mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-21 20:20:59 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
1.8 KiB
1.8 KiB
Ransomware Incident Response - API Reference
File System Scanning
Ransomware Extensions
Common encrypted file extensions: .encrypted, .locked, .crypt, .locky, .cerber, .zepto, .wncry, .wnry, .wcry, .onion, .micro, .r5a
Ransom Note Filenames
Common patterns: readme.txt, how_to_decrypt.txt, decrypt_instructions.html, restore_files.txt, _readme.txt, how_to_recover.txt
IOC Collection
hashlib (Python stdlib)
sha = hashlib.sha256()
with open(path, "rb") as f:
for chunk in iter(lambda: f.read(8192), b""):
sha.update(chunk)
sha.hexdigest()
ID Ransomware Identification
Upload ransom note or encrypted file sample to id-ransomware.malwarehunterteam.com for variant identification.
Shadow Copy Detection (Windows)
vssadmin list shadows
Ransomware commonly deletes shadow copies via:
vssadmin delete shadows /all /quiet
wmic shadowcopy delete
Containment Checklist
- Network isolation - Disable NICs or move to quarantine VLAN
- Evidence preservation - Disk image before remediation
- Credential reset - krbtgt (twice), DA accounts, service accounts
- Scope assessment - Enumerate affected hosts and shares
- Variant identification - Submit IOCs to threat intel platforms
- Recovery - Restore from clean backups after root cause confirmed
Output Schema
{
"report": "ransomware_incident_response",
"encrypted_files_found": 342,
"ransom_notes_found": 5,
"shadow_copy_status": {"intact": false, "shadow_copies": 0},
"containment_actions": [{"priority": 1, "action": "Isolate affected hosts"}],
"file_hashes": [{"path": "/data/file.encrypted", "sha256": "abc123..."}]
}
CLI Usage
python agent.py --target /mnt/affected_share --max-files 5000 --output report.json