Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/conducting-domain-persistence-with-dcsync/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/conducting-domain-persistence-with-dcsync/references/api-reference.md

@@ -0,0 +1,46 @@
+# DCSync Persistence Detection — API Reference
+
+## Libraries
+
+| Library | Install | Purpose |
+|---------|---------|---------|
+| ldap3 | `pip install ldap3` | LDAP directory queries for AD permission enumeration |
+| impacket | `pip install impacket` | Network protocol toolkit — secretsdump.py for DCSync |
+| pyad | `pip install pyad` | Windows Active Directory interface |
+
+## Key ldap3 Methods
+
+| Method | Description |
+|--------|-------------|
+| `Server(ip, get_info=ALL)` | Create LDAP server connection object |
+| `Connection(server, user, password, authentication=NTLM)` | Bind to AD with NTLM auth |
+| `conn.search(search_base, search_filter, attributes)` | Query directory objects |
+| `conn.entries` | Access search result entries |
+| `conn.unbind()` | Close LDAP connection |
+
+## Critical GUIDs for DCSync Detection
+
+| GUID | Right |
+|------|-------|
+| `1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` | DS-Replication-Get-Changes |
+| `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` | DS-Replication-Get-Changes-All |
+| `89e95b76-444d-4c62-991a-0facbeda640c` | DS-Replication-Get-Changes-In-Filtered-Set |
+
+## Windows Event IDs
+
+| Event ID | Description |
+|----------|-------------|
+| 4662 | Directory service object accessed (replication GUIDs indicate DCSync) |
+| 4624 | Logon event — correlate with replication activity from non-DC source |
+
+## MITRE ATT&CK Mapping
+
+| Technique | ID |
+|-----------|----|
+| OS Credential Dumping: DCSync | T1003.006 |
+
+## External References
+
+- [impacket secretsdump.py](https://github.com/fortra/impacket/blob/master/examples/secretsdump.py)
+- [ldap3 Documentation](https://ldap3.readthedocs.io/)
+- [Microsoft DCSync Detection](https://learn.microsoft.com/en-us/defender-for-identity/credential-access-alerts)

skills/conducting-domain-persistence-with-dcsync/scripts/agent.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""DCSync attack detection and analysis agent using impacket and ldap3."""
+
+import json
+import sys
+import argparse
+from datetime import datetime
+
+try:
+    import ldap3
+    from ldap3 import Server, Connection, ALL, NTLM
+except ImportError:
+    print("Install: pip install ldap3")
+    sys.exit(1)
+
+
+def check_dcsync_permissions(server_ip, domain, username, password):
+    """Check which accounts have DCSync-capable permissions (Replicating Directory Changes)."""
+    server = Server(server_ip, get_info=ALL)
+    conn = Connection(server, user=f"{domain}\\{username}", password=password,
+                      authentication=NTLM, auto_bind=True)
+    base_dn = ",".join([f"DC={p}" for p in domain.split(".")])
+    conn.search(
+        search_base=base_dn,
+        search_filter="(objectClass=domain)",
+        attributes=["nTSecurityDescriptor"],
+    )
+    dcsync_accounts = []
+    REPL_CHANGES_GUID = "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
+    REPL_ALL_GUID = "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
+    conn.search(
+        search_base=base_dn,
+        search_filter="(&(objectCategory=person)(objectClass=user)(adminCount=1))",
+        attributes=["sAMAccountName", "distinguishedName", "memberOf"],
+    )
+    for entry in conn.entries:
+        dcsync_accounts.append({
+            "account": str(entry.sAMAccountName),
+            "dn": str(entry.distinguishedName),
+            "admin_count": True,
+            "risk": "HIGH",
+            "note": "adminCount=1 — potential DCSync privilege holder",
+        })
+    conn.unbind()
+    return dcsync_accounts
+
+
+def detect_dcsync_events(log_file=None):
+    """Parse Windows Security event logs for DCSync indicators (Event IDs 4662, 4624)."""
+    dcsync_indicators = {
+        "4662": "Directory service access — replication operation",
+        "4624": "Logon event — check for NTLM from unexpected source",
+    }
+    REPL_GUIDS = [
+        "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
+        "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
+        "89e95b76-444d-4c62-991a-0facbeda640c",
+    ]
+    detections = []
+    if log_file:
+        try:
+            with open(log_file, "r") as f:
+                events = json.load(f)
+            for event in events:
+                eid = str(event.get("EventID", ""))
+                if eid == "4662":
+                    props = event.get("Properties", "")
+                    for guid in REPL_GUIDS:
+                        if guid in str(props).lower():
+                            detections.append({
+                                "event_id": eid,
+                                "timestamp": event.get("TimeCreated", ""),
+                                "account": event.get("SubjectUserName", ""),
+                                "operation": dcsync_indicators[eid],
+                                "guid_matched": guid,
+                                "severity": "CRITICAL",
+                            })
+        except (FileNotFoundError, json.JSONDecodeError) as e:
+            detections.append({"error": str(e)})
+    return detections
+
+
+def generate_sigma_rule():
+    """Generate Sigma detection rule for DCSync activity."""
+    return {
+        "title": "DCSync Attack Detected via Directory Replication",
+        "status": "production",
+        "logsource": {"product": "windows", "service": "security"},
+        "detection": {
+            "selection": {
+                "EventID": 4662,
+                "Properties|contains": [
+                    "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
+                    "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
+                ],
+            },
+            "filter": {"SubjectUserName|endswith": "$"},
+            "condition": "selection and not filter",
+        },
+        "level": "critical",
+        "tags": ["attack.credential_access", "attack.t1003.006"],
+    }
+
+
+def run_audit(server, domain, username, password, log_file=None):
+    """Run DCSync persistence audit."""
+    print(f"\n{'='*60}")
+    print(f"  DCSYNC PERSISTENCE AUDIT")
+    print(f"  Domain: {domain} | Server: {server}")
+    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
+    print(f"{'='*60}\n")
+
+    accounts = check_dcsync_permissions(server, domain, username, password)
+    print(f"--- PRIVILEGED ACCOUNTS ({len(accounts)}) ---")
+    for a in accounts[:15]:
+        print(f"  [{a['risk']}] {a['account']}: {a['note']}")
+
+    events = detect_dcsync_events(log_file)
+    print(f"\n--- DCSYNC DETECTIONS ({len(events)}) ---")
+    for e in events[:10]:
+        if "error" not in e:
+            print(f"  [{e['severity']}] {e['account']} at {e['timestamp']}")
+
+    sigma = generate_sigma_rule()
+    print(f"\n--- SIGMA RULE ---")
+    print(f"  {sigma['title']}")
+    print(f"  Level: {sigma['level']}")
+
+    return {"accounts": accounts, "detections": events, "sigma_rule": sigma}
+
+
+def main():
+    parser = argparse.ArgumentParser(description="DCSync Detection Agent")
+    parser.add_argument("--server", required=True, help="Domain controller IP")
+    parser.add_argument("--domain", required=True, help="AD domain (e.g., corp.local)")
+    parser.add_argument("--username", required=True, help="LDAP bind username")
+    parser.add_argument("--password", required=True, help="LDAP bind password")
+    parser.add_argument("--log-file", help="Windows event log JSON export to analyze")
+    parser.add_argument("--output", help="Save report to JSON file")
+    args = parser.parse_args()
+
+    report = run_audit(args.server, args.domain, args.username, args.password, args.log_file)
+    if args.output:
+        with open(args.output, "w") as f:
+            json.dump(report, f, indent=2, default=str)
+        print(f"\n[+] Report saved to {args.output}")
+
+
+if __name__ == "__main__":
+    main()