performing-power-grid-cybersecurity-assessment

Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.

Aller à l'installation

Dépôt: mukul975/Anthropic-Cybersecurity-Skills
Dernière activité de la source: 2 août 2026 à 16:32
Langue détectée de SKILL.md: anglais
Étoiles: 27 732
Forks: 3 366

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill performing-power-grid-cybersecurity-assessment

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

4 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

Tout voir dans ce dépôt

Performing Power Grid Cybersecurity Assessment

When to Use

When conducting periodic cybersecurity assessments of power grid facilities per NERC CIP requirements

When assessing substation automation systems using IEC 61850 GOOSE and MMS protocols

When evaluating the security of an Energy Management System (EMS) or SCADA control center

When assessing synchrophasor (PMU) networks and wide-area monitoring systems

When preparing for regional entity compliance audits or internal security reviews

Do not use for non-BES systems below NERC registration thresholds, for general OT assessment without power grid specifics (see performing-ot-network-security-assessment), or for physical security assessment of generation facilities without cyber scope.

Prerequisites

Understanding of electric power grid architecture (generation, transmission, distribution)

Familiarity with NERC CIP standards and BES Cyber System categorization

Knowledge of power grid protocols (IEC 61850, IEC 60870-5-104, DNP3, ICCP/TASE.2)

Passive monitoring tools for substation network traffic analysis

Access to EMS/SCADA architecture documentation and network diagrams

Workflow

Step 1: Map Power Grid Cyber Architecture

Identify and document all cyber systems supporting grid operations including EMS, SCADA, substation automation, and communication infrastructure.

# Power Grid Cyber Architecture Assessment facility_type: "Regional Transmission Organization Control Center" ems_systems: primary_ems: vendor: "GE Grid Solutions" product: "EMS/SCADA (formerly XA/21)" functions: - "State estimation" - "Automatic generation control (AGC)" - "Security-constrained economic dispatch" - "Contingency analysis" protocols: - "ICCP/TASE.2 (inter-control center)" - "DNP3 (substation RTU polling)" - "IEC 60870-5-104 (substation polling)" backup_control_center: location: "Geographically diverse backup site" sync_method: "Real-time database mirroring" switchover_time: "< 5 minutes" substation_automation: count: 145 system_types: - vendor: "ABB" product: "RTU560" protocol: "DNP3 over TCP/IP" count: 85 - vendor: "SEL" product: "SEL-3530 RTAC" protocol: "IEC 61850 MMS + GOOSE" count: 40 - vendor: "Siemens" product: "SICAM A8000" protocol: "IEC 60870-5-104" count: 20 communications: primary: "MPLS WAN (carrier-provided)" backup: "Licensed microwave radio" last_mile: "Fiber optic to substation" synchrophasor_network: pmu_count: 75 pdc: "GE PDC (Phasor Data Concentrator)" communication: "IEEE C37.118.2 over dedicated network" data_rate: "30-60 samples per second"

Step 2: Assess Substation Automation Security

Evaluate IEC 61850-based substation automation for protocol security, access controls, and network segmentation.

#!/usr/bin/env python3 """Power Grid Substation Security Assessor. Evaluates security of IEC 61850-based substation automation systems including GOOSE messaging, MMS client/server, and network architecture. """ import json import sys from dataclasses import dataclass, field, asdict from datetime import datetime @dataclass class SubstationFinding: finding_id: str severity: str category: str title: str description: str affected_systems: list nerc_cip_ref: str iec_62351_ref: str remediation: str class SubstationAssessment: """Assesses cybersecurity of substation automation systems.""" def __init__(self, substation_name): self.name = substation_name self.findings = [] self.counter = 1 def assess_iec61850_security(self, config): """Assess IEC 61850 protocol security.""" # GOOSE message authentication if not config.get("goose_authentication"): self.findings.append(SubstationFinding( finding_id=f"SUB-{self.counter:03d}", severity="critical", category=, title=, description=( ), affected_systems=config.get(, []), nerc_cip_ref=, iec_62351_ref=, remediation=( ), )) .counter += config.get(): .findings.append(SubstationFinding( finding_id=, severity=, category=, title=, description=( ), affected_systems=config.get(, []), nerc_cip_ref=, iec_62351_ref=, remediation=, )) .counter += config.get(): .findings.append(SubstationFinding( finding_id=, severity=, category=, title=, description=( ), affected_systems=[], nerc_cip_ref=, iec_62351_ref=, remediation=( ), )) .counter += (): config.get(): .findings.append(SubstationFinding( finding_id=, severity=, category=, title=, description=( ), affected_systems=[], nerc_cip_ref=, iec_62351_ref=, remediation=( ), )) .counter += (): report = [] report.append( * ) report.append() report.append() report.append( * ) sev [, , , ]: findings = [f f .findings f.severity == sev] findings: report.append() f findings: report.append() report.append() report.append() report.append() .join(report) __name__ == : assessment = SubstationAssessment() assessment.assess_iec61850_security({ : , : , : , : [, , ], : [, ], }) assessment.assess_remote_access({ : , }) (assessment.generate_report())

Key Concepts

Term

Definition

IEC 61850

International standard for communication networks and systems in substations, using GOOSE for protection signaling and MMS for SCADA data

GOOSE

Generic Object Oriented Substation Event - multicast protocol for fast peer-to-peer protection signaling between IEDs (< 4ms trip time)

MMS

Manufacturing Message Specification - client/server protocol for reading/writing IED data and operating circuit breakers

IEC 62351

Security standard series for power system communication protocols providing authentication and encryption for IEC 61850, DNP3, and IEC 104

ICCP/TASE.2

Inter-Control Center Communications Protocol for data exchange between control centers of different utilities

Synchrophasor (PMU)

Phasor Measurement Unit providing time-synchronized voltage/current measurements at 30-60 samples/second for wide-area monitoring

Tools & Systems

Dragos Platform: OT security platform with specific threat intelligence on power grid-targeting groups (ELECTRUM, KAMACITE)

SEL-3620 Ethernet Security Gateway: Substation security device providing encryption, access control, and intrusion detection

GRIDsure: Power grid cybersecurity assessment framework by Idaho National Laboratory

Wireshark with IEC 61850 Dissector: Protocol analysis for GOOSE and MMS traffic in substations

Output Format

Power Grid Cybersecurity Assessment Report ============================================= Facility: [Name and Type] NERC Registration: [Entity ID] BES Impact Rating: [High/Medium/Low] SUBSTATION FINDINGS: [N] EMS/SCADA FINDINGS: [N] COMMUNICATION FINDINGS: [N] NERC CIP COMPLIANCE: CIP-002: [Status] CIP-005: [Status] CIP-007: [Status]

name	performing-power-grid-cybersecurity-assessment
description	Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","scada","industrial-control","iec62443","nerc-cip","power-grid","substation"]
version	1.0.0
author	mahipal

performing-power-grid-cybersecurity-assessment

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt