Kubernetes Network Root Cause Analysis
kubeshark/kubeshark
Investigates past Kubernetes incidents from Kubeshark traffic snapshots: takes captures, dissects API calls, extracts PCAPs and compares traffic over time.
Agent skill
Building Ransomware Playbook With Cisa Framework
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication…
Install Building Ransomware Playbook With Cisa Framework
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-ransomware-playbook-with-cisa-framework --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/building-ransomware-playbook-with-cisa-framework .claude/skills/building-ransomware-playbook-with-cisa-framework && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "building-ransomware-playbook-with-cisa-framework" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-framework into .claude/skills/building-ransomware-playbook-with-cisa-framework/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "building-ransomware-playbook-with-cisa-framework", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-frameworkType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-ransomware-playbook-with-cisa-framework --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/building-ransomware-playbook-with-cisa-framework .agents/skills/building-ransomware-playbook-with-cisa-framework && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "building-ransomware-playbook-with-cisa-framework" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-framework into .agents/skills/building-ransomware-playbook-with-cisa-framework/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "building-ransomware-playbook-with-cisa-framework", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-ransomware-playbook-with-cisa-framework --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/building-ransomware-playbook-with-cisa-framework .cursor/skills/building-ransomware-playbook-with-cisa-framework && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "building-ransomware-playbook-with-cisa-framework" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-framework into .cursor/skills/building-ransomware-playbook-with-cisa-framework/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "building-ransomware-playbook-with-cisa-framework", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/building-ransomware-playbook-with-cisa-framework--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-ransomware-playbook-with-cisa-framework --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/building-ransomware-playbook-with-cisa-framework .gemini/skills/building-ransomware-playbook-with-cisa-framework && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "building-ransomware-playbook-with-cisa-framework" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-framework into .gemini/skills/building-ransomware-playbook-with-cisa-framework/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "building-ransomware-playbook-with-cisa-framework", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-ransomware-playbook-with-cisa-frameworkInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/building-ransomware-playbook-with-cisa-framework .github/skills/building-ransomware-playbook-with-cisa-framework && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "building-ransomware-playbook-with-cisa-framework" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-framework into .github/skills/building-ransomware-playbook-with-cisa-framework/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "building-ransomware-playbook-with-cisa-framework", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills building-ransomware-playbook-with-cisa-framework --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/building-ransomware-playbook-with-cisa-framework .opencode/skills/building-ransomware-playbook-with-cisa-framework && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "building-ransomware-playbook-with-cisa-framework" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/building-ransomware-playbook-with-cisa-framework into .opencode/skills/building-ransomware-playbook-with-cisa-framework/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "building-ransomware-playbook-with-cisa-framework", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
building-ransomware-playbook-with-cisa-framework- GitHub stars
- 34k
- Token cost
- ~2.1k tokens
- SKILL.md length
- 415 words
- Files
- 4 (incl. scripts, references)
- Skills in repo
- 644
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication…
- Works in 5 steps: Preparation Phase (CISA Part 1 -… → Detection and Analysis Phase → Containment Phase → …
- Updating a ransomware playbook
- SKILL.md covers When to Use, Prerequisites, Workflow and Verification, plus 2 more sections
- Runs Python scripts from its folder
What it does
Building Ransomware Playbook With Cisa Framework is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).
It sits in DevOps & Cloud, covering Audit readiness and Incident response. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.
When your agent uses it
- Updating a ransomware playbook
- Running a CISA-aligned readiness assessment
- Validating response steps during a tabletop exercise
Example prompts
- “Use the building-ransomware-playbook-with-cisa-framework skill to build a structured ransomware incident response playbook aligned with the CISA…”
- “/building-ransomware-playbook-with-cisa-framework”
Requirements
- Python 3
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Building Ransomware Playbook With Cisa Framework loads about 2.1k tokens when it runs, and up to ~2.9k if it reads all its reference files. Until then it costs about 115 tokens; SKILL.md has 415 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 415 words, ~2,122 tokens.
Download SKILL.mdSave it as
.claude/skills/building-ransomware-playbook-with-cisa-framework/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- building-ransomware-playbook-with-cisa-framework
- description
- Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Use when creating or updating a ransomware playbook, running a CISA-aligned readiness assessment, or validating response steps during a tabletop exercise.
- domain
- cybersecurity
- subdomain
- ransomware-defense
- tags
- ransomware, incident-response, CISA, playbook, compliance, NIST
- version
- 1.0.0
- author
- mahipal
- license
- Apache-2.0
- nist_csf
- PR.DS-11, RS.MA-01, RC.RP-01, PR.IR-01
- mitre_attack
- T1486, T1490, T1489, T1078, T1021.002
- mitre_f3.version
- 1.1
- mitre_f3.tactics
- initial-access, monetization
Building Ransomware Playbook with CISA Framework
When to Use
- An organization needs to create or update its ransomware incident response playbook following CISA guidelines
- A security team is conducting a ransomware readiness assessment against the CISA StopRansomware framework
- Compliance requires documenting ransomware response procedures aligned with NIST CSF and CISA recommendations
- During tabletop exercises to validate that the organization's ransomware response steps match industry best practices
- After a ransomware incident to update the playbook with lessons learned and close identified gaps
Do not use as a substitute for legal counsel regarding ransom payment decisions, breach notification timelines, or regulatory obligations specific to your jurisdiction.
Prerequisites
- Familiarity with the CISA StopRansomware Guide (cisa.gov/stopransomware/ransomware-guide)
- NIST Cybersecurity Framework (CSF) understanding (Identify, Protect, Detect, Respond, Recover)
- Inventory of critical assets, backup infrastructure, and communication channels
- Defined roles and responsibilities for incident response team members
- Python 3.8+ for playbook generation and compliance checking automation
- Access to organization's asset inventory and backup configuration documentation
Workflow
Step 1: Preparation Phase (CISA Part 1 - Prevention)
Establish ransomware-specific defenses before an incident:
CISA Preparation Checklist:
━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Maintain offline, encrypted backups tested for restoration
[ ] Create and exercise a cyber incident response plan (IRP)
[ ] Implement network segmentation between IT and OT networks
[ ] Enable MFA on all remote access and privileged accounts
[ ] Deploy endpoint detection and response (EDR) on all endpoints
[ ] Disable or restrict RDP; require VPN for remote access
[ ] Maintain a software/hardware asset inventory
[ ] Apply patches within 48 hours for internet-facing systems
[ ] Configure email filtering and disable macro execution by default
[ ] Conduct regular phishing awareness training
[ ] Implement application allowlisting (AppLocker/WDAC)
[ ] Test backup restoration quarterly and document RTO/RPOStep 2: Detection and Analysis Phase
Identify ransomware indicators and assess scope:
Detection Indicators:
━━━━━━━━━━━━━━━━━━━━
- Mass file rename operations with new extensions (.locked, .encrypted)
- Ransom notes appearing in directories (README.txt, DECRYPT.html)
- Volume Shadow Copy deletion (vssadmin delete shadows)
- Abnormal CPU usage from encryption processes
- EDR/AV alerts for known ransomware signatures
- Network connections to known C2 infrastructure
- Unusual lateral movement via SMB or PsExec
- Sysmon Event ID 11 (file creation) spikes
Initial Analysis Steps (CISA):
1. Take system images and memory captures of affected devices
2. Identify patient zero and initial access vector
3. Determine the ransomware family (ID Ransomware, ransom note analysis)
4. Assess encryption scope: which systems, shares, and data are affected
5. Check if data exfiltration occurred (double extortion indicator)Step 3: Containment Phase
Stop the spread and preserve evidence:
Immediate Containment (First 1-4 hours):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Isolate affected systems from the network (disable NICs, VLAN quarantine)
2. If unable to disconnect, power down affected systems
3. Disable shared drives to prevent encryption spread
4. Reset credentials for compromised accounts (especially admin/service accounts)
5. Block known ransomware IOCs at firewall/proxy (C2 domains, IPs)
6. Preserve forensic evidence (memory dumps, disk images, logs)
7. Engage legal counsel and prepare breach notification if data exfiltrated
Extended Containment:
- Identify and patch the initial access vector (phishing, RDP, VPN vuln)
- Audit all Active Directory accounts for persistence (scheduled tasks, services)
- Check for backdoors or additional malware beyond the ransomware payloadStep 4: Eradication and Recovery Phase
Remove the threat and restore operations:
CISA Recovery Steps:
━━━━━━━━━━━━━━━━━━━
1. Rebuild affected systems from known-clean images (do NOT decrypt in place)
2. Restore data from offline backups (verify backup integrity first)
3. Reset ALL passwords including service accounts, krbtgt (twice, 12h apart)
4. Scan restored systems with updated AV/EDR before reconnecting to network
5. Re-enable services in priority order based on business criticality
6. Monitor restored systems intensively for 72 hours for reinfection
Recovery Priority Matrix:
P1 (0-4h): Domain controllers, DNS, authentication infrastructure
P2 (4-24h): Email, critical business applications, databases
P3 (1-3d): File servers, departmental applications
P4 (3-7d): Non-critical systems, development environmentsStep 5: Post-Incident Activity
Document lessons learned and improve defenses:
Post-Incident Report Template:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Executive summary: What happened, impact, resolution
2. Timeline: Detection to full recovery with timestamps
3. Root cause analysis: Initial access vector and propagation path
4. Scope: Number of systems, data volumes, business impact in hours/dollars
5. Response effectiveness: What worked, what failed, what was missing
6. Recommendations: Specific technical and procedural improvements
7. Compliance actions: Notification timeline, regulatory obligations met
8. Updated playbook: Revisions based on lessons learnedVerification
- Validate playbook completeness against CISA StopRansomware checklist items
- Conduct tabletop exercise using the playbook with all stakeholders
- Verify backup restoration procedures work within documented RTO targets
- Test communication plans including out-of-band channels
- Confirm legal and regulatory notification procedures are current
- Review and update the playbook at least annually or after any incident
Show full SKILL.md (145 more words)Show less
Key Concepts
| Term | Definition |
|---|---|
| CISA StopRansomware Guide | Joint CISA/MS-ISAC/NSA/FBI guide providing ransomware prevention best practices and response checklists |
| RTO/RPO | Recovery Time Objective (max downtime) and Recovery Point Objective (max data loss); critical metrics for backup planning |
| Double Extortion | Ransomware tactic where attackers both encrypt data and threaten to publish stolen data unless paid |
| Patient Zero | The first system compromised in an incident; identifying it reveals the initial access vector |
| Tabletop Exercise | Simulated incident scenario walked through by the response team to validate the playbook without live systems |
Tools & Systems
- CISA StopRansomware Guide: Primary framework for ransomware response planning and prevention
- NIST CSF: Cybersecurity Framework providing the Identify/Protect/Detect/Respond/Recover structure
- ID Ransomware: Service for identifying ransomware families from encrypted files and ransom notes
- MITRE ATT&CK: Technique framework for mapping ransomware TTPs to detection opportunities
- Velociraptor: Endpoint visibility tool for rapid triage and forensic artifact collection during incidents
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (scripts, references) in skills/building-ransomware-playbook-with-cisa-framework of mukul975/Anthropic-Cybersecurity-Skills.
- SKILL.md
- LICENSE
- references/api-reference.md
- scripts/agent.py
Open the folder on GitHubat commit 54a7988
Compare with similar skills
Building Ransomware Playbook With Cisa Framework next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Building Ransomware Playbook With Cisa Framework this skillmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.1k | Automated safety check: Pass | Apache-2.0 | |
| Kubernetes Network Root Cause Analysiskubeshark/kubeshark | 12k | — | ~5.3k | Automated safety check: Pass | Apache-2.0 | |
| UModel Root Cause Analysisalibaba/UnifiedModel | 415 | — | ~1.9k | Automated safety check: Pass | Custom licence | |
| Learningskortix-ai/suna | 20k | — | ~1.1k | Automated safety check: Pass | Custom licence | |
| Nix Config Debugryan4yin/nix-config | 2.1k | — | ~1.2k | Automated safety check: Pass | MIT | |
| Oncallpigweed-project/pigweed | 548 | — | ~963 | Automated safety check: Pass | Apache-2.0 |
Similar skills
UModel Root Cause Analysis
alibaba/UnifiedModel
Investigates a service incident to its root cause by querying a UModel object graph alongside metrics, logs, topology and recent deployments.
Learnings
kortix-ai/suna
The project's episodic memory: a timestamped ledger of rules paid for with real outages and near-misses, one entry per incident.
Nix Config Debug
ryan4yin/nix-config
A skill your agent uses when something here is broken or stops working: an eval or build error, a failed activation, a dead or restarting unit, a mihomo or DNS outage, an unreachable host or MicroVM…
Oncall
pigweed-project/pigweed
Pigweed oncall rotation runbooks and maintenance workflows (such as rolling CIPD client tools for b/315378787).
Iso42001
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert ISO 42001 AI Management System (AIMS) compliance advisor.
More from mukul975/Anthropic-Cybersecurity-Skills
All 644 skills in this repoCampaign Attribution Evidence Analysis
mukul975/Anthropic-Cybersecurity-Skills
Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.
Go Malware Analysis in Ghidra
mukul975/Anthropic-Cybersecurity-Skills
Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.
LNK and Jump List Forensics
mukul975/Anthropic-Cybersecurity-Skills
Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.
Malware Persistence Analysis with Autoruns
mukul975/Anthropic-Cybersecurity-Skills
Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.
NTFS MFT Deleted File Recovery
mukul975/Anthropic-Cybersecurity-Skills
Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.
Network Covert Channel Analysis
mukul975/Anthropic-Cybersecurity-Skills
Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.
Related
Categories
Questions about Building Ransomware Playbook With Cisa Framework
What does Building Ransomware Playbook With Cisa Framework do?
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication…. Building Ransomware Playbook With Cisa Framework is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists.
When should I use Building Ransomware Playbook With Cisa Framework?
Building Ransomware Playbook With Cisa Framework fits situations like: updating a ransomware playbook; running a CISA-aligned readiness assessment; validating response steps during a tabletop exercise.
How do I install Building Ransomware Playbook With Cisa Framework in Claude Code?
Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a claude-code`. Or copy the skill folder (skills/building-ransomware-playbook-with-cisa-framework in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/building-ransomware-playbook-with-cisa-framework in your project. Claude Code loads it when a task matches its description.
How do I install Building Ransomware Playbook With Cisa Framework in Codex?
Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a codex`. Or copy the skill folder (skills/building-ransomware-playbook-with-cisa-framework in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/building-ransomware-playbook-with-cisa-framework in your project. Codex loads it when a task matches its description.
Can I use Building Ransomware Playbook With Cisa Framework in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-ransomware-playbook-with-cisa-framework -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/building-ransomware-playbook-with-cisa-framework, .gemini/skills/building-ransomware-playbook-with-cisa-framework, .github/skills/building-ransomware-playbook-with-cisa-framework and .opencode/skills/building-ransomware-playbook-with-cisa-framework in your project.
What does Building Ransomware Playbook With Cisa Framework need to run?
Going by SKILL.md and its folder, Building Ransomware Playbook With Cisa Framework needs Python for the scripts in its folder. Our summary lists: Python 3.
Does Building Ransomware Playbook With Cisa Framework access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Building Ransomware Playbook With Cisa Framework safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Building Ransomware Playbook With Cisa Framework use?
Building Ransomware Playbook With Cisa Framework is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Building Ransomware Playbook With Cisa Framework use?
About 2.1k tokens (SKILL.md is roughly 8.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 792 tokens, read only when the agent opens those files.
What are the alternatives to Building Ransomware Playbook With Cisa Framework?
Skills that share tags, products or a category with Building Ransomware Playbook With Cisa Framework: Kubernetes Network Root Cause Analysis (kubeshark/kubeshark, 12k stars), UModel Root Cause Analysis (alibaba/UnifiedModel, 415 stars), Learnings (kortix-ai/suna, 20k stars) and Nix Config Debug (ryan4yin/nix-config, 2.1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Building Ransomware Playbook With Cisa Framework?
mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.
Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.