creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-31 08:17:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/implementing-velociraptor-for-ir-collection/references/workflows.md
+150
View File
@@ -0,0 +1,150 @@
# Velociraptor IR Collection Workflows
## Workflow 1: Rapid Triage Collection
```
START: Incident Detected - Triage Needed
|
v
[Identify Target Endpoints]
|-- Search clients by hostname, IP, or label
|-- Verify client connectivity status
|-- Label endpoints as "investigation_targets"
|
v
[Launch Triage Collection]
|-- Select triage artifact pack
|-- Configure collection parameters
|-- Set resource limits (CPU, bandwidth)
|-- Launch flow on target endpoints
|
v
[Monitor Collection Progress]
|-- View flow status in Velociraptor UI
|-- Check for collection errors
|-- Verify artifact completeness
|
v
[Download and Analyze Results]
|-- Export collected data
|-- Import into timeline tool
|-- Begin forensic analysis
|
v
END: Triage Data Available for Analysis
```
## Workflow 2: Enterprise-Wide Hunt
```
START: IOC or Threat Intelligence Received
|
v
[Create Hunt]
|-- Define hunt description and scope
|-- Select target artifacts
|-- Configure IOC-based VQL queries
|-- Set include/exclude labels
|
v
[Launch Hunt]
|-- Deploy to all matching endpoints
|-- Offline endpoints queued for pickup
|-- Monitor completion percentage
|
v
[Analyze Hunt Results]
|-- Review matches and anomalies
|-- Identify compromised endpoints
|-- Label affected systems
|
v
[Escalate Findings]
|-- Create detailed flows for hits
|-- Collect additional artifacts
|-- Feed results into IR process
|
v
END: Hunt Complete - Findings Documented
```
## Workflow 3: Live Incident Response
```
START: Active Compromise Detected
|
v
[Connect to Affected Endpoint]
|-- Open VQL shell in Velociraptor UI
|-- Verify system identity and status
|
v
[Volatile Evidence Collection]
|-- Running processes (pslist)
|-- Network connections (netstat)
|-- DNS cache
|-- Open file handles
|-- Loaded DLLs
|-- Memory strings (if needed)
|
v
[Persistence Check]
|-- Scheduled tasks
|-- Services
|-- Registry autorun keys
|-- WMI subscriptions
|-- Startup folder items
|
v
[Non-Volatile Evidence]
|-- Event logs
|-- Prefetch files
|-- MFT entries
|-- Browser history
|-- PowerShell history
|
v
[Containment Decision]
|-- Enough evidence to contain?
|-- Isolate endpoint if needed
|-- Continue monitoring if needed
|
v
END: Evidence Collected - Containment Executed
```
## Workflow 4: Deployment at Scale
```
START: Velociraptor Deployment Project
|
v
[Server Setup]
|-- Deploy server on dedicated host
|-- Configure SSL certificates
|-- Set up authentication (SSO/SAML)
|-- Configure storage backend
|
v
[Client Configuration]
|-- Generate client config from server
|-- Repack client installers
|-- Test on pilot group
|
v
[Mass Deployment]
|-- GPO deployment (Windows)
|-- Configuration management (Linux)
|-- MDM deployment (macOS)
|-- Verify connectivity
|
v
[Operational Configuration]
|-- Set up monitoring artifacts
|-- Configure event forwarding
|-- Create standard hunt templates
|-- Document SOPs for analysts
|
v
END: Velociraptor Operational at Scale
```