mapping-mitre-attack-techniques

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.

Ir para a instalação

Repositório: mukul975/Anthropic-Cybersecurity-Skills
Última atividade na origem: 1 de junho de 2026 às 10:13
Idioma detectado do SKILL.md: inglês
Estrelas: 27.732
Forks: 3.366

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill mapping-mitre-attack-techniques

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

4 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

Ver todas deste repositório

name	mapping-mitre-attack-techniques
description	Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
domain	cybersecurity
subdomain	threat-intelligence
tags	["MITRE-ATT&CK","ATT&CK-Navigator","Sigma","D3FEND","TTP","detection-engineering","NIST-CSF"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1591","T1592","T1593","T1589","T1685.002"]

Mapping MITRE ATT&CK Techniques

When to Use

Use this skill when:

Generating an ATT&CK coverage heatmap to show which techniques your detection stack addresses
Tagging existing SIEM use cases or Sigma rules with ATT&CK technique IDs for structured reporting
Aligning your security program roadmap to specific adversary groups known to target your sector

Do not use this skill for real-time incident triage — ATT&CK mapping is an analytical activity best performed post-detection or during threat hunting planning.

Prerequisites

Access to MITRE ATT&CK knowledge base (https://attack.mitre.org) or local ATT&CK STIX data bundle
ATT&CK Navigator web app or local installation (https://mitre-attack.github.io/attack-navigator/)
Inventory of existing detection rules (Sigma, Splunk, Sentinel KQL) to assess current coverage
ATT&CK Python library: pip install mitreattack-python

Workflow

Step 1: Obtain Current ATT&CK Data

Download the latest ATT&CK STIX bundle for the relevant matrix (Enterprise, Mobile, ICS):

curl -o enterprise-attack.json \
  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

Use the mitreattack-python library to query techniques programmatically:

from mitreattack.stix20 import MitreAttackData

mitre = MitreAttackData("enterprise-attack.json")
techniques = mitre.get_techniques(remove_revoked_deprecated=True)
for t in techniques[:5]:
    print(t["external_references"][0]["external_id"], t["name"])

Step 2: Map Existing Detections to Techniques

For each SIEM rule or Sigma file, assign ATT&CK technique IDs. Sigma rules support native ATT&CK tagging:

tags:
  - attack.execution
  - attack.t1059.001

Term	Definition
ATT&CK Technique	Specific adversary method identified by T-number (e.g., T1059 = Command and Scripting Interpreter)
Sub-technique	More granular variant of a technique (e.g., T1059.001 = PowerShell, T1059.003 = Windows Command Shell)
Tactic	Adversary goal category in ATT&CK: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C&C, Exfiltration, Impact
Data Source	ATT&CK v10+ component identifying telemetry required to detect a technique (e.g., Process Creation, Network Traffic)
Coverage Score	Numeric (0–100) representing detection completeness for a technique: 0=blind, 50=logged only, 100=alerted
MITRE D3FEND	Defensive countermeasure ontology complementing ATT&CK — maps defensive techniques to attack techniques they mitigate

mapping-mitre-attack-techniques

Opções de instalação

Revise os arquivos de origem

Mapping MITRE ATT&CK Techniques

When to Use

Prerequisites

Workflow

Step 1: Obtain Current ATT&CK Data

Step 2: Map Existing Detections to Techniques

Mapping MITRE ATT&CK Techniques

When to Use

Prerequisites

Workflow

Step 1: Obtain Current ATT&CK Data

Step 2: Map Existing Detections to Techniques

Step 3: Prioritize Coverage Gaps Using Threat Intelligence

Step 4: Build Navigator Heatmap

Step 5: Generate Executive Coverage Report

Key Concepts

Tools & Systems

Common Pitfalls

mapping-mitre-attack-techniques

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mapping MITRE ATT&CK Techniques

When to Use

Prerequisites

Workflow

Step 1: Obtain Current ATT&CK Data

Step 2: Map Existing Detections to Techniques

Mais deste repositório

Mapping MITRE ATT&CK Techniques

When to Use

Prerequisites

Workflow

Step 1: Obtain Current ATT&CK Data

Step 2: Map Existing Detections to Techniques

Step 3: Prioritize Coverage Gaps Using Threat Intelligence

Step 4: Build Navigator Heatmap

Step 5: Generate Executive Coverage Report

Key Concepts

Tools & Systems

Common Pitfalls