368,247,369,248,370,371,324,372,230,373,374],"email","detecting email forwarding rules attack","malicious","create","inbox","mitre-attack","flow","BEC","proactive-detection","email-forwarding","t1114",{"skillNo":376,"name":377,"nameZh":13,"description":378,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":379,"categories":380,"keywords":382,"publishedAt":232},"01M6AECGBQT9BY5RKW04EKX6KM","detecting-email-account-compromise","Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation\u002Fdeletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-email-account-compromise\u002FSKILL.md",[381],{"categoryNo":360,"categoryName":361,"taxonomyType":6,"taxonomyTypeDesc":7},[364,383,366,384,215,99,385,368,386,243,224,387,346,388,389,390,371,391,392,393],"detecting email account compromise","google workspace","azure","audit","Office365","email-compromise","inbox-rules","OAuth","SET","sign-in-analysis","account-takeover",{"skillNo":395,"name":396,"nameZh":13,"description":397,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":398,"categories":399,"keywords":401,"publishedAt":232},"01M6AECCYSF2ACX260WQ4J6B96","detecting-dns-exfiltration-with-dns-query-analysis","Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT\u002FCNAME\u002FNULL record abuse, and oversized response payloads using passive DNS monitoring and statistical\u002FML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dns-exfiltration-with-dns-query-analysis\u002FSKILL.md",[400],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[300,301,402,214,215,403,285,404,405,223,406,224,305,306,307,407,309,310,408,409],"detecting dns exfiltration with dns query analysis","ml","monitoring","dns-tunneling","data-exfiltration","network-monitoring","iodine","dnscat2",{"skillNo":411,"name":412,"nameZh":13,"description":413,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":414,"categories":415,"keywords":417,"publishedAt":232},"01M6AEC9MGY593NM24GG5M5CRB","detecting-dnp3-protocol-anomalies","Detect anomalies in DNP3 communications used in SCADA\u002FICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT\u002FICS networks, investigating suspicious DNP3 master\u002Foutstation activity, or building an anomaly-based IDS for industrial control traffic.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dnp3-protocol-anomalies\u002FSKILL.md",[416],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[418,419,320,214,215,420,285,421,404,422,423,424,230,425,426,427,428,429,430],"protocol","detecting dnp3 protocol anomalies","machine learning","update","protocol-analysis","firmware","ids","ot-security","ics","scada","anomaly-detection","dnp3","energy-sector",{"skillNo":432,"name":433,"nameZh":13,"description":434,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":435,"categories":436,"keywords":438,"publishedAt":232},"01M6AEC5WXVPH3G9XXB81PCG6Y","detecting-dll-sideloading-attacks","Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures\u002Fhashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dll-sideloading-attacks\u002FSKILL.md",[437],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[439,366,215,266,322,440,270,441,369,248,224,442,324,443,326,444,327,328,445,446],"detecting dll sideloading attacks","search","apt","sysmon","MDE","CrowdStrike","dll-sideloading","t1574",{"skillNo":448,"name":449,"nameZh":13,"description":450,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":451,"categories":452,"keywords":454,"publishedAt":232},"01M6AEC2ED0DN6TAWKW0NVFY7A","detecting-dependency-confusion","Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`\u002F`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles\u002Fmanifests for confusable dependencies, or after an incident that may have leaked internal package names.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dependency-confusion\u002FSKILL.md",[453],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[455,456,214,215,457,458,459,460,461,462,463,464,465,466,467,468],"detecting dependency confusion","devsecops","npm","onboarding","package","xml","pypi","supply-chain","dependency-confusion","owasp","supply-chain-security","maven","package-management","namespace-hijacking",{"skillNo":470,"name":471,"nameZh":13,"description":472,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":473,"categories":474,"keywords":479,"publishedAt":232},"01M6AEBYWPEDG4QZ59G88NVQNQ","detecting-deepfake-audio-in-vishing-attacks","Detect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models, supporting batch audio analysis, confidence scoring, and forensic reporting. Use for deepfake voice detection, vishing investigations, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-deepfake-audio-in-vishing-attacks\u002FSKILL.md",[475,478],{"categoryNo":476,"categoryName":477,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[480,481,215,420,482,285,322,483,484,485,486,487,488,350,327,489,490,491,492,493],"vishing","detecting deepfake audio in vishing attacks","official","speech","batch","reporting","phishing","ZeRO","social-engineering","deepfake-detection","audio-forensics","MFCC","spectral-analysis","voice-cloning",{"skillNo":495,"name":496,"nameZh":13,"description":497,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":498,"categories":499,"keywords":501,"publishedAt":232},"01M6AEBTVXABS0AVT66MDY52E2","detecting-dcsync-attack-in-active-directory","Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-dcsync-attack-in-active-directory\u002FSKILL.md",[500],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[213,502,503,215,504,418,505,506,404,507,220,221,248,305,249,508,228,231,509],"dcsync","detecting dcsync attack in active directory","permissions","rpc","admin","server","Impacket","mitre-t1003-006",{"skillNo":511,"name":512,"nameZh":13,"description":513,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":514,"categories":515,"keywords":518,"publishedAt":232},"01M6AEBQ753P7VTSA216NSCAPC","detecting-data-and-model-poisoning","Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party\u002Fuser-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger).","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-data-and-model-poisoning\u002FSKILL.md",[516,517],{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},{"categoryNo":68,"categoryName":69,"taxonomyType":53,"taxonomyTypeDesc":54},[306,519,214,215,403,520,521,322,462,522,523,524,525,526,527,528,529,530,531,532],"detecting data and model poisoning","training","issues","ai-security","data-poisoning","pipeline","clustering","ibm","model-backdoor","ml-supply-chain","adversarial-robustness-toolbox","activation-clustering","spectral-signatures","model-integrity",{"skillNo":534,"name":535,"nameZh":13,"description":536,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":537,"categories":538,"keywords":543,"publishedAt":232},"01M6AEBKDX0QFXTRRE4Z9P3F66","detecting-cryptomining-in-cloud","This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cryptomining-in-cloud\u002FSKILL.md",[539,542],{"categoryNo":540,"categoryName":541,"taxonomyType":6,"taxonomyTypeDesc":7},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":240,"categoryName":241,"taxonomyType":6,"taxonomyTypeDesc":7},[544,545,215,546,385,285,547,548,404,507,549,305,550,551,552,553,554,555,556,557],"cloud","detecting cryptomining in cloud","automation","development","teams","cloud-security","cryptocurrency","eks","guardduty","cryptomining-detection","cloud-abuse","resource-hijacking","guardduty-crypto","cost-anomaly",{"skillNo":559,"name":560,"nameZh":13,"description":561,"descriptionZh":13,"repositoryFullName":201,"ownerLogin":202,"ownerAvatarUrl":203,"ownerAccountNo":204,"ownerDisplayName":205,"repositoryNo":206,"starsCount":207,"licenseSpdxId":208,"licenseFileUrl":13,"sourceHtmlUrl":562,"categories":563,"keywords":564,"publishedAt":232},"01M6AEBFK2BAZXPTEDS1Z5C89W","detecting-credential-dumping-techniques","Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows\u002FActive Directory hosts or triaging EDR alerts on LSASS access.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-credential-dumping-techniques\u002FSKILL.md",[],[565,213,214,215,216,217,566,567,270,243,220,221,223,442,568,229,326,327,569,328],"detecting credential dumping techniques","database","logging","credential-dumping","lsass",115,18]