mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-18 13:39:40 +03:00
mukul975
8cae0648ec
Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):
- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
invocation, guardrails, model/data poisoning, system-prompt leakage,
embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration
Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.
2.7 KiB
2.7 KiB
Command Reference — ESP Bootkit Hunting
ESP discovery and mounting
| Command | Purpose |
|---|---|
lsblk -o NAME,FSTYPE,PARTTYPENAME,MOUNTPOINT |
List partitions with type names to find the ESP |
fdisk -l | grep -i "EFI System" |
Identify the ESP partition device |
mount -o ro,umask=077 /dev/sdXN /mnt/esp |
Mount the ESP read-only (evidence-safe) |
umount /mnt/esp |
Unmount after analysis |
sbverify (sbsigntool) — Secure Boot signatures
| Command | Purpose |
|---|---|
sbverify --list <binary.efi> |
List all embedded signatures on an EFI binary |
sbverify --cert <ca.pem> <binary.efi> |
Verify a binary against a known-good signing certificate |
sbverify --detached <sig> <binary.efi> |
Verify a detached signature |
pesign — PE/COFF signature inspection
| Command | Purpose |
|---|---|
pesign -S -i <binary.efi> |
Show signatures / certificate chain on a PE binary |
pesign -h -i <binary.efi> |
Print the PE authenticode hash |
efitools / efibootmgr / mokutil — Secure Boot state
| Command | Purpose |
|---|---|
efi-readvar -v db -o db.esl |
Dump the Secure Boot allow-list (db) |
efi-readvar -v dbx -o dbx.esl |
Dump the Secure Boot revocation list (dbx) |
efibootmgr -v |
List boot entries and boot order with loader paths |
mokutil --sb-state |
Report whether Secure Boot is enabled |
mokutil --list-enrolled |
List enrolled Machine Owner Keys |
YARA — bootkit scanning
| Command | Purpose |
|---|---|
yara -r -w <rules.yar> /mnt/esp/ |
Recursively scan the ESP, suppress warnings |
yara -r -s <rules.yar> /mnt/esp/EFI/ |
Scan with matched-string output |
tpm2-tools — measured boot
| Command | Purpose |
|---|---|
tpm2_pcrread sha256:0,2,4,7 |
Read firmware/boot-loader/Secure-Boot PCRs |
tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements |
Parse the TCG measured-boot event log |
Hashing and baseline diff
| Command | Purpose |
|---|---|
find /mnt/esp -type f \( -iname '*.efi' -o -iname '*.sys' \) -print0 | xargs -0 sha256sum |
Inventory and hash all boot binaries |
comm -23 live.sha256 base.sha256 |
Show hashes present live but absent from baseline |
dd if=/dev/sdXN of=esp.img bs=4M conv=noerror,sync |
Forensically image the ESP |
Velociraptor artifacts (fleet hunting)
| Artifact | Purpose |
|---|---|
Windows.Forensics.UEFI |
Parse the ESP partition table and FAT to enumerate files |
Windows.Detection.Yara.UEFI |
YARA-scan ESP contents at scale |
Generic.System.EfiSignatures |
Collect EFI signature data |
Windows.Forensics.UEFI.BootApplication |
Parse Measured Boot TCG logs |