mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-20 16:39:40 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,114 @@
|
||||
# API Reference: Linux Forensic Artifact Analysis Tools
|
||||
|
||||
## Key Artifact Locations
|
||||
|
||||
| Artifact | Path | Description |
|
||||
|----------|------|-------------|
|
||||
| Auth logs | `/var/log/auth.log` (Debian) `/var/log/secure` (RHEL) | Authentication events |
|
||||
| Login history | `/var/log/wtmp` | Successful logins (binary, use `last`) |
|
||||
| Failed logins | `/var/log/btmp` | Failed logins (binary, use `lastb`) |
|
||||
| Bash history | `~/.bash_history` | Command history per user |
|
||||
| SSH keys | `~/.ssh/authorized_keys` | Authorized public keys |
|
||||
| Crontab | `/etc/crontab`, `/var/spool/cron/crontabs/` | Scheduled tasks |
|
||||
| Systemd services | `/etc/systemd/system/` | Service definitions |
|
||||
| LD_PRELOAD | `/etc/ld.so.preload` | Shared library preloading |
|
||||
| SUID binaries | `find / -perm -4000` | Setuid executables |
|
||||
|
||||
## last / lastb - Login History
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
last -f /var/log/wtmp # Successful logins
|
||||
lastb -f /var/log/btmp # Failed logins
|
||||
last -i -f /var/log/wtmp # Show IP addresses
|
||||
last -s 2024-01-15 -t 2024-01-20 # Date range filter
|
||||
```
|
||||
|
||||
### Output Format
|
||||
```
|
||||
user pts/0 192.168.1.50 Mon Jan 15 09:00 still logged in
|
||||
```
|
||||
|
||||
## chkrootkit - Rootkit Scanner
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
chkrootkit # Full scan
|
||||
chkrootkit -r /mnt/evidence # Scan mounted evidence
|
||||
chkrootkit -q # Quiet (infected only)
|
||||
```
|
||||
|
||||
## rkhunter - Rootkit Hunter
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
rkhunter --check # Full system check
|
||||
rkhunter --check --rootdir /mnt/ev # Check evidence root
|
||||
rkhunter --list tests # List available tests
|
||||
rkhunter --propupd # Update file properties DB
|
||||
```
|
||||
|
||||
### Check Categories
|
||||
| Check | Description |
|
||||
|-------|-------------|
|
||||
| `rootkits` | Known rootkit signatures |
|
||||
| `trojans` | Trojanized system binaries |
|
||||
| `properties` | File permission anomalies |
|
||||
| `filesystem` | Hidden files and directories |
|
||||
|
||||
## auditd Log Parsing
|
||||
|
||||
### ausearch Syntax
|
||||
```bash
|
||||
ausearch -m execve -ts recent # Recent command execution
|
||||
ausearch -m USER_AUTH -ts today # Authentication events
|
||||
ausearch -k suspicious_activity # Custom audit rule key
|
||||
ausearch -ua 0 -ts today # Root user actions
|
||||
```
|
||||
|
||||
### aureport Syntax
|
||||
```bash
|
||||
aureport --auth # Authentication summary
|
||||
aureport --login # Login summary
|
||||
aureport --file # File access summary
|
||||
aureport --summary # Overall summary
|
||||
```
|
||||
|
||||
## osquery - SQL-based System Queries
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
osqueryi "SELECT * FROM users WHERE uid = 0"
|
||||
osqueryi "SELECT * FROM crontab"
|
||||
osqueryi "SELECT * FROM authorized_keys"
|
||||
osqueryi "SELECT * FROM suid_bin"
|
||||
osqueryi "SELECT * FROM process_open_sockets"
|
||||
```
|
||||
|
||||
### Key Tables
|
||||
| Table | Content |
|
||||
|-------|---------|
|
||||
| `users` | User account information |
|
||||
| `crontab` | Cron job entries |
|
||||
| `authorized_keys` | SSH authorized keys |
|
||||
| `suid_bin` | SUID binaries |
|
||||
| `process_open_sockets` | Network connections by process |
|
||||
| `shell_history` | Command history entries |
|
||||
|
||||
## Plaso / log2timeline - Super Timeline
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
log2timeline.py /cases/timeline.plaso /mnt/evidence
|
||||
psort.py -o l2tcsv /cases/timeline.plaso > timeline.csv
|
||||
psort.py -o l2tcsv /cases/timeline.plaso "date > '2024-01-15'"
|
||||
```
|
||||
|
||||
## AIDE - File Integrity
|
||||
|
||||
### Syntax
|
||||
```bash
|
||||
aide --init # Initialize database
|
||||
aide --check # Check for changes
|
||||
aide --compare # Compare databases
|
||||
```
|
||||
@@ -0,0 +1,261 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Linux system artifact forensics agent for investigating compromised systems."""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import glob
|
||||
import json
|
||||
import re
|
||||
import datetime
|
||||
import subprocess
|
||||
|
||||
|
||||
def run_cmd(cmd):
|
||||
"""Execute a shell command and return output."""
|
||||
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
|
||||
return result.stdout.strip(), result.stderr.strip(), result.returncode
|
||||
|
||||
|
||||
def analyze_passwd(passwd_path):
|
||||
"""Analyze /etc/passwd for suspicious accounts."""
|
||||
findings = []
|
||||
with open(passwd_path, "r") as f:
|
||||
for line in f:
|
||||
parts = line.strip().split(":")
|
||||
if len(parts) < 7:
|
||||
continue
|
||||
username, _, uid, gid = parts[0], parts[1], int(parts[2]), int(parts[3])
|
||||
home, shell = parts[5], parts[6]
|
||||
if uid == 0 and username != "root":
|
||||
findings.append({
|
||||
"severity": "CRITICAL",
|
||||
"finding": f"UID 0 account: {username} (shell: {shell})",
|
||||
})
|
||||
login_shells = ["/bin/bash", "/bin/sh", "/bin/zsh", "/usr/bin/zsh"]
|
||||
if uid < 1000 and uid > 0 and shell in login_shells:
|
||||
findings.append({
|
||||
"severity": "WARNING",
|
||||
"finding": f"System account with login shell: {username} (UID:{uid})",
|
||||
})
|
||||
if uid >= 1000 and shell not in ["/bin/false", "/usr/sbin/nologin", "/bin/sync"]:
|
||||
findings.append({
|
||||
"severity": "INFO",
|
||||
"finding": f"Interactive user: {username} (UID:{uid}, Home:{home})",
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def analyze_shadow(shadow_path):
|
||||
"""Analyze /etc/shadow for password hash types and status."""
|
||||
findings = []
|
||||
with open(shadow_path, "r") as f:
|
||||
for line in f:
|
||||
parts = line.strip().split(":")
|
||||
if len(parts) < 3:
|
||||
continue
|
||||
username = parts[0]
|
||||
pwd_hash = parts[1]
|
||||
if pwd_hash and pwd_hash not in ("*", "!", "!!", ""):
|
||||
hash_type = "Unknown"
|
||||
if pwd_hash.startswith("$6$"):
|
||||
hash_type = "SHA-512"
|
||||
elif pwd_hash.startswith("$5$"):
|
||||
hash_type = "SHA-256"
|
||||
elif pwd_hash.startswith("$y$"):
|
||||
hash_type = "yescrypt"
|
||||
elif pwd_hash.startswith("$1$"):
|
||||
hash_type = "MD5 (WEAK)"
|
||||
findings.append({
|
||||
"severity": "WARNING",
|
||||
"finding": f"{username} uses weak MD5 password hash",
|
||||
})
|
||||
findings.append({
|
||||
"severity": "INFO",
|
||||
"finding": f"{username}: {hash_type} hash, last changed day {parts[2]}",
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def analyze_bash_history(history_path, username="unknown"):
|
||||
"""Analyze bash history for suspicious commands."""
|
||||
suspicious_patterns = [
|
||||
"wget", "curl", "nc ", "ncat", "netcat", "python -c", "python3 -c",
|
||||
"perl -e", "base64", "chmod 777", "chmod +s", "/dev/tcp", "/dev/udp",
|
||||
"nmap", "masscan", "hydra", "john", "hashcat", "passwd", "useradd",
|
||||
"iptables -F", "ufw disable", "history -c", "rm -rf", "dd if=",
|
||||
"crontab", "systemctl enable", "ssh-keygen", "scp ", "rsync",
|
||||
"/tmp/", "/dev/shm/", "mkfifo", "socat",
|
||||
]
|
||||
findings = []
|
||||
with open(history_path, "r", errors="ignore") as f:
|
||||
lines = f.readlines()
|
||||
for i, line in enumerate(lines):
|
||||
line_stripped = line.strip()
|
||||
for pattern in suspicious_patterns:
|
||||
if pattern in line_stripped.lower():
|
||||
findings.append({
|
||||
"user": username,
|
||||
"line_number": i + 1,
|
||||
"command": line_stripped[:200],
|
||||
"matched_pattern": pattern,
|
||||
})
|
||||
break
|
||||
return findings
|
||||
|
||||
|
||||
def check_cron_persistence(evidence_root):
|
||||
"""Check cron jobs for persistence mechanisms."""
|
||||
findings = []
|
||||
cron_paths = [
|
||||
os.path.join(evidence_root, "etc/crontab"),
|
||||
*glob.glob(os.path.join(evidence_root, "etc/cron.d/*")),
|
||||
*glob.glob(os.path.join(evidence_root, "var/spool/cron/crontabs/*")),
|
||||
]
|
||||
for cron_path in cron_paths:
|
||||
if os.path.exists(cron_path) and os.path.isfile(cron_path):
|
||||
with open(cron_path, "r", errors="ignore") as f:
|
||||
for line in f:
|
||||
line = line.strip()
|
||||
if line and not line.startswith("#"):
|
||||
suspicious = any(
|
||||
p in line.lower()
|
||||
for p in ["wget", "curl", "/tmp/", "/dev/shm/", "base64",
|
||||
"python", "bash -i", "reverse", "nc ", "ncat"]
|
||||
)
|
||||
if suspicious:
|
||||
findings.append({
|
||||
"severity": "HIGH",
|
||||
"source": cron_path,
|
||||
"entry": line[:200],
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def check_ssh_keys(evidence_root):
|
||||
"""Check for unauthorized SSH authorized_keys."""
|
||||
findings = []
|
||||
key_files = glob.glob(
|
||||
os.path.join(evidence_root, "home/*/.ssh/authorized_keys")
|
||||
) + glob.glob(
|
||||
os.path.join(evidence_root, "root/.ssh/authorized_keys")
|
||||
)
|
||||
for key_file in key_files:
|
||||
if os.path.exists(key_file):
|
||||
with open(key_file, "r") as f:
|
||||
keys = [l.strip() for l in f if l.strip() and not l.startswith("#")]
|
||||
if keys:
|
||||
findings.append({
|
||||
"file": key_file,
|
||||
"key_count": len(keys),
|
||||
"keys": [k[:80] + "..." for k in keys],
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def check_systemd_persistence(evidence_root):
|
||||
"""Check for suspicious systemd service files."""
|
||||
findings = []
|
||||
service_dirs = [
|
||||
os.path.join(evidence_root, "etc/systemd/system"),
|
||||
os.path.join(evidence_root, "usr/lib/systemd/system"),
|
||||
]
|
||||
for svc_dir in service_dirs:
|
||||
if not os.path.exists(svc_dir):
|
||||
continue
|
||||
for svc_file in glob.glob(os.path.join(svc_dir, "*.service")):
|
||||
with open(svc_file, "r", errors="ignore") as f:
|
||||
content = f.read()
|
||||
suspicious = any(
|
||||
p in content.lower()
|
||||
for p in ["/tmp/", "/dev/shm/", "wget", "curl", "reverse",
|
||||
"bash -i", "nc ", "python", "base64"]
|
||||
)
|
||||
if suspicious:
|
||||
findings.append({
|
||||
"severity": "HIGH",
|
||||
"file": svc_file,
|
||||
"preview": content[:300],
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def check_ld_preload(evidence_root):
|
||||
"""Check for LD_PRELOAD rootkit indicators."""
|
||||
findings = []
|
||||
preload_path = os.path.join(evidence_root, "etc/ld.so.preload")
|
||||
if os.path.exists(preload_path):
|
||||
with open(preload_path, "r") as f:
|
||||
content = f.read().strip()
|
||||
if content:
|
||||
findings.append({
|
||||
"severity": "CRITICAL",
|
||||
"finding": f"/etc/ld.so.preload contains: {content}",
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def find_suid_binaries(evidence_root):
|
||||
"""Find SUID/SGID binaries (potential privilege escalation)."""
|
||||
stdout, _, rc = run_cmd(
|
||||
f"find {evidence_root} -perm -4000 -type f 2>/dev/null"
|
||||
)
|
||||
return stdout.splitlines() if rc == 0 and stdout else []
|
||||
|
||||
|
||||
def find_suspicious_tmp_files(evidence_root):
|
||||
"""Find suspicious files in /tmp and /dev/shm."""
|
||||
findings = []
|
||||
for tmp_dir in ["tmp", "dev/shm"]:
|
||||
full_path = os.path.join(evidence_root, tmp_dir)
|
||||
if os.path.exists(full_path):
|
||||
for root, dirs, files in os.walk(full_path):
|
||||
for fname in files:
|
||||
fpath = os.path.join(root, fname)
|
||||
findings.append(fpath)
|
||||
return findings
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
print("=" * 60)
|
||||
print("Linux System Artifacts Forensics Agent")
|
||||
print("User accounts, persistence, shell history, rootkit detection")
|
||||
print("=" * 60)
|
||||
|
||||
evidence_root = sys.argv[1] if len(sys.argv) > 1 else "/mnt/evidence"
|
||||
|
||||
if os.path.exists(evidence_root):
|
||||
print(f"\n[*] Examining evidence root: {evidence_root}")
|
||||
|
||||
passwd_path = os.path.join(evidence_root, "etc/passwd")
|
||||
if os.path.exists(passwd_path):
|
||||
print("\n--- User Account Analysis ---")
|
||||
for f in analyze_passwd(passwd_path):
|
||||
print(f" [{f['severity']}] {f['finding']}")
|
||||
|
||||
print("\n--- Cron Persistence ---")
|
||||
cron = check_cron_persistence(evidence_root)
|
||||
for c in cron:
|
||||
print(f" [{c['severity']}] {c['source']}: {c['entry'][:80]}")
|
||||
|
||||
print("\n--- SSH Authorized Keys ---")
|
||||
ssh = check_ssh_keys(evidence_root)
|
||||
for s in ssh:
|
||||
print(f" {s['file']}: {s['key_count']} keys")
|
||||
|
||||
print("\n--- Systemd Persistence ---")
|
||||
systemd = check_systemd_persistence(evidence_root)
|
||||
for s in systemd:
|
||||
print(f" [{s['severity']}] {s['file']}")
|
||||
|
||||
print("\n--- LD_PRELOAD Rootkit Check ---")
|
||||
ld = check_ld_preload(evidence_root)
|
||||
for l in ld:
|
||||
print(f" [{l['severity']}] {l['finding']}")
|
||||
|
||||
print("\n--- Suspicious Temp Files ---")
|
||||
tmp = find_suspicious_tmp_files(evidence_root)
|
||||
for t in tmp[:20]:
|
||||
print(f" {t}")
|
||||
else:
|
||||
print(f"\n[DEMO] Usage: python agent.py <evidence_mount_point>")
|
||||
print("[*] Mount a forensic image and provide the path for analysis.")
|
||||
Reference in New Issue
Block a user