mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-03 06:50:51 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
55 lines
1.6 KiB
Markdown
55 lines
1.6 KiB
Markdown
# API Reference: Hunting Living Off The Land Binaries
|
|
|
|
## LOLBAS Project API
|
|
|
|
```python
|
|
import requests
|
|
resp = requests.get("https://lolbas-project.github.io/api/lolbas.json")
|
|
lolbas = resp.json()
|
|
# Each entry: {"Name": "Certutil.exe", "Commands": [...], "Paths": [...]}
|
|
for entry in lolbas:
|
|
for cmd in entry.get("Commands", []):
|
|
print(cmd["Command"], cmd["Category"])
|
|
# Categories: Download, Execute, Compile, Encode, ...
|
|
```
|
|
|
|
## python-evtx (Event Log Parsing)
|
|
|
|
```python
|
|
import Evtx.Evtx as evtx
|
|
from xml.etree import ElementTree as ET
|
|
|
|
with evtx.Evtx("Security.evtx") as log:
|
|
for record in log.records():
|
|
root = ET.fromstring(record.xml())
|
|
# Event ID 4688 = process creation
|
|
# Sysmon Event ID 1 = process create
|
|
```
|
|
|
|
## Key LOLBAS Detection Patterns
|
|
|
|
| Binary | Suspicious Pattern | ATT&CK |
|
|
|--------|--------------------|--------|
|
|
| certutil.exe | `-urlcache -split -f` | T1105 |
|
|
| mshta.exe | `vbscript:Execute` | T1218.005 |
|
|
| regsvr32.exe | `/s /n /u /i:http` | T1218.010 |
|
|
| rundll32.exe | `javascript:` | T1218.011 |
|
|
| wmic.exe | `process call create` | T1047 |
|
|
| bitsadmin.exe | `/transfer` | T1197 |
|
|
| cmstp.exe | `/s .inf` | T1218.003 |
|
|
|
|
## Windows Event IDs
|
|
|
|
| ID | Source | Description |
|
|
|----|--------|-------------|
|
|
| 4688 | Security | Process Creation |
|
|
| 1 | Sysmon | Process Create (with command line) |
|
|
| 7 | Sysmon | Image Loaded |
|
|
| 11 | Sysmon | FileCreate |
|
|
|
|
### References
|
|
|
|
- LOLBAS Project: https://lolbas-project.github.io/
|
|
- python-evtx: https://github.com/williballenthin/python-evtx
|
|
- LOLBAS API: https://lolbas-project.github.io/api/lolbas.json
|