Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
2026-07-20 14:30:59 +03:00 · 2026-03-10 21:02:12 +01:00
parent c74d52fa30
commit 27c6414ca5
1390 changed files with 106806 additions and 0 deletions
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,84 @@
+# Active Breach Containment API Reference
+
+## CrowdStrike Falcon - Host Containment
+
+```bash
+# Contain a host (network isolation)
+curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"ids": ["device_id_here"]}'
+
+# Lift containment
+curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=lift_containment" \
+  -H "Authorization: Bearer $TOKEN" \
+  -d '{"ids": ["device_id_here"]}'
+```
+
+## Microsoft Defender for Endpoint - Isolation
+
+```powershell
+# Isolate machine via API
+$body = @{ Comment = "Breach containment INC-2025-001"; IsolationType = "Full" } | ConvertTo-Json
+Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/isolate" `
+  -Method Post -Headers @{Authorization = "Bearer $token"} -Body $body -ContentType "application/json"
+
+# Release from isolation
+Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$machineId/unisolate" `
+  -Method Post -Headers @{Authorization = "Bearer $token"} `
+  -Body (@{Comment = "Containment lifted"} | ConvertTo-Json) -ContentType "application/json"
+```
+
+## Active Directory - Credential Actions
+
+```powershell
+# Disable compromised account
+Disable-ADAccount -Identity "jsmith"
+
+# Reset password
+Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword (ConvertTo-SecureString "NewP@ss!" -AsPlainText -Force)
+
+# Revoke Azure AD sessions
+Revoke-AzureADUserAllRefreshToken -ObjectId "user-object-id"
+
+# KRBTGT double reset (first reset)
+Reset-KrbtgtKeys -Server DC01 -Force
+```
+
+## Network Containment - iptables
+
+```bash
+# Block C2 IP
+iptables -A INPUT -s 185.220.x.x -j DROP
+iptables -A OUTPUT -d 185.220.x.x -j DROP
+
+# Isolate host from network (allow management only)
+iptables -A FORWARD -s 10.10.5.12 -d 10.10.0.1 -j ACCEPT
+iptables -A FORWARD -s 10.10.5.12 -j DROP
+
+# Block SMB lateral movement
+iptables -A FORWARD -p tcp --dport 445 -j DROP
+```
+
+## DNS Sinkholing
+
+```bash
+# Add sinkhole entry
+echo "127.0.0.1 evil.example.com" >> /etc/hosts
+
+# Unbound DNS sinkhole
+unbound-control local_zone "evil.example.com" redirect
+unbound-control local_data "evil.example.com A 10.0.0.99"
+```
+
+## Evidence Collection
+
+```bash
+# Memory dump (Linux)
+sudo dd if=/proc/kcore of=/evidence/memory.raw bs=1M
+
+# Volatile data collection
+ps auxww > /evidence/processes.txt
+ss -tunap > /evidence/network.txt
+cat /proc/net/arp > /evidence/arp.txt
+```
@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""Active breach containment agent for incident response operations."""
+
+import json
+import subprocess
+import sys
+from datetime import datetime
+
+
+def block_ip_at_firewall(ip_address, chain="INPUT", comment="breach-containment"):
+    """Block a C2 or malicious IP address using iptables."""
+    cmd = [
+        "iptables", "-A", chain, "-s", ip_address, "-j", "DROP",
+        "-m", "comment", "--comment", comment,
+    ]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
+        return {
+            "action": "block_ip",
+            "ip": ip_address,
+            "success": result.returncode == 0,
+            "error": result.stderr.strip() if result.returncode != 0 else None,
+            "timestamp": datetime.utcnow().isoformat() + "Z",
+        }
+    except Exception as e:
+        return {"action": "block_ip", "ip": ip_address, "success": False, "error": str(e)}
+
+
+def disable_ad_account(username, domain_controller=None):
+    """Disable a compromised Active Directory account via PowerShell."""
+    ps_cmd = f'Disable-ADAccount -Identity "{username}" -Confirm:$false'
+    if domain_controller:
+        ps_cmd += f' -Server "{domain_controller}"'
+    cmd = ["powershell", "-Command", ps_cmd]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+        return {
+            "action": "disable_account",
+            "username": username,
+            "success": result.returncode == 0,
+            "error": result.stderr.strip() if result.returncode != 0 else None,
+            "timestamp": datetime.utcnow().isoformat() + "Z",
+        }
+    except Exception as e:
+        return {"action": "disable_account", "username": username, "success": False, "error": str(e)}
+
+
+def reset_ad_password(username, domain_controller=None):
+    """Force password reset for a compromised AD account."""
+    ps_cmd = (
+        f'Set-ADAccountPassword -Identity "{username}" -Reset '
+        f'-NewPassword (ConvertTo-SecureString -AsPlainText '
+        f'"TempP@ss{datetime.now().strftime("%H%M%S")}!" -Force)'
+    )
+    if domain_controller:
+        ps_cmd += f' -Server "{domain_controller}"'
+    cmd = ["powershell", "-Command", ps_cmd]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+        return {
+            "action": "reset_password",
+            "username": username,
+            "success": result.returncode == 0,
+            "timestamp": datetime.utcnow().isoformat() + "Z",
+        }
+    except Exception as e:
+        return {"action": "reset_password", "username": username, "success": False, "error": str(e)}
+
+
+def isolate_host_firewall(host_ip, management_ip=None):
+    """Isolate a compromised host by blocking all traffic except management."""
+    commands = []
+    if management_ip:
+        commands.append(
+            ["iptables", "-A", "FORWARD", "-s", host_ip, "-d", management_ip, "-j", "ACCEPT"]
+        )
+        commands.append(
+            ["iptables", "-A", "FORWARD", "-s", management_ip, "-d", host_ip, "-j", "ACCEPT"]
+        )
+    commands.append(["iptables", "-A", "FORWARD", "-s", host_ip, "-j", "DROP"])
+    commands.append(["iptables", "-A", "FORWARD", "-d", host_ip, "-j", "DROP"])
+
+    results = []
+    for cmd in commands:
+        try:
+            r = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
+            results.append({"cmd": " ".join(cmd), "success": r.returncode == 0})
+        except Exception as e:
+            results.append({"cmd": " ".join(cmd), "success": False, "error": str(e)})
+
+    return {
+        "action": "isolate_host",
+        "host_ip": host_ip,
+        "management_ip": management_ip,
+        "results": results,
+        "timestamp": datetime.utcnow().isoformat() + "Z",
+    }
+
+
+def block_smb_lateral_movement():
+    """Block SMB (port 445) between server VLANs to prevent lateral movement."""
+    cmd = ["iptables", "-A", "FORWARD", "-p", "tcp", "--dport", "445", "-j", "DROP"]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
+        return {
+            "action": "block_smb",
+            "success": result.returncode == 0,
+            "timestamp": datetime.utcnow().isoformat() + "Z",
+        }
+    except Exception as e:
+        return {"action": "block_smb", "success": False, "error": str(e)}
+
+
+def sinkhole_domain(domain, sinkhole_ip="127.0.0.1", hosts_file="/etc/hosts"):
+    """Add DNS sinkhole entry for a C2 domain."""
+    entry = f"{sinkhole_ip}\t{domain}\t# breach-containment {datetime.utcnow().isoformat()}"
+    try:
+        with open(hosts_file, "r") as f:
+            existing = f.read()
+        if domain in existing:
+            return {"action": "sinkhole", "domain": domain, "status": "already_sinkholed"}
+        with open(hosts_file, "a") as f:
+            f.write("\n" + entry + "\n")
+        return {
+            "action": "sinkhole",
+            "domain": domain,
+            "sinkhole_ip": sinkhole_ip,
+            "success": True,
+            "timestamp": datetime.utcnow().isoformat() + "Z",
+        }
+    except Exception as e:
+        return {"action": "sinkhole", "domain": domain, "success": False, "error": str(e)}
+
+
+def collect_volatile_evidence(host="localhost"):
+    """Collect volatile system data from a compromised host for forensics."""
+    evidence = {}
+    commands = {
+        "processes": ["ps", "auxww"],
+        "network_connections": ["ss", "-tunap"],
+        "logged_users": ["who"],
+        "routing_table": ["ip", "route", "show"],
+        "arp_table": ["arp", "-an"],
+        "open_files": ["lsof", "-i", "-P"],
+    }
+    for name, cmd in commands.items():
+        try:
+            r = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
+            evidence[name] = r.stdout.strip()
+        except Exception as e:
+            evidence[name] = f"Error: {e}"
+
+    return {
+        "action": "collect_evidence",
+        "host": host,
+        "evidence": evidence,
+        "timestamp": datetime.utcnow().isoformat() + "Z",
+    }
+
+
+def generate_containment_report(incident_id, actions_taken):
+    """Generate a structured containment status report."""
+    return {
+        "report_type": "CONTAINMENT_STATUS",
+        "incident_id": incident_id,
+        "timestamp": datetime.utcnow().isoformat() + "Z",
+        "status": "CONTAINED",
+        "actions_taken": actions_taken,
+        "validation_pending": [
+            "Confirm C2 beacons ceased",
+            "Verify disabled accounts produce auth failures",
+            "Check no new lateral movement attempts",
+        ],
+    }
+
+
+if __name__ == "__main__":
+    action = sys.argv[1] if len(sys.argv) > 1 else "help"
+    if action == "block-ip" and len(sys.argv) > 2:
+        print(json.dumps(block_ip_at_firewall(sys.argv[2]), indent=2))
+    elif action == "disable-account" and len(sys.argv) > 2:
+        print(json.dumps(disable_ad_account(sys.argv[2]), indent=2))
+    elif action == "isolate-host" and len(sys.argv) > 2:
+        mgmt = sys.argv[3] if len(sys.argv) > 3 else None
+        print(json.dumps(isolate_host_firewall(sys.argv[2], mgmt), indent=2))
+    elif action == "block-smb":
+        print(json.dumps(block_smb_lateral_movement(), indent=2))
+    elif action == "sinkhole" and len(sys.argv) > 2:
+        print(json.dumps(sinkhole_domain(sys.argv[2]), indent=2))
+    elif action == "collect-evidence":
+        print(json.dumps(collect_volatile_evidence(), indent=2))
+    else:
+        print("Usage: agent.py [block-ip <ip>|disable-account <user>|isolate-host <ip> [mgmt_ip]|block-smb|sinkhole <domain>|collect-evidence]")