mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-21 20:20:59 +03:00

Files

T

mukul975 8cae0648ec Add 55 new skills across 3 new domains + 6 undercovered areas (762 -> 817)

Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):

- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
  prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
  invocation, guardrails, model/data poisoning, system-prompt leakage,
  embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
  malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
  Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
  shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
  Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration

Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.

2026-06-22 19:08:16 +02:00

2.1 KiB

Raw Blame History

Hayabusa — Command & Flag Reference

Subcommands

Command	Purpose
`csv-timeline`	Build a CSV forensic timeline
`json-timeline`	Build a JSON/JSONL timeline
`update-rules`	Sync the latest Sigma/Hayabusa rules
`search`	Keyword/regex search across event logs
`level-tuning`	Customize alert severity per rule
`computer-metrics`	Event counts per computer
`eid-metrics`	Event counts/percentages per Event ID
`log-metrics`	File metadata (timestamps, channels, providers)
`pivot-keywords-list`	Extract suspicious keywords for correlation

Common Timeline Flags

Flag	Description
`-d, --directory <DIR>`	Directory of `.evtx` files
`-f, --file <FILE>`	Single `.evtx` file
`-l, --live-analysis`	Analyze local Windows event logs (admin)
`-o, --output <FILE>`	Output path
`-p, --profile <PROFILE>`	Output profile (see below)
`-m, --min-level <LEVEL>`	Minimum alert level
`-w, --no-wizard`	Skip interactive wizard (scripting)
`-U, --UTC`	Output timestamps in UTC
`-L` (json-timeline)	JSONL (one object per line)

Output Profiles

minimal, standard (default), verbose, all-field-info, all-field-info-verbose, super-verbose, timesketch-minimal, timesketch-verbose

Alert Levels

informational, low, medium, high, critical

search Flags

Flag	Description
`-k, --keyword <KW>`	Keyword to match
`-r, --regex <RE>`	Regex to match
`-i, --ignore-case`	Case-insensitive
`-d, --directory <DIR>`	Logs directory

Examples

hayabusa update-rules
hayabusa csv-timeline -d ./evtx -o tl.csv -p verbose -m high -U -w
hayabusa json-timeline -d ./evtx -L -o tl.jsonl -w
hayabusa search -d ./evtx -k "mimikatz" -i
hayabusa eid-metrics -d ./evtx -o eid.csv
hayabusa pivot-keywords-list -d ./evtx -m medium -o pivots

External References

Hayabusa Wiki: https://github.com/Yamato-Security/hayabusa/wiki
Releases: https://github.com/Yamato-Security/hayabusa/releases

2.1 KiB Raw Blame History