mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-15 07:24:56 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
54 lines
1.5 KiB
Markdown
54 lines
1.5 KiB
Markdown
# API Reference: Adversary Infrastructure Tracking
|
|
|
|
## crt.sh (Certificate Transparency)
|
|
```
|
|
GET https://crt.sh/?q=%.example.com&output=json
|
|
```
|
|
| Field | Description |
|
|
|-------|-------------|
|
|
| `issuer_name` | Certificate issuer |
|
|
| `name_value` | SANs / common names |
|
|
| `serial_number` | Certificate serial |
|
|
| `not_before` / `not_after` | Validity period |
|
|
|
|
## URLhaus API
|
|
```
|
|
POST https://urlhaus-api.abuse.ch/v1/host/
|
|
Body: host=example.com
|
|
```
|
|
Returns malicious URLs hosted on the domain.
|
|
|
|
## ThreatFox API
|
|
```
|
|
POST https://threatfox-api.abuse.ch/api/v1/
|
|
Body: {"query": "search_ioc", "search_term": "1.2.3.4"}
|
|
```
|
|
| Field | Description |
|
|
|-------|-------------|
|
|
| `ioc` | IOC value |
|
|
| `threat_type` | botnet_cc, payload_delivery, etc. |
|
|
| `malware` | Associated malware family |
|
|
| `tags` | IOC tags |
|
|
|
|
## Pivoting Techniques
|
|
| Pivot | Method |
|
|
|-------|--------|
|
|
| Certificate SANs | crt.sh wildcard search |
|
|
| Shared IP | PassiveTotal, VirusTotal |
|
|
| WHOIS registrant | WHOIS history |
|
|
| DNS history | PassiveDNS (Farsight, CIRCL) |
|
|
| JARM fingerprint | TLS server fingerprinting |
|
|
| HTTP response hash | Favicon hash, body hash |
|
|
|
|
## Infrastructure Relationships
|
|
| Edge Type | Description |
|
|
|-----------|-------------|
|
|
| shared_certificate | Same TLS cert on different hosts |
|
|
| shared_ip | Multiple domains on same IP |
|
|
| shared_registrant | Same WHOIS registrant |
|
|
| shared_nameserver | Same NS records |
|
|
|
|
## MITRE ATT&CK
|
|
- T1583 - Acquire Infrastructure
|
|
- T1584 - Compromise Infrastructure
|