cyber-eradicating-malware-from-infected-systems

Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.

Ir a la instalación

Repositorio: nexuslinkproductions/yuri-os
Última actividad en el origen: 2 de agosto de 2026 a las 20:10
Idioma detectado de SKILL.md: inglés
Estrellas: 2
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/nexuslinkproductions/yuri-os --skill cyber-eradicating-malware-from-infected-systems

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

cyber-abusing-dpapi-for-credential-access

[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Extract DPAPI-protected secrets such as credentials and browser data offline and online.

2026-08-02

cyber-abusing-shadow-credentials-for-privesc

[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

2026-08-02

cyber-achieving-cmmc-level-2-compliance

>- Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD

2026-08-02

Ver todos los de este repositorio

Eradicating Malware from Infected Systems

When to Use

Malware infection confirmed and containment is in place

Forensic investigation has identified all persistence mechanisms

All compromised systems have been identified and scoped

Ready to remove attacker artifacts and restore clean state

Post-containment phase requires systematic cleanup

Prerequisites

Completed forensic analysis identifying all malware artifacts

List of all compromised systems and accounts

EDR/AV with updated signatures deployed

YARA rules for the specific malware family

Clean system images or verified backups for restoration

Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

# Windows - Check all known persistence locations # Autoruns (Sysinternals) - comprehensive autostart enumeration autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv # Registry Run keys reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s # Scheduled tasks schtasks /query /fo CSV /v > schtasks_all.csv # WMI event subscriptions Get-WMIObject -Namespace root\Subscription -Class __EventFilter Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding # Services Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName # Linux persistence cat /etc/crontab ls -la /etc/cron.*/ ls -la /etc/init.d/ systemctl list-unit-files --type=service | grep enabled /etc/rc.local -la ~/.bashrc ~/.profile ~/.bash_profile

Eradicating Malware from Infected Systems

When to Use

Malware infection confirmed and containment is in place

Forensic investigation has identified all persistence mechanisms

All compromised systems have been identified and scoped

Ready to remove attacker artifacts and restore clean state

Post-containment phase requires systematic cleanup

Prerequisites

Completed forensic analysis identifying all malware artifacts

List of all compromised systems and accounts

EDR/AV with updated signatures deployed

YARA rules for the specific malware family

Clean system images or verified backups for restoration

Network isolation still in effect during eradication

Workflow

Step 1: Map All Persistence Mechanisms

name	cyber-eradicating-malware-from-infected-systems
description	Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: eradicating-malware-from-infected-systems \| description: Systematically remove malware, backdoors, and attacker persistence mechanisms \| from infected systems while ensuring complete eradication and preventing re-infection. \| domain: cybersecurity \| subdomain: incident-response \| tags: \| - incident-response \| - eradication \| - malware-removal \| - persistence \| - dfir \| mitre_attack: \| - T1486 \| - T1490 \| - T1070 \| - T1078 \| - T1547 \| version: '1.0' \| author: mahipal \| license: Apache-2.0
hide	true

name	cyber-eradicating-malware-from-infected-systems
description	Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: eradicating-malware-from-infected-systems \| description: Systematically remove malware, backdoors, and attacker persistence mechanisms \| from infected systems while ensuring complete eradication and preventing re-infection. \| domain: cybersecurity \| subdomain: incident-response \| tags: \| - incident-response \| - eradication \| - malware-removal \| - persistence \| - dfir \| mitre_attack: \| - T1486 \| - T1490 \| - T1070 \| - T1078 \| - T1547 \| version: '1.0' \| author: mahipal \| license: Apache-2.0
hide	true

Concept	Description
Persistence Mechanism	Method attacker uses to maintain access across reboots
Root Cause Remediation	Fixing the vulnerability that enabled initial compromise
Credential Rotation	Resetting all potentially compromised passwords and tokens
KRBTGT Reset	Invalidating Kerberos tickets after golden ticket attack
Indicator Sweep	Scanning all systems for known malicious artifacts
Validation Scan	Confirming eradication was successful before recovery
Re-imaging	Rebuilding systems from clean images rather than cleaning

Tool	Purpose
Sysinternals Autoruns	Enumerate all Windows autostart locations
YARA	Custom rule-based malware scanning
CrowdStrike/SentinelOne	EDR-based scanning and remediation
ClamAV	Open-source antivirus scanning
PowerShell	Scripted cleanup and validation
Velociraptor	Remote artifact collection and remediation

cyber-eradicating-malware-from-infected-systems

Opciones de instalación

Revisa los archivos de origen

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Step 3: Remove Malware Files and Artifacts

Step 4: Reset Compromised Credentials

Step 5: Patch Vulnerability Used for Initial Access

Step 6: Validate Eradication

Key Concepts

Tools & Systems

Common Scenarios

Output Format

cyber-eradicating-malware-from-infected-systems

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Más de este repositorio

Eradicating Malware from Infected Systems

When to Use

Prerequisites

Workflow

Step 1: Map All Persistence Mechanisms

Step 2: Identify All Malware Artifacts

Step 3: Remove Malware Files and Artifacts

Step 4: Reset Compromised Credentials

Step 5: Patch Vulnerability Used for Initial Access

Step 6: Validate Eradication

Key Concepts

Tools & Systems

Common Scenarios

Output Format