From cybersecurity-skills
Collects, categorizes, and shares indicators of compromise (IOCs) from security incidents using STIX/TAXII and platforms like MISP for detection and threat intelligence.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
- During active incident response to identify and block adversary infrastructure
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Do not use for behavioral TTP analysis without accompanying technical indicators; use MITRE ATT&CK mapping for behavioral characterization.
Collect indicators across all categories from incident evidence:
Network Indicators:
Host Indicators:
Email Indicators:
Systematically extract indicators from each evidence source:
From SIEM/Log Analysis:
# Extract unique destination IPs from firewall logs
index=firewall action=blocked
| stats count by dest_ip
| where count > 100
# Extract domains from DNS query logs
index=dns query=*evil* OR query=*c2*
| stats count by query
From Memory Forensics:
# Extract network connections
vol -f memory.raw windows.netscan | grep ESTABLISHED
# Extract strings from suspicious process memory
vol -f memory.raw windows.memmap --pid 3847 --dump
strings -n 8 pid.3847.dmp | grep -E "(http|https)://"
From Malware Analysis:
Sandbox Report IOC Extraction:
- Dropped files: 3 (hashes extracted)
- DNS queries: update.evil[.]com, cdn.malware[.]net
- HTTP connections: POST to https://185.220.101[.]42/gate.php
- Registry modified: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svcupdate
- Mutex created: Global\MTX_0x1234ABCD
- Named pipe: \\.\pipe\MSSE-1234-server
Add threat intelligence context to each indicator:
IOC Enrichment Report:
━━━━━━━━━━━━━━━━━━━━━
IP: 185.220.101.42
VirusTotal: 12/89 vendors flag as malicious
Shodan: Open ports: 443, 8443, 80
Geolocation: Netherlands, AS208476
First Seen: 2025-10-01
Threat Intel: Associated with Qakbot C2 infrastructure
Confidence: High
TLP: AMBER
Domain: update.evil[.]com
Registration: 2025-10-28 (recently registered)
Registrar: Namecheap
WHOIS Privacy: Yes
VirusTotal: 8/89 vendors flag as malicious
DNS History: Resolved to 185.220.101.42, 91.215.85.17
Confidence: High
TLP: AMBER
Assign confidence and risk scores to each indicator:
| Score | Confidence Level | Criteria |
|---|---|---|
| 90-100 | Confirmed Malicious | Multiple TI sources confirm, observed in active attack |
| 70-89 | Highly Suspicious | Single TI source confirms, behavioral analysis supports |
| 50-69 | Suspicious | Limited TI data, contextually suspicious |
| 30-49 | Unconfirmed | No TI matches, but anomalous in environment |
| 0-29 | Likely Benign | False positive indicators or legitimate infrastructure |
Push IOCs to defensive systems for immediate protection:
Package IOCs in STIX 2.1 format for sharing:
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"created": "2025-11-15T18:00:00Z",
"modified": "2025-11-15T18:00:00Z",
"name": "Qakbot C2 Server IP",
"indicator_types": ["malicious-activity"],
"pattern": "[ipv4-addr:value = '185.220.101.42']",
"pattern_type": "stix",
"valid_from": "2025-11-15T14:23:00Z",
"confidence": 95,
"labels": ["c2", "qakbot"],
"object_marking_refs": ["marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"]
}
Submit to MISP, ISAC portals, and TAXII servers per sharing agreements.
| Term | Definition |
|---|---|
| IOC (Indicator of Compromise) | Technical artifact observed during a security incident that indicates adversary presence (hash, IP, domain, etc.) |
| TLP (Traffic Light Protocol) | Standard for classifying the sharing restrictions of threat intelligence: WHITE, GREEN, AMBER, AMBER+STRICT, RED |
| STIX (Structured Threat Information Expression) | Standard language for representing cyber threat intelligence in a structured, machine-readable format |
| TAXII (Trusted Automated Exchange of Intelligence Information) | Transport protocol for sharing STIX-formatted threat intelligence between organizations |
| Confidence Score | Numerical rating (0-100) indicating the analyst's certainty that an indicator is truly malicious |
| IOC Lifecycle | Process of creating, validating, distributing, and eventually retiring indicators as they lose relevance |
| Defanging | Practice of modifying malicious URLs and domains in reports to prevent accidental clicks (e.g., evil[.]com) |
Context: After responding to a Qakbot infection that led to Cobalt Strike deployment, the IR team must package all IOCs for sharing with the Financial Services ISAC (FS-ISAC).
Approach:
Pitfalls:
INDICATOR OF COMPROMISE REPORT
================================
Incident: INC-2025-1547
Date: 2025-11-15
TLP: AMBER
Sharing: FS-ISAC, internal SOC
NETWORK INDICATORS
Type | Value | Confidence | Context
---------|--------------------------|------------|--------
IPv4 | 185.220.101[.]42 | 95 | Qakbot C2 server
IPv4 | 91.215.85[.]17 | 90 | Cobalt Strike C2
Domain | update.evil[.]com | 95 | Staging domain
URL | hxxps://185.220[.]101.42/gate.php | 95 | C2 check-in
JA3 | a0e9f5d64349fb13191bc7...| 80 | Qakbot TLS fingerprint
HOST INDICATORS
Type | Value | Confidence | Context
---------|--------------------------|------------|--------
SHA-256 | a1b2c3d4e5f6... | 100 | Qakbot dropper
SHA-256 | b2c3d4e5f6a7... | 100 | Cobalt Strike beacon
FilePath | C:\Users\*\AppData\Local\Temp\update.exe | 85 | Dropper location
RegKey | HKCU\...\Run\svcupdate | 90 | Persistence
Mutex | Global\MTX_0x1234ABCD | 95 | Qakbot instance lock
Task | WindowsUpdate | 90 | Scheduled task persistence
EMAIL INDICATORS
Type | Value | Confidence | Context
---------|--------------------------|------------|--------
Sender | billing@spoofed[.]com | 95 | Phishing sender
Subject | "Invoice-Nov2025" | 70 | Phishing subject line
Hash | c3d4e5f6a7b8... | 100 | Malicious .docm attachment
TOTAL: 14 indicators | HIGH confidence avg: 91