mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-30 21:29:40 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,87 @@
|
||||
# Rootkit Detection API Reference
|
||||
|
||||
## Volatility 3 - Rootkit Analysis Plugins
|
||||
|
||||
```bash
|
||||
# Process enumeration - compare for hidden processes
|
||||
vol3 -f memory.dmp windows.pslist # EPROCESS linked list (rootkit-manipulable)
|
||||
vol3 -f memory.dmp windows.psscan # Pool tag scanning (rootkit-resistant)
|
||||
|
||||
# SSDT hook detection
|
||||
vol3 -f memory.dmp windows.ssdt
|
||||
|
||||
# Kernel module listing
|
||||
vol3 -f memory.dmp windows.modules
|
||||
vol3 -f memory.dmp windows.modscan # Scan for hidden modules
|
||||
|
||||
# Driver IRP hook detection
|
||||
vol3 -f memory.dmp windows.driverirp
|
||||
|
||||
# Callback enumeration
|
||||
vol3 -f memory.dmp windows.callbacks
|
||||
|
||||
# IDT (Interrupt Descriptor Table) check
|
||||
vol3 -f memory.dmp windows.idt
|
||||
|
||||
# Injected code detection
|
||||
vol3 -f memory.dmp windows.malfind
|
||||
```
|
||||
|
||||
## Cross-View Detection Method
|
||||
|
||||
```
|
||||
Step 1: Enumerate with pslist (uses EPROCESS ActiveProcessLinks)
|
||||
Step 2: Enumerate with psscan (scans pool tags in physical memory)
|
||||
Step 3: Compare PID sets
|
||||
Step 4: PIDs in psscan but NOT in pslist = hidden by DKOM rootkit
|
||||
```
|
||||
|
||||
## Linux Rootkit Detection Tools
|
||||
|
||||
```bash
|
||||
# rkhunter
|
||||
rkhunter --update # Update signatures
|
||||
rkhunter --check --skip-keypress # Full scan
|
||||
rkhunter --check --report-warnings-only # Warnings only
|
||||
|
||||
# chkrootkit
|
||||
chkrootkit # Full scan
|
||||
chkrootkit -q # Quiet (only infected)
|
||||
|
||||
# Unhide (process and port hiding detection)
|
||||
unhide proc # Compare /proc, ps, syscall enumeration
|
||||
unhide sys # System call brute force
|
||||
unhide-tcp # Hidden TCP/UDP ports
|
||||
```
|
||||
|
||||
## Rootkit Types
|
||||
|
||||
| Type | Hides In | Detection Method |
|
||||
|------|----------|-----------------|
|
||||
| User-mode | LD_PRELOAD, IAT hooks | Cross-view, strace |
|
||||
| Kernel-mode | DKOM, SSDT hooks | Memory forensics |
|
||||
| Bootkits | MBR/VBR/UEFI | Firmware integrity |
|
||||
| Hypervisor | Below OS | Timing analysis |
|
||||
|
||||
## DKOM (Direct Kernel Object Manipulation)
|
||||
|
||||
```
|
||||
Rootkit unlinking technique:
|
||||
EPROCESS(prev).Flink -> EPROCESS(hidden).Flink (skip hidden)
|
||||
EPROCESS(next).Blink -> EPROCESS(hidden).Blink (skip hidden)
|
||||
|
||||
Process disappears from pslist but remains in physical memory (psscan finds it)
|
||||
```
|
||||
|
||||
## Memory Acquisition
|
||||
|
||||
```bash
|
||||
# Windows - WinPmem
|
||||
winpmem_mini_x64.exe memdump.raw
|
||||
|
||||
# Linux - LiME
|
||||
insmod lime.ko "path=/tmp/memory.lime format=lime"
|
||||
|
||||
# Linux - /proc/kcore
|
||||
dd if=/proc/kcore of=/evidence/memory.raw bs=1M
|
||||
```
|
||||
@@ -0,0 +1,204 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Rootkit detection agent using cross-view analysis and integrity checking."""
|
||||
|
||||
import json
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
from datetime import datetime
|
||||
|
||||
|
||||
def run_volatility_pslist(memory_dump):
|
||||
"""List processes using ActiveProcessLinks (EPROCESS linked list)."""
|
||||
cmd = ["vol3", "-f", memory_dump, "windows.pslist"]
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
|
||||
processes = []
|
||||
for line in result.stdout.splitlines():
|
||||
parts = line.split()
|
||||
if len(parts) >= 4 and parts[0].isdigit():
|
||||
processes.append({"pid": int(parts[0]), "ppid": int(parts[1]),
|
||||
"name": parts[2], "threads": parts[3] if len(parts) > 3 else ""})
|
||||
return {"method": "pslist", "count": len(processes), "processes": processes}
|
||||
except FileNotFoundError:
|
||||
return {"error": "Volatility 3 not installed"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"error": "Timed out"}
|
||||
|
||||
|
||||
def run_volatility_psscan(memory_dump):
|
||||
"""Scan physical memory for EPROCESS pool tags (rootkit-resistant)."""
|
||||
cmd = ["vol3", "-f", memory_dump, "windows.psscan"]
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
|
||||
processes = []
|
||||
for line in result.stdout.splitlines():
|
||||
parts = line.split()
|
||||
if len(parts) >= 4 and parts[0].startswith("0x"):
|
||||
processes.append({"offset": parts[0], "pid": parts[1],
|
||||
"ppid": parts[2] if len(parts) > 2 else "",
|
||||
"name": parts[3] if len(parts) > 3 else ""})
|
||||
return {"method": "psscan", "count": len(processes), "processes": processes}
|
||||
except FileNotFoundError:
|
||||
return {"error": "Volatility 3 not installed"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"error": "Timed out"}
|
||||
|
||||
|
||||
def cross_view_detection(memory_dump):
|
||||
"""Compare pslist vs psscan to find hidden processes (DKOM rootkits)."""
|
||||
pslist = run_volatility_pslist(memory_dump)
|
||||
psscan = run_volatility_psscan(memory_dump)
|
||||
|
||||
if "error" in pslist or "error" in psscan:
|
||||
return {"error": "Could not complete cross-view analysis",
|
||||
"pslist": pslist, "psscan": psscan}
|
||||
|
||||
pslist_pids = set(str(p["pid"]) for p in pslist.get("processes", []))
|
||||
psscan_pids = set(str(p.get("pid", "")) for p in psscan.get("processes", []))
|
||||
|
||||
hidden = psscan_pids - pslist_pids
|
||||
hidden_processes = [
|
||||
p for p in psscan.get("processes", [])
|
||||
if str(p.get("pid", "")) in hidden
|
||||
]
|
||||
|
||||
return {
|
||||
"pslist_count": len(pslist_pids),
|
||||
"psscan_count": len(psscan_pids),
|
||||
"hidden_processes": hidden_processes,
|
||||
"hidden_count": len(hidden_processes),
|
||||
"alert": "ROOTKIT DETECTED - Hidden processes found" if hidden_processes else "No hidden processes detected",
|
||||
}
|
||||
|
||||
|
||||
def check_ssdt_hooks(memory_dump):
|
||||
"""Check for SSDT (System Service Descriptor Table) hooks."""
|
||||
cmd = ["vol3", "-f", memory_dump, "windows.ssdt"]
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
|
||||
hooks = []
|
||||
for line in result.stdout.splitlines():
|
||||
if "UNKNOWN" in line.upper() or line.count("\\") == 0:
|
||||
parts = line.split()
|
||||
if len(parts) >= 3:
|
||||
hooks.append({"entry": " ".join(parts)})
|
||||
return {"ssdt_hooks": hooks, "count": len(hooks)}
|
||||
except FileNotFoundError:
|
||||
return {"error": "Volatility 3 not installed"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"error": "Timed out"}
|
||||
|
||||
|
||||
def check_kernel_modules(memory_dump):
|
||||
"""List loaded kernel modules and detect unsigned/suspicious ones."""
|
||||
cmd = ["vol3", "-f", memory_dump, "windows.modules"]
|
||||
try:
|
||||
result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
|
||||
modules = []
|
||||
for line in result.stdout.splitlines():
|
||||
parts = line.split()
|
||||
if len(parts) >= 3 and parts[0].startswith("0x"):
|
||||
modules.append({"base": parts[0], "size": parts[1],
|
||||
"name": parts[2] if len(parts) > 2 else ""})
|
||||
return {"modules": modules, "count": len(modules)}
|
||||
except FileNotFoundError:
|
||||
return {"error": "Volatility 3 not installed"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"error": "Timed out"}
|
||||
|
||||
|
||||
def run_rkhunter():
|
||||
"""Run rkhunter for Linux rootkit detection."""
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["rkhunter", "--check", "--skip-keypress", "--report-warnings-only"],
|
||||
capture_output=True, text=True, timeout=120
|
||||
)
|
||||
warnings = [line.strip() for line in result.stdout.splitlines() if "Warning" in line]
|
||||
return {
|
||||
"tool": "rkhunter",
|
||||
"warnings": warnings,
|
||||
"warning_count": len(warnings),
|
||||
"exit_code": result.returncode,
|
||||
}
|
||||
except FileNotFoundError:
|
||||
return {"error": "rkhunter not installed (apt install rkhunter)"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"error": "rkhunter timed out"}
|
||||
|
||||
|
||||
def run_chkrootkit():
|
||||
"""Run chkrootkit for Linux rootkit detection."""
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["chkrootkit", "-q"], capture_output=True, text=True, timeout=120
|
||||
)
|
||||
infected = [line.strip() for line in result.stdout.splitlines()
|
||||
if "INFECTED" in line.upper()]
|
||||
return {
|
||||
"tool": "chkrootkit",
|
||||
"infected": infected,
|
||||
"infected_count": len(infected),
|
||||
"exit_code": result.returncode,
|
||||
}
|
||||
except FileNotFoundError:
|
||||
return {"error": "chkrootkit not installed (apt install chkrootkit)"}
|
||||
except subprocess.TimeoutExpired:
|
||||
return {"error": "chkrootkit timed out"}
|
||||
|
||||
|
||||
def check_hidden_files_linux():
|
||||
"""Check for hidden files and directories that may indicate a rootkit."""
|
||||
suspicious = []
|
||||
check_dirs = ["/tmp", "/dev/shm", "/var/tmp"]
|
||||
for d in check_dirs:
|
||||
if not os.path.exists(d):
|
||||
continue
|
||||
try:
|
||||
for entry in os.listdir(d):
|
||||
if entry.startswith(".") and entry not in (".", ".."):
|
||||
full_path = os.path.join(d, entry)
|
||||
suspicious.append({
|
||||
"path": full_path,
|
||||
"is_dir": os.path.isdir(full_path),
|
||||
"size": os.path.getsize(full_path) if os.path.isfile(full_path) else 0,
|
||||
})
|
||||
except PermissionError:
|
||||
continue
|
||||
return {"hidden_files": suspicious, "count": len(suspicious)}
|
||||
|
||||
|
||||
def generate_report(memory_dump=None):
|
||||
"""Generate comprehensive rootkit detection report."""
|
||||
report = {"timestamp": datetime.utcnow().isoformat() + "Z"}
|
||||
|
||||
if memory_dump:
|
||||
report["cross_view"] = cross_view_detection(memory_dump)
|
||||
report["ssdt_hooks"] = check_ssdt_hooks(memory_dump)
|
||||
report["kernel_modules"] = check_kernel_modules(memory_dump)
|
||||
else:
|
||||
report["rkhunter"] = run_rkhunter()
|
||||
report["chkrootkit"] = run_chkrootkit()
|
||||
report["hidden_files"] = check_hidden_files_linux()
|
||||
|
||||
return report
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
action = sys.argv[1] if len(sys.argv) > 1 else "help"
|
||||
if action == "cross-view" and len(sys.argv) > 2:
|
||||
print(json.dumps(cross_view_detection(sys.argv[2]), indent=2, default=str))
|
||||
elif action == "malfind" and len(sys.argv) > 2:
|
||||
print(json.dumps(run_volatility_pslist(sys.argv[2]), indent=2, default=str))
|
||||
elif action == "ssdt" and len(sys.argv) > 2:
|
||||
print(json.dumps(check_ssdt_hooks(sys.argv[2]), indent=2, default=str))
|
||||
elif action == "rkhunter":
|
||||
print(json.dumps(run_rkhunter(), indent=2))
|
||||
elif action == "chkrootkit":
|
||||
print(json.dumps(run_chkrootkit(), indent=2))
|
||||
elif action == "report":
|
||||
mem = sys.argv[2] if len(sys.argv) > 2 else None
|
||||
print(json.dumps(generate_report(mem), indent=2, default=str))
|
||||
else:
|
||||
print("Usage: agent.py [cross-view <mem>|malfind <mem>|ssdt <mem>|rkhunter|chkrootkit|report [mem]]")
|
||||
Reference in New Issue
Block a user