mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-06-26 19:54:37 +03:00

Files

T

mukul975 8cae0648ec Add 55 new skills across 3 new domains + 6 undercovered areas (762 -> 817)

Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):

- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
  prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
  invocation, guardrails, model/data poisoning, system-prompt leakage,
  embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
  malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
  Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
  shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
  Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration

Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.

2026-06-22 19:08:16 +02:00

2.4 KiB

Raw Blame History

Stratus Red Team — Command Reference

Lifecycle Commands

Command	Description
`stratus list`	List all available attack techniques
`stratus list --platform aws`	Filter techniques by platform (`aws`, `azure`, `gcp`, `kubernetes`, `eks`)
`stratus list --mitre-attack-tactic credential-access`	Filter techniques by MITRE ATT&CK tactic
`stratus show <technique-id>`	Print a technique's full description and detonation details
`stratus warmup <technique-id>`	Provision prerequisite infrastructure (Terraform) without attacking
`stratus detonate <technique-id>`	Execute the attack actions (implicit warmup if needed)
`stratus detonate <id> --force`	Force a fresh warmup before detonating
`stratus status`	Show the lifecycle state (COLD/WARM/DETONATED) of all techniques
`stratus revert <technique-id>`	Undo detonation side effects, keeping prerequisites
`stratus cleanup <technique-id>`	Remove a technique's prerequisite infrastructure
`stratus cleanup --all`	Remove all infrastructure Stratus ever provisioned
`stratus version`	Print the Stratus Red Team version

State and Configuration

Item	Value
State directory	`~/.stratus-red-team/` (Terraform binary, provider plugins, per-technique state)
AWS credentials	Standard AWS SDK chain (`AWS_PROFILE`, `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`/`AWS_SESSION_TOKEN`)
Azure credentials	`az login` / Azure SDK environment chain
GCP credentials	Application Default Credentials (`gcloud auth application-default login`)
Kubernetes	Active `kubectl` context / kubeconfig

Example Technique IDs

Technique ID	Tactic
`aws.credential-access.ec2-steal-instance-credentials`	Credential Access
`aws.persistence.iam-create-admin-user`	Persistence
`aws.exfiltration.ec2-share-ebs-snapshot`	Exfiltration
`aws.discovery.ec2-enumerate-from-instance`	Discovery
`gcp.persistence.create-admin-service-account`	Persistence
`azure.execution.vm-custom-script-extension`	Execution
`k8s.persistence.create-admin-clusterrole`	Persistence

Programmatic Use (Go SDK)

Stratus also exposes a Go package github.com/datadog/stratus-red-team/v2/pkg/stratus/runner that can be embedded in tooling to warm up, detonate, revert, and clean up techniques programmatically.

2.4 KiB Raw Blame History