mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-18 21:49:40 +03:00
mukul975
8cae0648ec
Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):
- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
invocation, guardrails, model/data poisoning, system-prompt leakage,
embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration
Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.
67 lines
2.7 KiB
Markdown
67 lines
2.7 KiB
Markdown
# Command Reference — ESP Bootkit Hunting
|
|
|
|
## ESP discovery and mounting
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `lsblk -o NAME,FSTYPE,PARTTYPENAME,MOUNTPOINT` | List partitions with type names to find the ESP |
|
|
| `fdisk -l \| grep -i "EFI System"` | Identify the ESP partition device |
|
|
| `mount -o ro,umask=077 /dev/sdXN /mnt/esp` | Mount the ESP read-only (evidence-safe) |
|
|
| `umount /mnt/esp` | Unmount after analysis |
|
|
|
|
## sbverify (sbsigntool) — Secure Boot signatures
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `sbverify --list <binary.efi>` | List all embedded signatures on an EFI binary |
|
|
| `sbverify --cert <ca.pem> <binary.efi>` | Verify a binary against a known-good signing certificate |
|
|
| `sbverify --detached <sig> <binary.efi>` | Verify a detached signature |
|
|
|
|
## pesign — PE/COFF signature inspection
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `pesign -S -i <binary.efi>` | Show signatures / certificate chain on a PE binary |
|
|
| `pesign -h -i <binary.efi>` | Print the PE authenticode hash |
|
|
|
|
## efitools / efibootmgr / mokutil — Secure Boot state
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `efi-readvar -v db -o db.esl` | Dump the Secure Boot allow-list (db) |
|
|
| `efi-readvar -v dbx -o dbx.esl` | Dump the Secure Boot revocation list (dbx) |
|
|
| `efibootmgr -v` | List boot entries and boot order with loader paths |
|
|
| `mokutil --sb-state` | Report whether Secure Boot is enabled |
|
|
| `mokutil --list-enrolled` | List enrolled Machine Owner Keys |
|
|
|
|
## YARA — bootkit scanning
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `yara -r -w <rules.yar> /mnt/esp/` | Recursively scan the ESP, suppress warnings |
|
|
| `yara -r -s <rules.yar> /mnt/esp/EFI/` | Scan with matched-string output |
|
|
|
|
## tpm2-tools — measured boot
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `tpm2_pcrread sha256:0,2,4,7` | Read firmware/boot-loader/Secure-Boot PCRs |
|
|
| `tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements` | Parse the TCG measured-boot event log |
|
|
|
|
## Hashing and baseline diff
|
|
|
|
| Command | Purpose |
|
|
|---------|---------|
|
|
| `find /mnt/esp -type f \( -iname '*.efi' -o -iname '*.sys' \) -print0 \| xargs -0 sha256sum` | Inventory and hash all boot binaries |
|
|
| `comm -23 live.sha256 base.sha256` | Show hashes present live but absent from baseline |
|
|
| `dd if=/dev/sdXN of=esp.img bs=4M conv=noerror,sync` | Forensically image the ESP |
|
|
|
|
## Velociraptor artifacts (fleet hunting)
|
|
|
|
| Artifact | Purpose |
|
|
|----------|---------|
|
|
| `Windows.Forensics.UEFI` | Parse the ESP partition table and FAT to enumerate files |
|
|
| `Windows.Detection.Yara.UEFI` | YARA-scan ESP contents at scale |
|
|
| `Generic.System.EfiSignatures` | Collect EFI signature data |
|
|
| `Windows.Forensics.UEFI.BootApplication` | Parse Measured Boot TCG logs |
|