mukul975/Anthropic-Cybersecurity-Skills
analyzing-cyber-kill-chain
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
Before you install
- Last update
- Files in folder
- 4
- Scripts
- Contains scripts. Review them before running.
- SKILL.md size
- 7.1 KB (about 1,827 tokens of context each time it loads)
- License
- Apache-2.0
- Source on GitHub
- mukul975/Anthropic-Cybersecurity-Skills
Skills are plain text instructions the agent follows, sometimes with scripts. Check the source, prefer repositories with many installs and stars, and read any script it ships.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills@analyzing-cyber-kill-chainRuns in a terminal with Node.js 18 or newer. Add -y to skip the prompts and -g to install for every project instead of this one.
Install for your agent
npx skills add mukul975/Anthropic-Cybersecurity-Skills@analyzing-cyber-kill-chain --agent claude-code -y- Project install writes to
.claude/skills/analyzing-cyber-kill-chain- Global install writes to
~/.claude/skills/analyzing-cyber-kill-chain
Start a new session afterwards so the agent picks the skill up. In Claude Code you can also call it directly with /analyzing-cyber-kill-chain.
What it does
Analyzing Cyber Kill Chain When to Use Use this skill when: - Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence - Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase - Producing threat intelligence reports that communicate attack progression to non-technical stakeholders Do not use this skill as a standalone framework — combine with MITRE ATT&CK for technique-level granularity beyond what the 7-phase kill chain provides. Prerequisites - Complete incident timeline with forensic…
Excerpt from the skill's own SKILL.md. Read the full file on GitHub before installing: skills run with your agent's permissions.
Related skills
- analyzing-api-gateway-access-logs
mukul975/Anthropic-Cybersecurity-Skills
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
- acquiring-disk-image-with-dd-and-dcfldd
mukul975/Anthropic-Cybersecurity-Skills
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
664 installs 35K scripts - analyzing-android-malware-with-apktool
mukul975/Anthropic-Cybersecurity-Skills
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
- analyzing-email-headers-for-phishing-investigation
mukul975/Anthropic-Cybersecurity-Skills
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
604 installs 35K scripts - analyzing-browser-forensics-with-hindsight
mukul975/Anthropic-Cybersecurity-Skills
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
- analyzing-docker-container-forensics
mukul975/Anthropic-Cybersecurity-Skills
Investigate compromised Docker containers by analyzing images, layers,