Anthropic-Cybersecurity-Skills.

734+ skills cybersec structurées, MITRE ATT&CK mapped

Contenu du dépôt tel qu'installé

assets · ATTACK_COVERAGE.md · CITATION.cff · CODE_OF_CONDUCT.md · CONTRIBUTING.md · docs · index.json · LICENSE · mappings · README.md

Ce que couvre ce dépôt

Rubriques de sa documentation : The largest open-source cybersecurity skills library for AI agents · Give any AI agent the security skills of a senior analyst · Six frameworks, one skill library · 🆕 MITRE Fight Fraud Framework F3 — 94 fraud-relevant skills · MITRE ATT&CK v19.1 — 754/754 skills mapped · Quick start · 🌍 GARS-2026 — Global Agentic AI Readiness Survey · 🚀 Try it on the Playground · Why this exists · What's inside — 29 security domains · How AI agents use these skills · Skill anatomy · YAML frontmatter real example · Markdown body sections · When to Use · Prerequisites · Workflow · Verification · MITRE ATLAS v5.4 — AI/ML adversarial threats · MITRE D3FEND v1.3 — Defensive countermeasures · NIST AI RMF 1.0 + GenAI Profile AI 600-1 · Compatible platforms · What people are saying · Featured in · Star history · Releases · Community · Citation.

Les 817 skills, par domaine

Autres skills

• analyzing active directory acl abuse — Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
• analyzing ethereum smart contract vulnerabilities — Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.
• auditing foundry smart contract security — - Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-cont
• analyzing uefi bootkit persistence — Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, Mosai
• auditing uefi firmware with chipsec — Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.
• detecting secure boot bypass — Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.
• hunting bootkits in efi system partition — Baseline the EFI System Partition and hunt malicious EFI binaries (ESPecter, BlackLotus, Bootkitty, Glupteba) by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and detecting anomalous non-EFI files.
• validating tpm measured boot attestation — Verify TPM PCRs and measured-boot and remote-attestation integrity.
• deploying active directory honeytokens — Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs
• deploying cloud deception with decoy resources — - Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals,
• deploying honeytokens and canarytokens — Plant canarytokens and honey credentials and alert on breach.
• designing adversary engagement with mitre engage — - Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operati
• implementing deception based detection with canarytoken — Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug tokens, DNS tokens, document tokens, and AWS key tokens.
• implementing network deception with honeypots — Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
• detecting bluetooth low energy attacks — Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT serv
• performing bluetooth security assessment — Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities
• detecting credential dumping techniques — Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules
• detecting golden ticket forgery — Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
• detecting insider threat with ueba — Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized
• detecting living off the land attacks — Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
• detecting living off the land with lolbas — Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis
• detecting pass the ticket attacks — Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
• detecting rdp brute force attacks — Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
• detecting deepfake audio in vishing attacks — Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio
• implementing attack surface management — Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorith
• performing binary exploitation analysis — Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with ROPgadget, and exploit development for CTF and authorized security assessments.
• implementing data loss prevention with microsoft purview — Implements data loss prevention policies using Microsoft Purview to protect sensitive information across Exchange Online, SharePoint, OneDrive, Teams, endpoint devices, and Power BI. The analyst configures sensitivity labels with encryption and content marking
• implementing devsecops security scanning — Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP f
• implementing runtime application self protection — Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy configuration for Java and Python web applications.
• performing fuzzing with aflplusplus — Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with
• performing supply chain attack simulation — Simulate and detect software supply chain attacks including typosquatting detection via Levenshtein distance, dependency confusion testing against private registries, package hash verification with pip, and known vulnerability scanning with pip-audit.
• implementing gdpr data subject access request — Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Cove
• performing privacy impact assessment — Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework P
• implementing hardware security key authentication — Implements FIDO2/WebAuthn hardware security key authentication including registration ceremonies, authentication flows, YubiKey enrollment, and passkey migration strategies. Builds a complete relying party server using the python-fido2 library that supports cr
• implementing privileged access workstation — Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time access, and integration with CyberArk or BeyondTrust for secure administrative operations.
• implementing zero trust with beyondcorp — Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, and Access Context Manager to enforce identity and posture-based access to GCP resources and internal appli
• monitoring scada modbus traffic anomalies — Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst uses deep packet inspection with pymodbus, Scapy, and Zeek to baseline normal PLC/RT
• performing active directory forest trust attack — Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.
• performing red team with covenant — Conduct red team operations using the Covenant C2 framework for authorized adversary simulation, including listener setup, grunt deployment, task execution, and lateral movement tracking.
• performing firmware extraction with binwalk — Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extrac
• performing purple team atomic testing — Executes Atomic Red Team tests mapped to MITRE ATT&CK techniques, performs coverage gap analysis across the ATT&CK matrix, and runs detection validation loops to measure blue team visibility. Covers Invoke-AtomicRedTeam PowerShell execution, ATT&CK Navigator l
• performing soc2 type2 audit preparation — Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monit

Les intitulés et résumés de skills proviennent du dépôt d'origine (Apache-2.0). Hub Forge AI les indexe et les charge dans les agents ; il n'en est pas l'auteur.