Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

skills/detecting-pass-the-hash-attacks/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Anthropic Agent Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skills/detecting-pass-the-hash-attacks/references/api-reference.md

@@ -0,0 +1,43 @@
+# API Reference: Detecting Pass-the-Hash Attacks
+
+## python-evtx Library
+```python
+from Evtx.Evtx import FileHeader
+with open("Security.evtx", "rb") as f:
+    fh = FileHeader(f)
+    for record in fh.records():
+        xml_string = record.xml()
+```
+
+## Event 4624 - NTLM Network Logon (PTH Indicator)
+```xml
+<Data Name="TargetUserName">admin</Data>
+<Data Name="TargetDomainName">CORP</Data>
+<Data Name="LogonType">3</Data>
+<Data Name="AuthenticationPackageName">NTLM</Data>
+<Data Name="LmPackageName">NTLM V2</Data>
+<Data Name="LogonProcessName">NtLmSsp</Data>
+<Data Name="KeyLength">0</Data>
+<Data Name="IpAddress">10.0.0.50</Data>
+<Data Name="WorkstationName">ATTACKER-PC</Data>
+```
+
+## PTH Detection Indicators
+| Field | PTH Value | Normal |
+|-------|-----------|--------|
+| LogonType | 3 (Network) | Various |
+| AuthenticationPackageName | NTLM | Kerberos |
+| LogonProcessName | NtLmSsp | Kerberos |
+| KeyLength | 0 | 128 |
+| LmPackageName | NTLM V1 (weaker) | NTLM V2 |
+
+## Detection Logic
+1. Filter 4624 where LogonType=3 AND AuthenticationPackageName=NTLM
+2. Flag events with KeyLength=0 (hash-only authentication)
+3. Detect same account authenticating from 3+ different source IPs
+4. Detect account used from 3+ different workstation names
+5. Correlate with process creation (4688) for post-exploitation activity
+
+## MITRE ATT&CK
+- T1550.002 - Pass the Hash
+- T1078 - Valid Accounts

skills/detecting-pass-the-hash-attacks/scripts/agent.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""Pass-the-Hash Detection Agent - Detects PTH via NTLM Event 4624 LogonType=3 analysis."""
+
+import json
+import logging
+import argparse
+from collections import defaultdict
+from datetime import datetime
+
+from Evtx.Evtx import FileHeader
+from lxml import etree
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
+logger = logging.getLogger(__name__)
+
+NS = {"evt": "http://schemas.microsoft.com/win/2004/08/events/event"}
+
+
+def parse_ntlm_logons(evtx_path):
+    """Parse Event 4624 NTLM network logons from Security EVTX."""
+    ntlm_logons = []
+    with open(evtx_path, "rb") as f:
+        fh = FileHeader(f)
+        for record in fh.records():
+            try:
+                xml = record.xml()
+                root = etree.fromstring(xml.encode("utf-8"))
+                eid = root.find(".//evt:System/evt:EventID", NS)
+                if eid is None or eid.text != "4624":
+                    continue
+                data = {}
+                for elem in root.findall(".//evt:EventData/evt:Data", NS):
+                    data[elem.get("Name", "")] = elem.text or ""
+                if data.get("LogonType") == "3" and data.get("AuthenticationPackageName") == "NTLM":
+                    time_elem = root.find(".//evt:System/evt:TimeCreated", NS)
+                    ntlm_logons.append({
+                        "timestamp": time_elem.get("SystemTime", "") if time_elem is not None else "",
+                        "account": data.get("TargetUserName", ""),
+                        "domain": data.get("TargetDomainName", ""),
+                        "source_ip": data.get("IpAddress", ""),
+                        "workstation": data.get("WorkstationName", ""),
+                        "logon_process": data.get("LogonProcessName", ""),
+                        "lm_package": data.get("LmPackageName", ""),
+                        "key_length": data.get("KeyLength", ""),
+                    })
+            except Exception:
+                continue
+    logger.info("Parsed %d NTLM network logon events", len(ntlm_logons))
+    return ntlm_logons
+
+
+def detect_pth_indicators(ntlm_logons):
+    """Detect Pass-the-Hash indicators in NTLM logon events."""
+    pth_candidates = []
+    for logon in ntlm_logons:
+        indicators = []
+        if logon["logon_process"].strip() == "NtLmSsp":
+            indicators.append("NtLmSsp logon process")
+        if logon["lm_package"].strip() == "NTLM V1":
+            indicators.append("NTLMv1 (weaker, often PTH)")
+        if logon["key_length"] == "0":
+            indicators.append("Zero key length (PTH indicator)")
+        if logon["workstation"] and logon["source_ip"]:
+            indicators.append("Remote NTLM with workstation name")
+        if indicators:
+            logon["pth_indicators"] = indicators
+            logon["confidence"] = min(len(indicators) * 25, 100)
+            pth_candidates.append(logon)
+    logger.info("Found %d PTH candidate events", len(pth_candidates))
+    return pth_candidates
+
+
+def detect_lateral_movement_chains(ntlm_logons):
+    """Detect chains of NTLM logons from the same account across multiple hosts."""
+    account_hosts = defaultdict(set)
+    account_events = defaultdict(list)
+    for logon in ntlm_logons:
+        account = f"{logon['domain']}\\{logon['account']}"
+        if not logon["account"].endswith("$"):
+            account_hosts[account].add(logon["source_ip"])
+            account_events[account].append(logon)
+    chains = []
+    for account, hosts in account_hosts.items():
+        if len(hosts) >= 3:
+            chains.append({
+                "account": account,
+                "unique_source_ips": len(hosts),
+                "total_logons": len(account_events[account]),
+                "source_ips": list(hosts),
+                "indicator": "Multi-host NTLM lateral movement",
+                "severity": "critical" if len(hosts) >= 5 else "high",
+            })
+    logger.info("Found %d lateral movement chains", len(chains))
+    return chains
+
+
+def detect_workstation_mismatch(ntlm_logons):
+    """Detect mismatches between source workstation and expected host."""
+    account_workstations = defaultdict(set)
+    for logon in ntlm_logons:
+        if logon["account"] and not logon["account"].endswith("$"):
+            key = f"{logon['domain']}\\{logon['account']}"
+            account_workstations[key].add(logon["workstation"])
+    mismatches = []
+    for account, workstations in account_workstations.items():
+        if len(workstations) >= 3:
+            mismatches.append({
+                "account": account,
+                "unique_workstations": len(workstations),
+                "workstations": list(workstations),
+                "indicator": "Account used from multiple workstations (PTH spread)",
+            })
+    return mismatches
+
+
+def generate_report(ntlm_logons, pth_candidates, chains, mismatches):
+    """Generate Pass-the-Hash detection report."""
+    report = {
+        "timestamp": datetime.utcnow().isoformat(),
+        "total_ntlm_logons": len(ntlm_logons),
+        "pth_candidates": len(pth_candidates),
+        "lateral_movement_chains": len(chains),
+        "workstation_mismatches": len(mismatches),
+        "high_confidence_pth": [p for p in pth_candidates if p.get("confidence", 0) >= 75],
+        "chain_details": chains,
+        "mismatch_details": mismatches,
+        "sample_pth_events": pth_candidates[:20],
+    }
+    total = len(pth_candidates) + len(chains)
+    print(f"PTH DETECTION: {len(pth_candidates)} candidates, {len(chains)} lateral chains")
+    return report
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Pass-the-Hash Detection Agent")
+    parser.add_argument("--evtx-file", required=True, help="Path to Security EVTX file")
+    parser.add_argument("--output", default="pth_report.json")
+    args = parser.parse_args()
+
+    ntlm_logons = parse_ntlm_logons(args.evtx_file)
+    pth_candidates = detect_pth_indicators(ntlm_logons)
+    chains = detect_lateral_movement_chains(ntlm_logons)
+    mismatches = detect_workstation_mismatch(ntlm_logons)
+
+    report = generate_report(ntlm_logons, pth_candidates, chains, mismatches)
+    with open(args.output, "w") as f:
+        json.dump(report, f, indent=2)
+    logger.info("Report saved to %s", args.output)
+
+
+if __name__ == "__main__":
+    main()