Anthropic-Cybersecurity-Skills 實(shí)戰(zhàn)Windows USB 設(shè)備連接歷史取證分析指南【免費(fèi)下載鏈接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0項(xiàng)目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本文是 Anthropic-Cybersecurity-Skills 倉(cāng)庫(kù)中analyzing-usb-device-connection-history技能Skill的深度實(shí)戰(zhàn)指南。該技能屬于數(shù)字取證Digital Forensics子域聚焦于通過(guò)關(guān)聯(lián) Windows 注冊(cè)表鍵USBSTOR、MountedDevices、MountPoints2、事件日志System、Security、DriverFrameworks-UserMode與setupapi.dev.log完整重建 USB 設(shè)備的連接歷史、首次/末次插入時(shí)間戳與盤(pán)符映射。讀完本文后你將掌握一套可直接落地的手工取證工作流以及基于本倉(cāng)庫(kù) agent.py 的自動(dòng)化解析能力可應(yīng)用于可移動(dòng)介質(zhì)數(shù)據(jù)泄露調(diào)查、內(nèi)部威脅追蹤、合規(guī)審計(jì)與設(shè)備溯源場(chǎng)景。何時(shí)使用本技能根據(jù) SKILL.md 的定位本技能在以下場(chǎng)景中價(jià)值最高調(diào)查經(jīng)由可移動(dòng)存儲(chǔ)設(shè)備U 盤(pán)、移動(dòng)硬盤(pán)實(shí)施的數(shù)據(jù)泄露Exfiltration事件內(nèi)部威脅調(diào)查中追蹤特定用戶(hù)的 USB 設(shè)備使用情況合規(guī)審計(jì)中驗(yàn)證可移動(dòng)介質(zhì)管控策略removable media policy是否得到執(zhí)行將 USB 連接事件與文件訪問(wèn)、復(fù)制事件進(jìn)行關(guān)聯(lián)取證在應(yīng)急響應(yīng)中建立完整的設(shè)備連接時(shí)間線。在 MITRE ATTCK 視角下本技能覆蓋了T1052.001Exfiltration Over Physical Medium: Exfiltration over USB、T1025Data from Removable Media、T1091Replication Through Removable Media、T1005Data from Local System與T1074.001Data Staged: Local Data Staging在 NIST CSF 2.0 上對(duì)應(yīng)RS.AN-03、DE.AE-02、RS.MA-01見(jiàn) SKILL.md 的 frontmatter 與倉(cāng)庫(kù) ATTACK_COVERAGE.md 的技術(shù)映射體系。前置條件取證鏡像forensic image或已提取的注冊(cè)表配置單元hives與事件日志可訪問(wèn)SYSTEM、SOFTWARE、NTUSER.DAT注冊(cè)表配置單元SetupAPI 日志setupapi.dev.log用于首次連接時(shí)間戳Windows 事件日志System、Security、DriverFrameworks-UserMode工具USBDeview、USB Forensic Tracker、RegRipper理解 USB 設(shè)備標(biāo)識(shí)體系VIDVendor ID、PIDProduct ID、序列號(hào)serial number。取證工作流總覽完整的分析流程分為五個(gè)步驟前四步分別從不同證據(jù)源提取信息第五步匯總為統(tǒng)一時(shí)間線提取 USB 相關(guān)取證產(chǎn)物掛載鏡像、拷貝配置單元/日志解析USBSTOR注冊(cè)表鍵設(shè)備清單與末次連接時(shí)間提取MountedDevices盤(pán)符映射與MountPoints2用戶(hù)關(guān)聯(lián)從setupapi.dev.log與事件日志提取首次連接時(shí)間戳匯總構(gòu)建 USB 活動(dòng)時(shí)間線并輸出報(bào)告。提示完整操作應(yīng)始終在取證鏡像的只讀副本上進(jìn)行本技能提供的工作流以mount -o ro,loop只讀掛載為起點(diǎn)。Step 1提取 USB 相關(guān)取證產(chǎn)物對(duì)取證鏡像進(jìn)行只讀掛載后將關(guān)鍵證據(jù)文件拷貝到案件工作目錄。掛載時(shí)需根據(jù)鏡像的分區(qū)起始扇區(qū)計(jì)算偏移示例中為2048*512即標(biāo)準(zhǔn) 1 MiB 對(duì)齊# Mount forensic image and copy relevant artifacts mount -o ro,loop,offset$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence mkdir -p /cases/case-2024-001/usb/ # Registry hives cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/usb/ cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/usb/ cp /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/usb/ # SetupAPI logs (first connection timestamps) cp /mnt/evidence/Windows/INF/setupapi.dev.log /cases/case-2024-001/usb/ # Event logs cp /mnt/evidence/Windows/System32/winevt/Logs/System.evtx /cases/case-2024-001/usb/ cp /mnt/evidence/Windows/System32/winevt/Logs/Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx \ /cases/case-2024-001/usb/ 2/dev/null cp /mnt/evidence/Windows/System32/winevt/Logs/Microsoft-Windows-Partition%4Diagnostic.evtx \ /cases/case-2024-001/usb/ 2/dev/null本技能原文檔 SKILL.md 中明確說(shuō)明事件日志的Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx與Microsoft-Windows-Partition%4Diagnostic.evtx路徑在部分系統(tǒng)中不存在拷貝命令后附加了2/dev/null以容忍缺失這保證了工作流在差異化 Windows 環(huán)境中的健壯性。Step 2解析 USBSTOR 注冊(cè)表鍵USBSTOR是 SYSTEM 配置單元中存儲(chǔ) USB 大容量存儲(chǔ)設(shè)備標(biāo)識(shí)與連接數(shù)據(jù)的核心鍵。其枚舉路徑結(jié)構(gòu)為ControlSet00X\Enum\USBSTOR\DiskVen_廠商Prod_產(chǎn)品Rev_修訂\序列號(hào)注意必須先讀取Select鍵中的Current值確定當(dāng)前 ControlSet通常是 ControlSet001否則可能解析到非活動(dòng)配置單元。使用python-registryRegistry模塊解析的完整腳本如下python3 PYEOF from Registry import Registry import json reg Registry.Registry(/cases/case-2024-001/usb/SYSTEM) # Find current ControlSet select reg.open(Select) current select.value(Current).value() controlset fControlSet{current:03d} # Parse USBSTOR usbstor_path f{controlset}\\Enum\\USBSTOR usbstor reg.open(usbstor_path) devices [] print( USBSTOR DEVICES \n) for device_class in usbstor.subkeys(): # Format: DiskVen_VENDORProd_PRODUCTRev_REVISION class_name device_class.name() parts class_name.split() vendor parts[1].replace(Ven_, ) if len(parts) 1 else Unknown product parts[2].replace(Prod_, ) if len(parts) 2 else Unknown revision parts[3].replace(Rev_, ) if len(parts) 3 else Unknown for instance in device_class.subkeys(): serial instance.name() last_write instance.timestamp() device_info { vendor: vendor, product: product, revision: revision, serial: serial, last_connected: str(last_write), } # Get friendly name if available try: friendly instance.value(FriendlyName).value() device_info[friendly_name] friendly except: pass # Get device parameters try: params instance.subkey(Device Parameters) try: device_info[class_guid] params.value(ClassGUID).value() except: pass except: pass devices.append(device_info) print(fDevice: {vendor} {product}) print(f Serial: {serial}) print(f Last Connected: {last_write}) print(f Friendly Name: {device_info.get(friendly_name, N/A)}) print() # Save results with open(/cases/case-2024-001/analysis/usb_devices.json, w) as f: json.dump(devices, f, indent2) print(f\nTotal USB storage devices found: {len(devices)}) PYEOF關(guān)鍵點(diǎn)設(shè)備類(lèi)名解析DiskVen_KingstonProd_DataTraveler_3.0Rev_PMAP這類(lèi)名稱(chēng)按拆分后分別對(duì)應(yīng)廠商、產(chǎn)品、修訂號(hào)末次連接時(shí)間取自實(shí)例鍵的最后寫(xiě)入時(shí)間戳instance.timestamp()這是 USBSTOR 能提供的末次連接證據(jù)FriendlyName人類(lèi)可讀的設(shè)備名稱(chēng)用于與采購(gòu)/白名單記錄比對(duì)ClassGUID位于Device Parameters子鍵用于進(jìn)一步歸類(lèi)設(shè)備。倉(cāng)庫(kù)中的 agent.py第 12-42 行parse_usbstor將該邏輯封裝為可復(fù)用函數(shù)且改用regipy庫(kù)實(shí)現(xiàn)同樣的遍歷RegistryHive打開(kāi) SYSTEM →Select鍵讀取Current→iter_subkeys()遍歷設(shè)備類(lèi)與實(shí)例 → 從instance.header.last_modified獲取末次連接時(shí)間戳。可見(jiàn)原文檔的解析思路與倉(cāng)庫(kù)參考實(shí)現(xiàn)api-reference.md 中的 regipy 示例完全一致僅是庫(kù) API 不同。Step 3提取盤(pán)符映射與用戶(hù)關(guān)聯(lián)USBSTOR 只告訴我們什么設(shè)備被插過(guò)還需回答插到哪個(gè)盤(pán)符和哪個(gè)用戶(hù)用過(guò)。這一步分別由MountedDevices與MountPoints2承擔(dān)。MountedDevices盤(pán)符到設(shè)備的映射python3 PYEOF from Registry import Registry import struct reg Registry.Registry(/cases/case-2024-001/usb/SYSTEM) mounted reg.open(MountedDevices) print( MOUNTED DEVICES (Drive Letter Assignments) \n) for value in mounted.values(): name value.name() data value.value() if name.startswith(\\DosDevices\\): drive_letter name.replace(\\DosDevices\\, ) if len(data) 24: # USB device - contains device path string try: device_path data.decode(utf-16-le).strip(\x00) if USBSTOR in device_path or USB# in device_path: print(f {drive_letter} - {device_path}) except: pass else: # Fixed disk - contains disk signature offset disk_sig struct.unpack(I, data[0:4])[0] offset struct.unpack(Q, data[4:12])[0] print(f {drive_letter} - Disk Signature: 0x{disk_sig:08X}, Offset: {offset}) PYEOF解析要點(diǎn)值名\DosDevices\E:中的盤(pán)符即設(shè)備掛載盤(pán)符數(shù)據(jù)長(zhǎng)度 24 字節(jié)的值通常是 USB 設(shè)備其內(nèi)容為 UTF-16LE 編碼的設(shè)備路徑字符串可通過(guò)包含USBSTOR或USB#判定為 USB 設(shè)備長(zhǎng)度 ≤ 24 字節(jié)的值對(duì)應(yīng)固定磁盤(pán)內(nèi)容是 4 字節(jié)磁盤(pán)簽名 8 字節(jié)分區(qū)偏移因此需要struct.unpack按I與Q解包。MountPoints2哪個(gè)用戶(hù)訪問(wèn)了哪些卷python3 PYEOF from Registry import Registry import os, glob print(\n USER MOUNT POINTS (MountPoints2) \n) for ntuser in glob.glob(/cases/case-2024-001/usb/NTUSER*.DAT): try: reg Registry.Registry(ntuser) mp2 reg.open(Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2) print(fUser hive: {os.path.basename(ntuser)}) for key in mp2.subkeys(): guid key.name() last_write key.timestamp() if { in guid: print(f Volume: {guid} | Last accessed: {last_write}) print() except Exception as e: print(f Error parsing {ntuser}: {e}) PYEOF由于 MountPoints2 位于每個(gè)用戶(hù)各自的NTUSER.DAT中腳本通過(guò)glob遍歷所有用戶(hù)配置單元從而建立設(shè)備卷 GUID → 用戶(hù) → 訪問(wèn)時(shí)間的關(guān)聯(lián)。這正是將設(shè)備與具體嫌疑人用戶(hù)關(guān)聯(lián)起來(lái)的關(guān)鍵證據(jù)鏈。倉(cāng)庫(kù)參考文檔 api-reference.md 匯總了本技能涉及的四個(gè)核心注冊(cè)表路徑可作為手工分析的速查表路徑配置單元說(shuō)明ControlSet00X\Enum\USBSTORSYSTEMUSB 大容量存儲(chǔ)設(shè)備標(biāo)識(shí)符MountedDevicesSYSTEM盤(pán)符到設(shè)備的映射ControlSet00X\Enum\USBSYSTEM所有 USB 設(shè)備不限于存儲(chǔ)Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2NTUSER.DAT按用戶(hù)的卷訪問(wèn)歷史Step 4提取首次連接時(shí)間戳USBSTOR 只提供末次連接時(shí)間首次連接時(shí)間需要從 SetupAPI 日志與事件日志中獲取。SetupAPI首次安裝時(shí)間python3 PYEOF import re print( SETUPAPI USB DEVICE INSTALLATIONS \n) with open(/cases/case-2024-001/usb/setupapi.dev.log, r, errorsignore) as f: content f.read() # Find USB device installation sections pattern r\s\[Device Install.*?\n.*?Section start (\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}).*?\n(.*?) matches re.findall(pattern, content, re.DOTALL) usb_installs [] for timestamp, section in matches: if USBSTOR in section or USB\\VID in section: # Extract device ID dev_match re.search(r(USBSTOR\\[^\s]|USB\\VID_\wPID_\w[^\s]*), section) if dev_match: device_id dev_match.group(1) usb_installs.append({ first_install: timestamp, device_id: device_id }) print(f {timestamp} | {device_id}) print(f\nTotal USB installations found: {len(usb_installs)}) PYEOF正則邏輯說(shuō)明匹配 [Device Install ...] Section start 時(shí)間戳 ... 格式的安裝段再在段內(nèi)查找USBSTOR\...或USB\VID_...PID_...設(shè)備 ID從而得到該設(shè)備首次被系統(tǒng)識(shí)別并安裝驅(qū)動(dòng)的時(shí)間。事件日志連接/拔出事件python3 PYEOF import json from evtx import PyEvtxParser try: parser PyEvtxParser(/cases/case-2024-001/usb/System.evtx) print(\n SYSTEM EVENT LOG USB EVENTS \n) for record in parser.records_json(): data json.loads(record[data]) event_id str(data[Event][System][EventID]) # USB device connection events if event_id in (20001, 20003, 10000, 10100): timestamp data[Event][System][TimeCreated][#attributes][SystemTime] event_data data[Event].get(UserData, data[Event].get(EventData, {})) print(f [{timestamp}] EventID {event_id}: {json.dumps(event_data, defaultstr)[:200]}) except Exception as e: print(fError: {e}) PYEOF需要關(guān)注的事件 ID 匯總本技能原文檔明確列出事件源事件 ID含義DriverFrameworks-UserMode2003、2010、2100、2102USB 設(shè)備驅(qū)動(dòng)安裝/啟停相關(guān)Security6416識(shí)別到新的外部設(shè)備外接設(shè)備審計(jì)System20001、20003、10000、10100USB 插拔相關(guān)連接事件結(jié)合倉(cāng)庫(kù) agent.py 中的parse_setupapi_log第 85-100 行可見(jiàn)自動(dòng)化實(shí)現(xiàn)使用了相同的正則模式\s\[Device Install...與Section start說(shuō)明該正則模式在倉(cāng)庫(kù)實(shí)現(xiàn)中已被驗(yàn)證為有效。這樣手工腳本與倉(cāng)庫(kù) Agent 代碼形成互相印證讀者可以放心復(fù)用。Step 5構(gòu)建 USB 活動(dòng)時(shí)間線與報(bào)告將前四步證據(jù)匯總為統(tǒng)一時(shí)間線輸出 CSV 供后續(xù)分析工具如 Excel、Splunk、Timesketch使用python3 PYEOF import json, csv timeline [] # Load USBSTOR data with open(/cases/case-2024-001/analysis/usb_devices.json) as f: devices json.load(f) for device in devices: timeline.append({ timestamp: device[last_connected], source: USBSTOR Registry, device: f{device[vendor]} {device[product]}, serial: device[serial], event: Last Connected, detail: device.get(friendly_name, ) }) # Sort chronologically timeline.sort(keylambda x: x[timestamp]) # Write timeline CSV with open(/cases/case-2024-001/analysis/usb_timeline.csv, w, newline) as f: writer csv.DictWriter(f, fieldnames[timestamp, source, device, serial, event, detail]) writer.writeheader() writer.writerows(timeline) print(fUSB Timeline: {len(timeline)} events written to usb_timeline.csv) # Print summary print(\n USB DEVICE SUMMARY ) for entry in timeline: print(f {entry[timestamp]} | {entry[device]} | {entry[serial][:20]} | {entry[event]}) PYEOF倉(cāng)庫(kù) agent.py 的build_timeline第 103-125 行在手工腳本基礎(chǔ)上做了增強(qiáng)同時(shí)把 USBSTOR 的Last Connected事件與 MountPoints2 的Volume Accessed事件合并進(jìn)同一條時(shí)間線并按時(shí)間戳排序后通過(guò)export_timeline_csv第 128-135 行導(dǎo)出。該 Agent 的 CLI 用法為python3 agent.py \ --system-hive /cases/case-2024-001/usb/SYSTEM \ --ntuser /cases/case-2024-001/usb/NTUSER.DAT \ --setupapi-log /cases/case-2024-001/usb/setupapi.dev.log \ --output-dir ./usb_analysis \ --case-id CASE-2024-001從main()第 138-178 行可以看到參數(shù)約定--system-hive為必填--ntuser、--setupapi-log可選輸出包含設(shè)備清單、盤(pán)符映射、時(shí)間線事件數(shù)以及一份 JSON 報(bào)告。這種手工腳本 可復(fù)用 Agent的組合正是本技能設(shè)計(jì)的意圖——先用文檔理解原理再用 Agent 自動(dòng)化重復(fù)勞動(dòng)。關(guān)鍵概念速查概念說(shuō)明USBSTOR存儲(chǔ) USB 大容量存儲(chǔ)設(shè)備標(biāo)識(shí)與連接數(shù)據(jù)的注冊(cè)表鍵VID/PID唯一標(biāo)識(shí) USB 設(shè)備廠商與型號(hào)的廠商 ID 與產(chǎn)品 ID設(shè)備序列號(hào)單個(gè) USB 設(shè)備的唯一標(biāo)識(shí)注意部分設(shè)備共享序列號(hào)MountedDevices將卷 GUID 與盤(pán)符映射到物理設(shè)備的注冊(cè)表鍵MountPoints2按用戶(hù)記錄卷訪問(wèn)歷史的注冊(cè)表鍵SetupAPI 日志記錄設(shè)備首次連接驅(qū)動(dòng)安裝時(shí)間的 Windows 驅(qū)動(dòng)安裝日志DeviceContainersSOFTWARE 配置單元中攜帶設(shè)備元數(shù)據(jù)與時(shí)間戳的注冊(cè)表鍵EMDMgmt追蹤 ReadyBoost 兼容設(shè)備含序列號(hào)與時(shí)間戳的注冊(cè)表鍵其中DeviceContainers與EMDMgmt位于SOFTWARE配置單元可作為 USBSTOR 之外的時(shí)間戳佐證源詳見(jiàn) api-reference.md。工具與系統(tǒng)工具用途USB Forensic Tracker專(zhuān)門(mén)的 USB 設(shè)備歷史提取工具USBDeviewNirSoft 出品列出系統(tǒng)連接過(guò)的所有 USB 設(shè)備RegRipperusbstor 插件從注冊(cè)表配置單元自動(dòng)提取 USB 產(chǎn)物Registry Explorer交互式分析 USB 相關(guān)注冊(cè)表鍵KAPE自動(dòng)化收集 USB 相關(guān)取證產(chǎn)物Plaso/log2timeline構(gòu)建包含 USB 連接事件的完整時(shí)間線FTK Imager取證成像含可移動(dòng)介質(zhì)Velociraptor端點(diǎn) Agent內(nèi)置 USB 設(shè)備歷史狩獵產(chǎn)物常見(jiàn)實(shí)戰(zhàn)場(chǎng)景場(chǎng)景 1離職員工數(shù)據(jù)泄露提取 USBSTOR 條目識(shí)別所有連接過(guò)的 USB 設(shè)備用設(shè)備序列號(hào)關(guān)聯(lián) MountPoints2 確認(rèn)具體用戶(hù)訪問(wèn)將時(shí)間戳與文件訪問(wèn)日志、Jump List 最近文件交叉比對(duì)在 USN Journal 中查找大規(guī)模文件復(fù)制特征。場(chǎng)景 2安全系統(tǒng)上出現(xiàn)未授權(quán)設(shè)備將所有 USBSTOR 條目與公司白名單設(shè)備清單比對(duì)通過(guò) VID/PID 識(shí)別未獲企業(yè)批準(zhǔn)的硬件確定未授權(quán)設(shè)備的首次與末次連接時(shí)間核查是否發(fā)生了數(shù)據(jù)傳輸。場(chǎng)景 3經(jīng) USB 傳播的惡意軟件找出惡意軟件執(zhí)行Prefetch 時(shí)間戳之前剛剛插入的 USB 設(shè)備提取設(shè)備序列號(hào)與廠商信息檢查該設(shè)備的 autorun 是否被啟用在 Prefetch 與 ShimCache 中查找從可移動(dòng)盤(pán)符啟動(dòng)的可執(zhí)行文件痕跡。場(chǎng)景 4跨多臺(tái)系統(tǒng)追蹤同一 U 盤(pán)在所有取證鏡像的 USBSTOR 中搜索同一序列號(hào)繪制該 U 盤(pán)在各系統(tǒng)的連接時(shí)間地圖還原設(shè)備在組織內(nèi)的移動(dòng)路徑與網(wǎng)絡(luò)共享訪問(wèn)日志關(guān)聯(lián)。報(bào)告輸出格式本技能給出了標(biāo)準(zhǔn)的取證報(bào)告輸出模板節(jié)選USB Device History Analysis: System: DESKTOP-ABC123 (Windows 10 Pro) Total USB Storage Devices: 12 Analysis Sources: USBSTOR, MountedDevices, MountPoints2, SetupAPI, Event Logs Device Inventory: 1. Kingston DataTraveler 3.0 (Serial: 0019E06B4521A2B0) First Connected: 2024-01-10 09:15:32 (SetupAPI) Last Connected: 2024-01-18 14:30:00 (USBSTOR) Drive Letter: E: User Access: suspect_user (MountPoints2) 2. WD My Passport (Serial: 575834314131363035) First Connected: 2024-01-15 20:00:00 Last Connected: 2024-01-15 23:45:00 Drive Letter: F: User Access: suspect_user Suspicious Findings: - Kingston drive connected 15 times during investigation period - WD Passport connected only once, late evening (unusual hours) - Unknown device (VID_1234PID_5678) connected 2024-01-17, no matching approved device Timeline: /cases/case-2024-001/analysis/usb_timeline.csv報(bào)告中 Suspicious Findings 段落的價(jià)值在于將證據(jù)轉(zhuǎn)化為可操作的調(diào)查線索——連接頻次異常、非工作時(shí)間插入、無(wú)法匹配白名單的未知設(shè)備都是需要進(jìn)一步深挖的切入點(diǎn)。局限性與注意事項(xiàng)USBSTOR 只記錄末次連接它不提供每次插入的歷史記錄完整連接歷史必須依賴(lài)事件日志2003/20001 等與 SetupAPI 日志共享序列號(hào)問(wèn)題部分廠商尤其是廉價(jià) U 盤(pán)會(huì)讓多個(gè)設(shè)備共用同一序列號(hào)此時(shí)無(wú)法通過(guò)序列號(hào)唯一區(qū)分物理設(shè)備需結(jié)合 VID/PID 與體積特征日志留存窗口System 事件日志與 DriverFrameworks-UserMode 日志受日志大小與輪轉(zhuǎn)策略影響可能無(wú)法覆蓋全部歷史需與注冊(cè)表證據(jù)互為補(bǔ)充僅限授權(quán)取證本技能及倉(cāng)庫(kù)整體明確要求僅在擁有授權(quán)或書(shū)面許可的系統(tǒng)上進(jìn)行取證分析遵守適用的法律與交戰(zhàn)規(guī)則見(jiàn) README.md 的使用聲明與 SECURITY.md。延伸閱讀技能正文SKILL.md參考 API 文檔regipy / python-evtx 用法api-reference.md自動(dòng)化 Agent 腳本scripts/agent.py框架映射說(shuō)明mappings/README.mdATTCK 覆蓋總覽ATTACK_COVERAGE.md【免費(fèi)下載鏈接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0項(xiàng)目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills創(chuàng)作聲明：本文部分內(nèi)容由AI輔助生成（AIGC），僅供參考