メニュー
Deploy XM Cyber's continuous exposure management platform to map attack paths, identify choke points, and prioritize the 2% of exposures that threaten critical assets.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/AgentFlocks/flocks --skill implementing-attack-path-analysis-with-xm-cyberコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
深信服 EDR 登录态管理、首页仪表盘、威胁资产分析和资产清点分类统计 API 采集。用户提到深信服 EDR、EDR、资产清点或 sangfor EDR 时必须先加载本 skill。
统一处理浏览器使用任务，支持可见浏览器 CDP 直连、专用 headless CDP、agent-browser。Use when the user asks to browse websites, interact with pages, fill forms, capture screenshots, reuse an existing Chrome/Chromium/Edge login session, work with an already-open browser/sidebar browser, access login-only/internal/dynamic pages, or automate browser actions.
用于处理 OneSEC/OneDNS 终端安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSEC、微步 EDR等相关操纵需求时，必须先加载本 skill。本 skill 是 OneSEC 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesec_*` tool。
SOC 職業分類に基づく
SKILL.md を表示中
| name | implementing-attack-path-analysis-with-xm-cyber |
| description | Deploy XM Cyber's continuous exposure management platform to map attack paths, identify choke points, and prioritize the 2% of exposures that threaten critical assets. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["xm-cyber","attack-path-analysis","exposure-management","ctem","choke-points","breach-simulation","attack-surface"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
XM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on "choke points" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.
Unlike point-in-time vulnerability scanning, XM Cyber continuously models all possible attack paths across the entire environment:
| Traditional Scanning | XM Cyber Attack Path Analysis |
|---|---|
| Lists individual vulnerabilities | Maps chained attack paths |
| Scores by CVSS severity | Scores by reachability to critical assets |
| Point-in-time assessment | Continuous real-time modeling |
| No context of lateral movement | Models full lateral movement chains |
| Treats each vuln independently | Shows how vulns chain together |
| Finding | Statistic |
|---|---|
| Average exposures per organization | ~15,000 |
| CVE-based exposures | < 1% of total |
| Misconfiguration-based exposures | ~80% of total |
| Exposures on critical choke points | 2% |
| Orgs where attackers can pivot on-prem to cloud | 70% |
| Cloud critical assets compromisable in 2 hops | 93% |
| Critical asset exposures in cloud platforms | 56% |
A choke point is a single entity (host, identity, credential, misconfiguration) that sits at the intersection of multiple attack paths leading to critical assets. Fixing a choke point eliminates many attack paths simultaneously, providing maximum risk reduction per remediation effort.
Attack Path 1: Web Server -> SQL Injection -> DB Admin Creds
\
Attack Path 2: VPN -> Stolen Creds -> File Server -> Domain Controller
/ (Critical Asset)
Attack Path 3: Workstation -> Mimikatz -> Cached Creds
^
CHOKE POINT
(Cached Domain Admin credential)
| Category | % of Exposures | Examples |
|---|---|---|
| Identity & Credentials | 40% | Cached credentials, over-privileged accounts, Kerberoastable SPNs |
| Misconfigurations | 38% | Open shares, weak permissions, missing hardening |
| Network Exposures | 12% | Open ports, flat networks, missing segmentation |
| Software Vulnerabilities | 8% | Unpatched CVEs, outdated software |
| Cloud Exposures | 2% | IAM misconfig, public storage, overly permissive roles |
Critical Asset Definition:
Tier 1 - Crown Jewels:
- Domain Controllers (Active Directory)
- Database servers with PII/financial data
- ERP systems (SAP, Oracle)
- Certificate Authority servers
- Backup infrastructure (Veeam, Commvault)
Tier 2 - High Value:
- Email servers (Exchange)
- File servers with IP/trade secrets
- CI/CD pipeline servers
- Jump servers / PAM vaults
Tier 3 - Supporting Infrastructure:
- DNS/DHCP servers
- Monitoring systems
- Logging infrastructure
Deployment Architecture:
On-Premises:
- Install XM Cyber sensor on management server
- Configure AD integration (read-only service account)
- Enable network discovery protocols
- Set scanning scope (IP ranges, AD OUs)
Cloud (AWS):
- Deploy XM Cyber CloudConnect via CloudFormation
- Configure IAM role with read-only permissions
- Enable cross-account scanning for multi-account orgs
Cloud (Azure):
- Deploy via Azure Marketplace
- Configure Entra ID (Azure AD) integration
- Grant Reader role on subscriptions
Hybrid:
- Configure cross-environment path analysis
- Map on-premises to cloud trust relationships
- Enable identity correlation across environments
Scenario 1: External Attacker to Domain Admin
Starting Point: Internet-facing assets
Target: Domain Admin privileges
Attack Techniques: Exploit public CVEs, credential theft,
lateral movement, privilege escalation
Scenario 2: Insider Threat to Financial Data
Starting Point: Any corporate workstation
Target: Financial database servers
Attack Techniques: Credential harvesting, share enumeration,
privilege escalation, data access
Scenario 3: Cloud Account Takeover
Starting Point: Compromised cloud IAM user
Target: Production cloud infrastructure
Attack Techniques: IAM privilege escalation, cross-account
pivot, storage access, compute compromise
Scenario 4: Ransomware Propagation
Starting Point: Phished workstation
Target: Maximum host compromise (lateral spread)
Attack Techniques: Credential reuse, SMB exploitation,
PsExec/WMI lateral movement
# Interpreting XM Cyber attack path analysis results
def analyze_choke_points(attack_graph_results):
"""Analyze attack graph results for priority remediation."""
choke_points = []
for entity in attack_graph_results.get("entities", []):
if entity.get("is_choke_point"):
choke_points.append({
"entity_name": entity["name"],
"entity_type": entity["type"],
"attack_paths_blocked": entity["paths_through"],
"critical_assets_protected": entity["protects_assets"],
"remediation_complexity": entity["fix_complexity"],
"exposure_type": entity["exposure_category"],
})
# Sort by impact (paths blocked * assets protected)
choke_points.sort(
key=lambda x: x["attack_paths_blocked"] * len(x["critical_assets_protected"]),
reverse=True
)
print(f"Total choke points identified: {len(choke_points)}")
print(f"\nTop 10 choke points for maximum risk reduction:")
for i, cp in enumerate(choke_points[:10], 1):
print(f" {i}. {cp['entity_name']} ({cp['entity_type']})")
print(f" Paths blocked: {cp['attack_paths_blocked']}")
print(f" Assets protected: {len(cp['critical_assets_protected'])}")
print(f" Exposure type: {cp['exposure_type']}")
print(f" Fix complexity: {cp['remediation_complexity']}")
return choke_points
Remediation Priority Matrix:
Priority 1 (Immediate - 48h):
- Choke points on paths to Tier 1 assets
- Identity exposures (cached Domain Admin creds)
- Internet-facing vulnerabilities with attack paths
Priority 2 (Urgent - 7 days):
- Choke points on paths to Tier 2 assets
- Cloud IAM misconfigurations with privilege escalation
- Network segmentation gaps enabling lateral movement
Priority 3 (Important - 30 days):
- Remaining choke points
- Misconfigurations reducing defense depth
- Non-critical software vulnerabilities on attack paths
Priority 4 (Standard - 90 days):
- Exposures NOT on any attack path to critical assets
- Informational findings
- Hardening recommendations