mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-18 13:39:40 +03:00

Files

T

mukul975 8cae0648ec Add 55 new skills across 3 new domains + 6 undercovered areas (762 -> 817)

Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):

- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
  prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
  invocation, guardrails, model/data poisoning, system-prompt leakage,
  embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
  malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
  Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
  shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
  Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration

Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.

2026-06-22 19:08:16 +02:00

2.3 KiB

Raw Blame History

EZ Tools Command Reference

All tools are .NET CLI parsers that emit CSV/JSON. Common flags: -f (single file), -d (directory recurse), --csv (output dir), --csvf (output filename), --json (JSON output dir).

MFTECmd

Flag	Purpose
`-f`	Path to `$MFT`, `$J`, `$Boot`, `$SDS`, or `$LogFile`
`--csv` / `--csvf`	CSV output dir / filename
`--json`	JSON output dir
`--de <entry>`	Dump a specific MFT entry

MFTECmd.exe -f "C:\$MFT" --csv "C:\out" --csvf MFT.csv
MFTECmd.exe -f "C:\$Extend\$J" --csv "C:\out" --csvf UsnJrnl.csv

PECmd (Prefetch)

Flag	Purpose
`-f` / `-d`	Single `.pf` / directory
`--csv` / `--csvf` / `--json`	Outputs
`-k <keywords>`	Highlight keywords

PECmd.exe -d "C:\Windows\Prefetch" --csv "C:\out" --csvf Prefetch.csv --json "C:\out\json"

RECmd (Registry)

Flag	Purpose
`-f` / `-d`	Single hive / directory of hives
`--bn <file>`	Batch file (.reb), e.g. `Kroll_Batch.reb`
`--sk <value>`	Search keys/values
`--csv` / `--csvf`	Outputs

RECmd.exe -d "C:\config" --bn "RECmd\BatchExamples\Kroll_Batch.reb" --csv "C:\out"

SBECmd (ShellBags)

SBECmd.exe -d "C:\Users\jsmith" --csv "C:\out"

AmcacheParser

Flag	Purpose
`-f`	Path to `Amcache.hve`
`-i`	Include unassociated file entries
`--csv`	Output dir

AmcacheParser.exe -f "C:\Windows\AppCompat\Programs\Amcache.hve" --csv "C:\out" -i

AppCompatCacheParser (ShimCache)

AppCompatCacheParser.exe -f "C:\Windows\System32\config\SYSTEM" --csv "C:\out"

LECmd / JLECmd (LNK / Jump Lists)

LECmd.exe  -d "C:\Users\jsmith\AppData\Roaming\Microsoft\Windows\Recent" --csv "C:\out"
JLECmd.exe -d "...\Recent\AutomaticDestinations" --csv "C:\out"

EvtxECmd (EVTX)

EvtxECmd.exe -d "C:\Windows\System32\winevt\Logs" --csv "C:\out" --csvf EventLogs.csv

Get-ZimmermanTools (downloader)

.\Get-ZimmermanTools.ps1 -Dest C:\Tools\EZ

Timeline Explorer

GUI CSV viewer: TimelineExplorer.exe. Loads EZ Tools CSVs; supports column filters, conditional formatting, and tagging for cross-artifact correlation on UTC timestamps.

2.3 KiB Raw Blame History