creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-20 06:20:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: add NIST CSF 2.0 nist_csf field to all 754 cybersecurity skills

Browse Source 
Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions)
based on subdomain and content analysis. Restores 11 skills corrupted during
prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields.

All 754 skills now carry structured mappings for all 5 security frameworks:
- MITRE ATT&CK (in tags)
- MITRE ATLAS v5.5 (atlas_techniques)
- MITRE D3FEND v1.3 (d3fend_techniques)
- NIST AI RMF 1.0 (nist_ai_rmf)
- NIST CSF 2.0 (nist_csf)
This commit is contained in:
mukul975
2026-04-06 11:17:40 +02:00
parent e8105a2f4d
commit efca3ec611
754 changed files with 12847 additions and 2832 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/detecting-command-and-control-over-dns/SKILL.md
+19 -10
View File
@@ -1,20 +1,29 @@
---
name: detecting-command-and-control-over-dns
description: >
Detects command-and-control (C2) communications tunneled through DNS protocol
including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon),
domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records,
and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains,
statistical anomaly detection, ML-based DGA classification, passive DNS correlation,
and Zeek/Suricata signature development. Activates for requests involving DNS-based
C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or
DGA domain classification.
description: 'Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools
(Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME
records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection,
ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving
DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.
'
domain: cybersecurity
subdomain: network-security
tags: [dns, c2, tunneling, dga, network-forensics, threat-detection]
tags:
- dns
- c2
- tunneling
- dga
- network-forensics
- threat-detection
version: 1.0.0
author: mukul975
license: Apache-2.0
nist_csf:
- PR.IR-01
- DE.CM-01
- ID.AM-03
- PR.DS-02
---
# Detecting Command and Control Over DNS