mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-05 10:20:18 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,55 @@
|
||||
# API Reference: Detecting Lateral Movement with Splunk
|
||||
|
||||
## Key Lateral Movement Techniques
|
||||
|
||||
| Technique | MITRE ID | Event Source |
|
||||
|-----------|----------|-------------|
|
||||
| Pass-the-Hash | T1550.002 | Event 4624 Logon_Type=3 NTLM |
|
||||
| PSExec | T1569.002 | Sysmon Event 1 (PSEXESVC.exe) |
|
||||
| WMI Remote Exec | T1047 | Sysmon Event 1 (wmiprvse.exe) |
|
||||
| RDP Pivoting | T1021.001 | Event 4624 Logon_Type=10 |
|
||||
| SMB/Admin Share | T1021.002 | Network logs dest_port=445 |
|
||||
| WinRM | T1021.006 | Sysmon Event 1 (wsmprovhost.exe) |
|
||||
|
||||
## Splunk SPL Syntax
|
||||
|
||||
```spl
|
||||
# Pass-the-Hash detection
|
||||
index=wineventlog EventCode=4624 Logon_Type=3
|
||||
| where Authentication_Package="NTLM"
|
||||
| stats dc(Computer) as targets by Source_Network_Address
|
||||
| where targets > 3
|
||||
|
||||
# PSExec detection
|
||||
index=sysmon EventCode=1
|
||||
| where ParentImage="*\\services.exe" AND Image="*\\PSEXESVC.exe"
|
||||
```
|
||||
|
||||
## splunklib Python SDK
|
||||
|
||||
```python
|
||||
import splunklib.client as client
|
||||
import splunklib.results as results
|
||||
|
||||
service = client.connect(host="splunk", port=8089, token="...")
|
||||
job = service.jobs.create("search index=wineventlog EventCode=4624")
|
||||
for result in results.JSONResultsReader(job.results(output_mode="json")):
|
||||
print(result)
|
||||
```
|
||||
|
||||
## Windows Logon Types
|
||||
|
||||
| Type | Description |
|
||||
|------|-------------|
|
||||
| 2 | Interactive (console) |
|
||||
| 3 | Network (SMB, PSExec) |
|
||||
| 7 | Unlock |
|
||||
| 10 | RemoteInteractive (RDP) |
|
||||
|
||||
## CLI Usage
|
||||
|
||||
```bash
|
||||
python agent.py --generate-queries
|
||||
python agent.py --generate-queries --techniques pass_the_hash psexec_execution
|
||||
python agent.py --parse-results splunk_output.json
|
||||
```
|
||||
@@ -0,0 +1,143 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Lateral movement detection agent using Splunk SPL query generation.
|
||||
|
||||
Generates and analyzes SPL queries for detecting lateral movement techniques
|
||||
including pass-the-hash, RDP pivoting, WMI/PSExec execution, and SMB abuse.
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from datetime import datetime
|
||||
|
||||
LATERAL_MOVEMENT_QUERIES = {
|
||||
"pass_the_hash": {
|
||||
"mitre": "T1550.002",
|
||||
"severity": "CRITICAL",
|
||||
"spl": """index=wineventlog EventCode=4624 Logon_Type=3
|
||||
| where Authentication_Package="NTLM" AND Logon_Process="NtLmSsp"
|
||||
| where NOT match(Source_Network_Address, "^(127\\.0\\.0\\.1|::1|-)")
|
||||
| stats count dc(Computer) as target_count values(Computer) as targets by Source_Network_Address Account_Name
|
||||
| where target_count > 3
|
||||
| sort -target_count"""
|
||||
},
|
||||
"psexec_execution": {
|
||||
"mitre": "T1569.002",
|
||||
"severity": "HIGH",
|
||||
"spl": """index=sysmon EventCode=1
|
||||
| where (ParentImage="*\\services.exe" AND Image="*\\PSEXESVC.exe")
|
||||
OR (Image="*\\psexec.exe" OR Image="*\\psexec64.exe")
|
||||
| stats count by Image, ParentImage, CommandLine, Computer, User
|
||||
| sort -count"""
|
||||
},
|
||||
"wmi_remote_execution": {
|
||||
"mitre": "T1047",
|
||||
"severity": "HIGH",
|
||||
"spl": """index=sysmon EventCode=1
|
||||
| where (Image="*\\wmiprvse.exe" AND ParentImage="*\\svchost.exe")
|
||||
| where CommandLine!=""
|
||||
| stats count by CommandLine, Computer, User
|
||||
| sort -count"""
|
||||
},
|
||||
"rdp_pivoting": {
|
||||
"mitre": "T1021.001",
|
||||
"severity": "MEDIUM",
|
||||
"spl": """index=wineventlog EventCode=4624 Logon_Type=10
|
||||
| stats count dc(Computer) as rdp_targets values(Computer) as targets by Source_Network_Address Account_Name
|
||||
| where rdp_targets > 3
|
||||
| sort -rdp_targets"""
|
||||
},
|
||||
"smb_lateral": {
|
||||
"mitre": "T1021.002",
|
||||
"severity": "HIGH",
|
||||
"spl": """index=network dest_port=445
|
||||
| stats count dc(dest_ip) as smb_targets values(dest_ip) as targets by src_ip
|
||||
| where smb_targets > 5
|
||||
| sort -smb_targets"""
|
||||
},
|
||||
"winrm_execution": {
|
||||
"mitre": "T1021.006",
|
||||
"severity": "HIGH",
|
||||
"spl": """index=sysmon EventCode=1
|
||||
| where Image="*\\wsmprovhost.exe" OR (ParentImage="*\\winrshost.exe")
|
||||
| stats count by Image, CommandLine, Computer, User
|
||||
| sort -count"""
|
||||
},
|
||||
"service_creation": {
|
||||
"mitre": "T1543.003",
|
||||
"severity": "HIGH",
|
||||
"spl": """index=wineventlog EventCode=7045
|
||||
| where Service_Type="user mode service"
|
||||
| stats count by Service_Name, Service_File_Name, Computer
|
||||
| where match(Service_File_Name, "(cmd|powershell|\\\\\\\\|%COMSPEC%)")
|
||||
| sort -count"""
|
||||
},
|
||||
"scheduled_task_remote": {
|
||||
"mitre": "T1053.005",
|
||||
"severity": "HIGH",
|
||||
"spl": """index=sysmon EventCode=1 Image="*\\schtasks.exe"
|
||||
| where match(CommandLine, "/create.*/s\\s")
|
||||
| stats count by CommandLine, Computer, User
|
||||
| sort -count"""
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
def generate_queries(techniques=None):
|
||||
if techniques:
|
||||
selected = {k: v for k, v in LATERAL_MOVEMENT_QUERIES.items() if k in techniques}
|
||||
else:
|
||||
selected = LATERAL_MOVEMENT_QUERIES
|
||||
|
||||
return [{"technique": name, **details} for name, details in selected.items()]
|
||||
|
||||
|
||||
def parse_splunk_results(filepath):
|
||||
findings = []
|
||||
with open(filepath, "r") as f:
|
||||
try:
|
||||
data = json.load(f)
|
||||
results = data.get("results", data if isinstance(data, list) else [data])
|
||||
except json.JSONDecodeError:
|
||||
f.seek(0)
|
||||
import csv
|
||||
reader = csv.DictReader(f)
|
||||
results = list(reader)
|
||||
|
||||
for row in results:
|
||||
target_count = int(row.get("target_count", row.get("dc(Computer)", 0)))
|
||||
if target_count >= 3:
|
||||
findings.append({
|
||||
"source": row.get("Source_Network_Address", row.get("src_ip", "")),
|
||||
"user": row.get("Account_Name", row.get("User", "")),
|
||||
"target_count": target_count,
|
||||
"targets": row.get("targets", row.get("Computer", "")),
|
||||
"severity": "CRITICAL" if target_count >= 10 else "HIGH",
|
||||
})
|
||||
return findings
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Lateral Movement Detector (Splunk SPL)")
|
||||
parser.add_argument("--generate-queries", action="store_true", help="Generate SPL queries")
|
||||
parser.add_argument("--techniques", nargs="+", choices=list(LATERAL_MOVEMENT_QUERIES.keys()),
|
||||
help="Specific techniques to query")
|
||||
parser.add_argument("--parse-results", help="Parse Splunk JSON/CSV results file")
|
||||
args = parser.parse_args()
|
||||
|
||||
results = {"timestamp": datetime.utcnow().isoformat() + "Z"}
|
||||
|
||||
if args.generate_queries:
|
||||
results["queries"] = generate_queries(args.techniques)
|
||||
results["total_queries"] = len(results["queries"])
|
||||
|
||||
if args.parse_results:
|
||||
findings = parse_splunk_results(args.parse_results)
|
||||
results["findings"] = findings
|
||||
results["total_findings"] = len(findings)
|
||||
|
||||
print(json.dumps(results, indent=2))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user