From cybersecurity-skills
Performs endpoint vulnerability remediation: prioritizes CVEs by CVSS/EPSS/CISA KEV risk scores, deploys patches via WSUS/SCCM, applies configs, validates fixes. For scans, advisories, compliance SLAs.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
Use this skill when:
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Use this skill when:
Do not use this skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).
Priority scoring combines:
1. CVSS Base Score (0-10)
2. EPSS (Exploit Prediction Scoring System) - probability of exploitation
3. CISA KEV (Known Exploited Vulnerabilities) catalog membership
4. Asset criticality (business impact of affected endpoint)
5. Network exposure (internet-facing vs. internal)
Priority Matrix:
P1 (Critical - 14 days SLA):
- CVSS >= 9.0 OR
- Listed in CISA KEV OR
- Active exploitation in the wild + CVSS >= 7.0
P2 (High - 30 days SLA):
- CVSS 7.0-8.9 AND
- EPSS > 0.5 (50% probability of exploitation)
P3 (Medium - 60 days SLA):
- CVSS 4.0-6.9 OR
- CVSS 7.0-8.9 with EPSS < 0.1
P4 (Low - 90 days SLA):
- CVSS < 4.0 AND
- No known exploit
For each vulnerability, determine the appropriate remediation:
Remediation Types:
1. Patch: Apply vendor security update (most common)
2. Configuration change: Modify settings to mitigate (registry, GPO)
3. Upgrade: Update to newer software version
4. Workaround: Apply temporary mitigation when patch unavailable
5. Compensating control: Network segmentation, WAF rule, EDR rule
6. Accept risk: Document accepted risk with CISO sign-off
# WSUS: Approve patches for deployment
# 1. Open WSUS Console
# 2. Navigate to Updates → Security Updates
# 3. Approve selected KBs for target computer groups
# SCCM: Create Software Update Group
# 1. Software Library → Software Updates → All Software Updates
# 2. Select required KBs → Create Software Update Group
# 3. Deploy to target collection with maintenance window
# Intune: Create Windows Update Ring
# Devices → Windows → Update rings
# Configure: Quality updates deferral = 0 days (for critical)
# Feature updates deferral = per policy
# PowerShell: Force Windows Update check
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -KBArticleID "KB5034441" -Install -AcceptAll -AutoReboot
# Verify patch installation
Get-HotFix -Id "KB5034441"
systeminfo | findstr "KB5034441"
# Example: Disable SMBv1 (CVE-2017-0144 - EternalBlue)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
# Example: Disable Print Spooler on non-print servers (CVE-2021-34527 - PrintNightmare)
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
# Example: Disable LLMNR (credential theft mitigation)
# Via GPO: Computer Configuration → Admin Templates → Network → DNS Client
# Turn off multicast name resolution: Enabled
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" `
-Name EnableMulticast -Value 0 -PropertyType DWORD -Force
# Example: Restrict NTLM authentication
# Via GPO: Security Settings → Local Policies → Security Options
# Network security: Restrict NTLM: Audit/Deny
When vendor patch is not yet available:
1. Check vendor advisory for workarounds
- Microsoft: https://msrc.microsoft.com/update-guide
- Adobe: https://helpx.adobe.com/security.html
- Linux: Distribution security trackers
2. Apply temporary mitigations:
- Disable vulnerable feature/service
- Deploy EDR detection rule for exploitation attempt
- Apply network-level blocking (WAF/firewall rules)
- Restrict access to vulnerable application
3. Monitor for patch release:
- Subscribe to vendor security mailing list
- Monitor CISA KEV additions
- Set calendar reminder for next Patch Tuesday
4. Document workaround with expiration date
# Re-scan remediated endpoints to confirm vulnerability closure
# Option 1: Targeted vulnerability scan
nessuscli scan --target 192.168.1.0/24 --plugin-id 12345
# Option 2: PowerShell verification
# Check specific KB is installed
$kb = Get-HotFix -Id "KB5034441" -ErrorAction SilentlyContinue
if ($kb) {
Write-Host "PASS: KB5034441 installed on $(hostname)" -ForegroundColor Green
} else {
Write-Host "FAIL: KB5034441 missing on $(hostname)" -ForegroundColor Red
}
# Check service is disabled
$svc = Get-Service -Name Spooler
if ($svc.StartType -eq 'Disabled') {
Write-Host "PASS: Print Spooler disabled" -ForegroundColor Green
}
# Check registry configuration
$val = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
-Name SMB1 -ErrorAction SilentlyContinue
if ($val.SMB1 -eq 0) {
Write-Host "PASS: SMBv1 disabled" -ForegroundColor Green
}
Generate remediation status report:
Remediation Metrics:
- Total vulnerabilities: X
- Remediated: Y (Z%)
- Pending (within SLA): A
- Overdue (past SLA): B
- Accepted risk: C
- Mean time to remediate (MTTR): D days
- SLA compliance rate: E%
| Term | Definition |
|---|---|
| CVSS | Common Vulnerability Scoring System; 0-10 severity scale for vulnerabilities |
| EPSS | Exploit Prediction Scoring System; probability (0-1) that a CVE will be exploited in the wild within 30 days |
| CISA KEV | CISA Known Exploited Vulnerabilities catalog; federal mandate to patch these CVEs within specified timeframes |
| SLA | Service Level Agreement for remediation timelines based on vulnerability severity |
| MTTR | Mean Time To Remediate; average days from vulnerability discovery to confirmed fix |
| Compensating Control | Alternative security measure when direct remediation is not feasible |