mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-22 12:40:59 +03:00
mukul975
8cae0648ec
Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):
- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
invocation, guardrails, model/data poisoning, system-prompt leakage,
embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration
Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.
64 lines
2.1 KiB
Markdown
64 lines
2.1 KiB
Markdown
# Hayabusa — Command & Flag Reference
|
|
|
|
## Subcommands
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `csv-timeline` | Build a CSV forensic timeline |
|
|
| `json-timeline` | Build a JSON/JSONL timeline |
|
|
| `update-rules` | Sync the latest Sigma/Hayabusa rules |
|
|
| `search` | Keyword/regex search across event logs |
|
|
| `level-tuning` | Customize alert severity per rule |
|
|
| `computer-metrics` | Event counts per computer |
|
|
| `eid-metrics` | Event counts/percentages per Event ID |
|
|
| `log-metrics` | File metadata (timestamps, channels, providers) |
|
|
| `pivot-keywords-list` | Extract suspicious keywords for correlation |
|
|
|
|
## Common Timeline Flags
|
|
|
|
| Flag | Description |
|
|
|------|-------------|
|
|
| `-d, --directory <DIR>` | Directory of `.evtx` files |
|
|
| `-f, --file <FILE>` | Single `.evtx` file |
|
|
| `-l, --live-analysis` | Analyze local Windows event logs (admin) |
|
|
| `-o, --output <FILE>` | Output path |
|
|
| `-p, --profile <PROFILE>` | Output profile (see below) |
|
|
| `-m, --min-level <LEVEL>` | Minimum alert level |
|
|
| `-w, --no-wizard` | Skip interactive wizard (scripting) |
|
|
| `-U, --UTC` | Output timestamps in UTC |
|
|
| `-L` (json-timeline) | JSONL (one object per line) |
|
|
|
|
## Output Profiles
|
|
|
|
`minimal`, `standard` (default), `verbose`, `all-field-info`,
|
|
`all-field-info-verbose`, `super-verbose`, `timesketch-minimal`, `timesketch-verbose`
|
|
|
|
## Alert Levels
|
|
|
|
`informational`, `low`, `medium`, `high`, `critical`
|
|
|
|
## search Flags
|
|
|
|
| Flag | Description |
|
|
|------|-------------|
|
|
| `-k, --keyword <KW>` | Keyword to match |
|
|
| `-r, --regex <RE>` | Regex to match |
|
|
| `-i, --ignore-case` | Case-insensitive |
|
|
| `-d, --directory <DIR>` | Logs directory |
|
|
|
|
## Examples
|
|
|
|
```bash
|
|
hayabusa update-rules
|
|
hayabusa csv-timeline -d ./evtx -o tl.csv -p verbose -m high -U -w
|
|
hayabusa json-timeline -d ./evtx -L -o tl.jsonl -w
|
|
hayabusa search -d ./evtx -k "mimikatz" -i
|
|
hayabusa eid-metrics -d ./evtx -o eid.csv
|
|
hayabusa pivot-keywords-list -d ./evtx -m medium -o pivots
|
|
```
|
|
|
|
## External References
|
|
|
|
- Hayabusa Wiki: https://github.com/Yamato-Security/hayabusa/wiki
|
|
- Releases: https://github.com/Yamato-Security/hayabusa/releases
|