How does it handle sensitive intelligence sharing?

It utilizes the Traffic Light Protocol (TLP) to classify sharing restrictions and provides defanging procedures to prevent accidental execution of malicious links in reports.

Can I use this for real-time incident response?

Absolutely. It is specifically designed to assist analysts in extracting and scoring indicators during active investigations to enable immediate blocking and mitigation.

What types of indicators does this skill collect?

The skill covers network (IPs, domains, URLs, JA3 hashes), host (file hashes, registry keys, mutexes), email (sender info, headers), and behavioral artifacts observed during attacks.

Does it support standard threat intelligence formats?

Yes, it natively supports STIX 2.1 formatting, making it compatible with TAXII servers and major threat intelligence platforms like MISP and OpenCTI.

IOC Collection & Threat Intelligence

Name: IOC Collection & Threat Intelligence
Author: mukul975

bymukul975

•

4,121

•

Seguridad y Pruebas

Systematically identifies, extracts, and enriches technical artifacts to block threats and share intelligence during security incidents.

This skill empowers Claude to act as a cybersecurity analyst, systematically collecting and categorizing Indicators of Compromise (IOCs) across network, host, and email vectors. It guides users through extracting artifacts from SIEM logs, memory forensics, and malware reports, while facilitating enrichment via platforms like VirusTotal and MISP. By standardizing outputs into STIX 2.1 formats, it streamlines threat intelligence sharing and enhances defensive postures through automated blocking and detection rule creation.

Características Principales

01Multi-vector IOC extraction across network, host, and email domains

024,121 GitHub stars

03Defanging procedures for safe reporting and threat intelligence sharing

04Automated enrichment using VirusTotal, Shodan, and MISP context

05STIX 2.1 compliant formatting for TAXII sharing

06Context-aware risk scoring and confidence leveling (0-100)

Casos de Uso

01Creating blocklists and detection rules for SIEM and EDR platforms

02Formatting observed malware artifacts for ISAC/ISAO threat sharing portals

03Generating structured IOC reports during active incident response investigations

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills collecting-indicators-of-compromise

For use in Claude.ai and ChatGPT

Características Principales

01Multi-vector IOC extraction across network, host, and email domains

024,121 GitHub stars

03Defanging procedures for safe reporting and threat intelligence sharing

04Automated enrichment using VirusTotal, Shodan, and MISP context

05STIX 2.1 compliant formatting for TAXII sharing

06Context-aware risk scoring and confidence leveling (0-100)

Casos de Uso

01Creating blocklists and detection rules for SIEM and EDR platforms

02Formatting observed malware artifacts for ISAC/ISAO threat sharing portals

03Generating structured IOC reports during active incident response investigations

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills collecting-indicators-of-compromise

For use in Claude.ai and ChatGPT