mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-11 18:13:43 +03:00

Files

T

mukul975 27c6414ca5 Add folder anatomy (scripts/agent.py + references/api-reference.md) for 648 cybersecurity skills

Complete skill folder anatomy across all cybersecurity skills:
- scripts/agent.py: 80-150 line Python agents using real libraries (impacket,
  boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.)
- references/api-reference.md: real API documentation with method signatures
- LICENSE: MIT license for all skill folders

2026-03-10 21:02:12 +01:00

1.8 KiB

Raw Blame History

API Reference — Hunting for LOLBins Execution in Endpoint Logs

Libraries Used

csv: Parse exported endpoint log CSV files from SIEM or EDR
python-evtx (Evtx): Parse Windows Sysmon EVTX event logs directly
re: Regex matching for suspicious command-line patterns

CLI Interface

python agent.py csv --file <csv_path> [--process-col Image] [--cmdline-col CommandLine]
python agent.py evtx --file <evtx_path>

Core Functions

`scan_csv_logs(csv_file, process_col, cmdline_col)`

Scans CSV-exported endpoint logs for LOLBin process executions with suspicious arguments.

Parameters:

Name	Type	Description
`csv_file`	str	Path to CSV log file
`process_col`	str	Column name for process image path (default: `Image`)
`cmdline_col`	str	Column name for command line (default: `CommandLine`)

Returns: dict with total_findings, by_binary counts, by_mitre counts, findings list.

`scan_evtx_sysmon(evtx_file)`

Parses Sysmon EVTX logs for Event ID 1 (Process Creation) matching LOLBin signatures.

Parameters:

Name	Type	Description
`evtx_file`	str	Path to Sysmon .evtx file

Returns: dict with total_findings and findings with record IDs, binary names, MITRE IDs.

LOLBins Detected (14 binaries)

certutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, bitsadmin.exe, wmic.exe, msiexec.exe, cmstp.exe, forfiles.exe, pcalua.exe, csc.exe, installutil.exe, msbuild.exe, powershell.exe

Output Format

{
  "total_findings": 12,
  "by_binary": {"powershell.exe": 5, "certutil.exe": 4},
  "by_mitre": {"T1059.001": 5, "T1140": 4},
  "findings": [{"binary": "...", "mitre": "...", "command_line": "..."}]
}

Dependencies

pip install python-evtx

1.8 KiB Raw Blame History