菜单
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill detecting-aws-cloudtrail-anomalies命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
正在显示 SKILL.md
基于 SOC 职业分类
| name | detecting-aws-cloudtrail-anomalies |
| description | Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access. |
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["cloud-security","aws","cloudtrail","anomaly-detection","threat-detection","boto3"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf |
| ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] |
| mitre_attack | ["T1078.004","T1580","T1538","T1098.001","T1526"] |
| mitre_f3 | {"version":"1.1","tactics":["initial-access","positioning","defense-impairment"],"techniques":[{"id":"F1006.001","name":"Account Takeover: Exposed API Key","tactic":"initial-access","source":"f3"},{"id":"T1586.003","name":"Compromise Accounts: Cloud Accounts","tactic":"resource-development","source":"attack"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1005.001","name":"Account Manipulation: Account Linking","tactic":"defense-impairment","source":"f3"}]} |
AWS CloudTrail records API calls across AWS services. This skill covers querying CloudTrail events with boto3's lookup_events API, building statistical baselines of normal API activity, detecting anomalies such as unusual event sources, geographic anomalies, high-frequency API calls, and first-time API usage patterns that indicate compromised credentials or insider threats.
boto3 libraryUse boto3 CloudTrail client's lookup_events to retrieve recent API activity with pagination.
Aggregate events by user, source IP, event source, and event name to establish normal behavior patterns.
Flag unusual patterns: new event sources per user, first-time API calls, geographic IP changes, high error rates, and sensitive API usage (IAM, KMS, S3 policy changes).
Produce a JSON report with anomaly scores, top suspicious users, and recommended investigation actions.
JSON report with event statistics, baseline deviations, anomalous users/IPs, sensitive API calls, and error rate analysis.