Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

skills/exploiting-zerologon-vulnerability-cve-2020-1472/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Anthropic Agent Skills Contributors
+Copyright (c) 2025 Mahipal
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md

@@ -0,0 +1,87 @@
+# API Reference: Zerologon (CVE-2020-1472)
+
+## Vulnerability Overview
+- **CVE**: CVE-2020-1472
+- **CVSS**: 10.0 (Critical)
+- **Protocol**: MS-NRPC (Netlogon Remote Protocol)
+- **Port**: 135 (RPC)
+- **Impact**: Domain Admin without credentials
+
+## Attack Mechanism
+The Netlogon AES-CFB8 implementation uses a static IV of zero bytes.
+Sending authentication requests with 256 zero bytes succeeds with
+probability 1/256 per attempt.
+
+## Detection Tools
+
+### Nmap
+```bash
+nmap -p 135,445 --script smb-vuln-cve-2020-1472 <DC_IP>
+```
+
+### Impacket zerologon_tester.py
+```bash
+zerologon_tester.py DC01 10.10.10.1
+```
+
+### CrackMapExec
+```bash
+crackmapexec smb <DC_IP> -u '' -p '' -M zerologon
+```
+
+## Patch Information
+
+### Microsoft KBs
+| KB | OS Version |
+|----|-----------|
+| KB4571694 | Windows Server 2016 |
+| KB4571703 | Windows Server 2019 |
+| KB4571723 | Windows Server 2012 R2 |
+| KB4571736 | Windows Server 2012 |
+
+### Registry Key for Enforcement
+```
+HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
+FullSecureChannelProtection = 1 (DWORD)
+```
+
+## MS-NRPC Protocol
+
+### NetrServerAuthenticate3
+```
+DCERPC call to \PIPE\netlogon
+Function: NetrServerAuthenticate3
+ClientCredential: 8 zero bytes
+NegotiateFlags: 0x212fffff
+```
+
+### Authentication Flow
+1. Client calls `NetrServerReqChallenge` (sends 8 zero bytes)
+2. Server responds with ServerChallenge
+3. Client calls `NetrServerAuthenticate3` (ClientCredential = zeros)
+4. On success (~1/256), client sets DC machine password to empty
+
+## Event Log Detection
+
+### Event IDs
+| Event | Source | Description |
+|-------|--------|-------------|
+| 5827 | Netlogon | Vulnerable connection denied |
+| 5828 | Netlogon | Vulnerable connection allowed |
+| 5829 | Netlogon | Vulnerable connection (audit mode) |
+| 5830 | Netlogon | Device allowed by GPO exception |
+| 5831 | Netlogon | Device denied |
+
+### KQL Detection
+```kql
+SecurityEvent
+| where EventID in (5827, 5828, 5829)
+| project TimeGenerated, Computer, EventData
+```
+
+## Remediation
+1. Apply KB patches immediately
+2. Set `FullSecureChannelProtection = 1`
+3. Monitor Event IDs 5827-5831
+4. Block RPC port 135 from untrusted networks
+5. Enable DC enforcement mode

skills/exploiting-zerologon-vulnerability-cve-2020-1472/scripts/agent.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""Agent for detecting Zerologon (CVE-2020-1472) vulnerability — authorized testing only."""
+
+import argparse
+import json
+import socket
+import subprocess
+import sys
+from datetime import datetime, timezone
+
+
+def check_zerologon_nmap(dc_ip):
+    """Use nmap script to check for Zerologon vulnerability."""
+    try:
+        result = subprocess.check_output(
+            ["nmap", "-p", "135,445", "--script", "smb-vuln-cve-2020-1472", dc_ip],
+            text=True, errors="replace", timeout=30
+        )
+        return {
+            "method": "nmap",
+            "target": dc_ip,
+            "vulnerable": "VULNERABLE" in result.upper(),
+            "output": result[:500],
+        }
+    except (subprocess.SubprocessError, FileNotFoundError):
+        return {"method": "nmap", "status": "nmap not available"}
+
+
+def check_zerologon_impacket(dc_name, dc_ip):
+    """Check vulnerability using zerologon_tester.py from Impacket."""
+    try:
+        result = subprocess.check_output(
+            ["zerologon_tester.py", dc_name, dc_ip],
+            text=True, errors="replace", timeout=30
+        )
+        return {
+            "method": "zerologon_tester",
+            "target": dc_ip,
+            "dc_name": dc_name,
+            "vulnerable": "success" in result.lower() or "vulnerable" in result.lower(),
+            "output": result[:500],
+        }
+    except (subprocess.SubprocessError, FileNotFoundError):
+        return {"method": "zerologon_tester", "status": "tool not available"}
+
+
+def check_patch_status(dc_ip):
+    """Check if DC has Zerologon patches applied."""
+    if sys.platform != "win32":
+        return {"status": "non-windows — use remote check"}
+    try:
+        result = subprocess.check_output(
+            ["wmic", "/node:" + dc_ip, "qfe", "list", "brief"],
+            text=True, errors="replace", timeout=15
+        )
+        patches = ["KB4571694", "KB4571703", "KB4571723", "KB4571736"]
+        found = [kb for kb in patches if kb in result]
+        return {
+            "target": dc_ip,
+            "patched": len(found) > 0,
+            "patches_found": found,
+            "patches_checked": patches,
+        }
+    except subprocess.SubprocessError:
+        return {"status": "wmic check failed"}
+
+
+def check_secure_channel(dc_ip):
+    """Verify Netlogon secure channel is enforced."""
+    ps_cmd = (
+        f"Get-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters' "
+        f"-Name FullSecureChannelProtection -ErrorAction SilentlyContinue | "
+        f"Select-Object FullSecureChannelProtection | ConvertTo-Json"
+    )
+    try:
+        result = subprocess.check_output(
+            ["powershell", "-NoProfile", "-Command", ps_cmd],
+            text=True, errors="replace", timeout=10
+        )
+        data = json.loads(result) if result.strip() else {}
+        enforced = data.get("FullSecureChannelProtection", 0) == 1
+        return {"secure_channel_enforced": enforced}
+    except (subprocess.SubprocessError, json.JSONDecodeError):
+        return {"status": "check_failed"}
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Detect Zerologon CVE-2020-1472 (authorized testing only)"
+    )
+    parser.add_argument("--dc-ip", required=True, help="Domain controller IP")
+    parser.add_argument("--dc-name", help="DC NetBIOS name (for Impacket check)")
+    parser.add_argument("--nmap", action="store_true", help="Use nmap check")
+    parser.add_argument("--check-patch", action="store_true")
+    parser.add_argument("--output", "-o", help="Output JSON report")
+    args = parser.parse_args()
+
+    print("[*] Zerologon (CVE-2020-1472) Detection Agent")
+    print("[!] For authorized security testing only")
+    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": {}}
+
+    if args.nmap:
+        result = check_zerologon_nmap(args.dc_ip)
+        report["findings"]["nmap"] = result
+        print(f"[*] nmap check: vulnerable={result.get('vulnerable', 'unknown')}")
+
+    if args.dc_name:
+        result = check_zerologon_impacket(args.dc_name, args.dc_ip)
+        report["findings"]["impacket"] = result
+        print(f"[*] Impacket check: {result.get('vulnerable', result.get('status'))}")
+
+    if args.check_patch:
+        patch = check_patch_status(args.dc_ip)
+        report["findings"]["patch_status"] = patch
+        channel = check_secure_channel(args.dc_ip)
+        report["findings"]["secure_channel"] = channel
+
+    report["risk_level"] = "CRITICAL" if any(
+        v.get("vulnerable") for v in report["findings"].values() if isinstance(v, dict)
+    ) else "LOW"
+
+    if args.output:
+        with open(args.output, "w") as f:
+            json.dump(report, f, indent=2)
+        print(f"[*] Report saved to {args.output}")
+    else:
+        print(json.dumps(report, indent=2))
+
+
+if __name__ == "__main__":
+    main()