mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-10 20:33:20 +03:00
Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
This commit is contained in:
mukul975
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2025 Anthropic Agent Skills Contributors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,57 @@
|
||||
# API Reference: Implementing CloudTrail Log Analysis
|
||||
|
||||
## Libraries
|
||||
|
||||
### boto3 -- AWS CloudTrail
|
||||
- **Install**: `pip install boto3`
|
||||
- **Docs**: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudtrail.html
|
||||
|
||||
### Key Methods
|
||||
|
||||
| Method | Description |
|
||||
|--------|-------------|
|
||||
| `lookup_events()` | Search recent CloudTrail events with filters |
|
||||
| `describe_trails()` | List configured trails |
|
||||
| `get_trail_status()` | Check if trail is actively logging |
|
||||
| `create_trail()` | Create a new CloudTrail trail |
|
||||
| `start_logging()` / `stop_logging()` | Control trail recording |
|
||||
| `get_event_selectors()` | View event type configuration |
|
||||
| `put_event_selectors()` | Configure management/data event capture |
|
||||
|
||||
## Lookup Attributes
|
||||
|
||||
| AttributeKey | Description |
|
||||
|-------------|-------------|
|
||||
| `EventName` | API action name (e.g., `RunInstances`) |
|
||||
| `Username` | IAM user or role name |
|
||||
| `ResourceType` | AWS resource type |
|
||||
| `ResourceName` | Specific resource identifier |
|
||||
| `EventSource` | AWS service (e.g., `ec2.amazonaws.com`) |
|
||||
| `ReadOnly` | Filter read vs write events |
|
||||
|
||||
## Suspicious Event Names
|
||||
|
||||
| Event | Threat Category |
|
||||
|-------|----------------|
|
||||
| `StopLogging` / `DeleteTrail` | Anti-forensics |
|
||||
| `CreateUser` / `CreateAccessKey` | Persistence |
|
||||
| `AttachUserPolicy` / `PutUserPolicy` | Privilege escalation |
|
||||
| `ConsoleLogin` (failed) | Brute force |
|
||||
| `RunInstances` | Resource abuse / cryptomining |
|
||||
| `AuthorizeSecurityGroupIngress` | Lateral movement |
|
||||
| `DisableKey` | Ransomware indicator |
|
||||
|
||||
## Athena Query Integration
|
||||
- Create Athena table from CloudTrail S3 logs
|
||||
- SQL queries for historical analysis beyond 90-day API limit
|
||||
- Partition by region, year, month for performance
|
||||
|
||||
## CloudWatch Logs Insights
|
||||
- `filter eventName = "ConsoleLogin"` -- Login analysis
|
||||
- `stats count(*) by eventName` -- API call frequency
|
||||
- `filter errorCode = "AccessDenied"` -- Permission issues
|
||||
|
||||
## External References
|
||||
- CloudTrail User Guide: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/
|
||||
- CloudTrail Log Events: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference.html
|
||||
- Athena + CloudTrail: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html
|
||||
@@ -0,0 +1,176 @@
|
||||
#!/usr/bin/env python3
|
||||
"""CloudTrail log analysis agent for security monitoring and threat detection."""
|
||||
|
||||
import json
|
||||
import sys
|
||||
import argparse
|
||||
from datetime import datetime, timedelta
|
||||
from collections import Counter
|
||||
|
||||
try:
|
||||
import boto3
|
||||
from botocore.exceptions import ClientError
|
||||
except ImportError:
|
||||
print("Install boto3: pip install boto3")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
SUSPICIOUS_EVENTS = {
|
||||
"ConsoleLogin": "Potential unauthorized console access",
|
||||
"StopLogging": "CloudTrail logging disabled - cover tracks",
|
||||
"DeleteTrail": "CloudTrail trail deleted - evidence destruction",
|
||||
"CreateUser": "New IAM user created - possible persistence",
|
||||
"CreateAccessKey": "New access key - potential credential theft",
|
||||
"AttachUserPolicy": "Policy attached to user - privilege escalation",
|
||||
"PutBucketPolicy": "S3 bucket policy changed - data exposure risk",
|
||||
"AuthorizeSecurityGroupIngress": "Security group opened - lateral movement",
|
||||
"RunInstances": "EC2 instances launched - cryptomining or C2",
|
||||
"CreateRole": "New IAM role created - privilege escalation",
|
||||
"AssumeRole": "Role assumed - potential lateral movement",
|
||||
"PutUserPolicy": "Inline policy added to user",
|
||||
"DeleteBucketEncryption": "Bucket encryption removed",
|
||||
"DisableKey": "KMS key disabled - ransomware indicator",
|
||||
"ModifyInstanceAttribute": "Instance attribute changed",
|
||||
}
|
||||
|
||||
|
||||
def get_cloudtrail_client(region="us-east-1"):
|
||||
"""Create CloudTrail client."""
|
||||
return boto3.client("cloudtrail", region_name=region)
|
||||
|
||||
|
||||
def lookup_events(client, event_name=None, hours=24, max_results=50):
|
||||
"""Look up CloudTrail events with optional filtering."""
|
||||
start_time = datetime.utcnow() - timedelta(hours=hours)
|
||||
kwargs = {"StartTime": start_time, "MaxResults": max_results,
|
||||
"LookupAttributes": []}
|
||||
if event_name:
|
||||
kwargs["LookupAttributes"] = [{"AttributeKey": "EventName", "AttributeValue": event_name}]
|
||||
try:
|
||||
resp = client.lookup_events(**kwargs)
|
||||
events = []
|
||||
for e in resp.get("Events", []):
|
||||
detail = json.loads(e.get("CloudTrailEvent", "{}"))
|
||||
events.append({
|
||||
"event_name": e.get("EventName"),
|
||||
"event_time": str(e.get("EventTime")),
|
||||
"username": e.get("Username", "unknown"),
|
||||
"source_ip": detail.get("sourceIPAddress", "unknown"),
|
||||
"user_agent": detail.get("userAgent", "unknown"),
|
||||
"region": detail.get("awsRegion", "unknown"),
|
||||
"error_code": detail.get("errorCode"),
|
||||
"error_message": detail.get("errorMessage"),
|
||||
"resources": [r.get("ResourceName", "") for r in e.get("Resources", [])],
|
||||
})
|
||||
return events
|
||||
except ClientError as e:
|
||||
return [{"error": str(e)}]
|
||||
|
||||
|
||||
def detect_suspicious_activity(client, hours=24):
|
||||
"""Scan CloudTrail for suspicious API calls."""
|
||||
detections = []
|
||||
for event_name, description in SUSPICIOUS_EVENTS.items():
|
||||
events = lookup_events(client, event_name=event_name, hours=hours)
|
||||
for e in events:
|
||||
if e.get("error"):
|
||||
continue
|
||||
severity = "CRITICAL" if event_name in ["StopLogging", "DeleteTrail", "DisableKey"] \
|
||||
else "HIGH" if event_name in ["CreateUser", "CreateAccessKey", "AttachUserPolicy"] \
|
||||
else "MEDIUM"
|
||||
detections.append({
|
||||
"event": event_name, "description": description,
|
||||
"severity": severity, "user": e["username"],
|
||||
"source_ip": e["source_ip"], "time": e["event_time"],
|
||||
"resources": e["resources"],
|
||||
})
|
||||
return sorted(detections, key=lambda x: {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2}.get(x["severity"], 3))
|
||||
|
||||
|
||||
def detect_failed_auth(client, hours=24):
|
||||
"""Detect failed authentication attempts."""
|
||||
events = lookup_events(client, event_name="ConsoleLogin", hours=hours, max_results=100)
|
||||
failed = [e for e in events if e.get("error_code")]
|
||||
by_ip = Counter(e["source_ip"] for e in failed)
|
||||
by_user = Counter(e["username"] for e in failed)
|
||||
return {"total_failed": len(failed), "by_source_ip": dict(by_ip.most_common(10)),
|
||||
"by_username": dict(by_user.most_common(10))}
|
||||
|
||||
|
||||
def detect_unauthorized_regions(client, authorized_regions, hours=24):
|
||||
"""Detect API calls from unauthorized AWS regions."""
|
||||
events = lookup_events(client, hours=hours, max_results=100)
|
||||
unauthorized = [e for e in events if e.get("region") and
|
||||
e["region"] not in authorized_regions and not e.get("error")]
|
||||
return unauthorized
|
||||
|
||||
|
||||
def analyze_user_activity(client, username, hours=24):
|
||||
"""Analyze all activity for a specific user."""
|
||||
kwargs = {"StartTime": datetime.utcnow() - timedelta(hours=hours),
|
||||
"MaxResults": 50,
|
||||
"LookupAttributes": [{"AttributeKey": "Username", "AttributeValue": username}]}
|
||||
try:
|
||||
resp = client.lookup_events(**kwargs)
|
||||
actions = Counter()
|
||||
timeline = []
|
||||
for e in resp.get("Events", []):
|
||||
actions[e.get("EventName")] += 1
|
||||
timeline.append({"event": e.get("EventName"), "time": str(e.get("EventTime"))})
|
||||
return {"user": username, "total_events": len(timeline),
|
||||
"actions": dict(actions.most_common(20)), "timeline": timeline[:20]}
|
||||
except ClientError as e:
|
||||
return {"error": str(e)}
|
||||
|
||||
|
||||
def run_cloudtrail_analysis(region="us-east-1", hours=24):
|
||||
"""Run comprehensive CloudTrail security analysis."""
|
||||
client = get_cloudtrail_client(region)
|
||||
|
||||
print(f"\n{'='*60}")
|
||||
print(f" CLOUDTRAIL SECURITY ANALYSIS")
|
||||
print(f" Region: {region} | Lookback: {hours}h")
|
||||
print(f" Generated: {datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S')} UTC")
|
||||
print(f"{'='*60}\n")
|
||||
|
||||
detections = detect_suspicious_activity(client, hours)
|
||||
print(f"--- SUSPICIOUS ACTIVITY ({len(detections)} detections) ---")
|
||||
for d in detections[:15]:
|
||||
print(f" [{d['severity']}] {d['event']}: {d['description']}")
|
||||
print(f" User: {d['user']} | IP: {d['source_ip']} | Time: {d['time']}")
|
||||
|
||||
auth = detect_failed_auth(client, hours)
|
||||
print(f"\n--- FAILED AUTHENTICATION ---")
|
||||
print(f" Total failures: {auth['total_failed']}")
|
||||
print(f" Top IPs: {auth['by_source_ip']}")
|
||||
print(f" Top Users: {auth['by_username']}")
|
||||
|
||||
print(f"\n{'='*60}\n")
|
||||
return {"detections": detections, "auth_failures": auth}
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="CloudTrail Log Analysis Agent")
|
||||
parser.add_argument("--region", default="us-east-1")
|
||||
parser.add_argument("--hours", type=int, default=24, help="Lookback period in hours")
|
||||
parser.add_argument("--analyze", action="store_true", help="Run full analysis")
|
||||
parser.add_argument("--user", help="Analyze specific user activity")
|
||||
parser.add_argument("--output", help="Save report to JSON")
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.user:
|
||||
client = get_cloudtrail_client(args.region)
|
||||
result = analyze_user_activity(client, args.user, args.hours)
|
||||
print(json.dumps(result, indent=2, default=str))
|
||||
elif args.analyze:
|
||||
report = run_cloudtrail_analysis(args.region, args.hours)
|
||||
if args.output:
|
||||
with open(args.output, "w") as f:
|
||||
json.dump(report, f, indent=2, default=str)
|
||||
print(f"[+] Report saved to {args.output}")
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user