Does this skill require external Python libraries?

Yes, it requires Python 3.8+ and the pycrtsh library to interface effectively with the crt.sh database.

Can I monitor for unauthorized wildcard certificates?

Yes, the skill includes logic to flag wildcard certificates issued on suspicious subdomains that could indicate shadow IT or takeover attempts.

What is Certificate Transparency monitoring?

It is the practice of auditing publicly logged SSL/TLS certificates to detect unauthorized issuances and identify malicious domains targeting your brand.

How does this skill detect typosquatting?

It utilizes Levenshtein distance to compare newly issued certificate names against your organization's legitimate domains to find slight, suspicious variations.

Is this skill suitable for SOC analysts?

Absolutely. It provides structured procedures and code snippets for proactive threat hunting and validating security monitoring coverage.

TLS Certificate Transparency Analysis

Name: TLS Certificate Transparency Analysis
Author: micsapp

bymicsapp

0•

Security & Testing

Monitors and analyzes Certificate Transparency logs to detect phishing attempts, unauthorized SSL/TLS issuances, and potential brand impersonation.

This skill empowers security analysts and developers to proactively defend their digital perimeter by querying crt.sh databases via the pycrtsh library. It identifies suspicious certificates using Levenshtein distance for typosquatting detection, uncovers shadow IT infrastructure, and flags certificates from unauthorized Authorities. By automating the monitoring of newly issued certificates, it provides a critical layer of defense against phishing infrastructure and brand impersonation before attacks are fully deployed.

Key Features

01Automated querying of crt.sh Certificate Transparency logs

02Proactive monitoring for brand impersonation and phishing domains

03Typosquatting detection using Levenshtein distance algorithms

040 GitHub stars

05Discovery of hidden subdomains and shadow IT infrastructure

06Identification of unauthorized or unexpected Certificate Authorities

Use Cases

01Monitoring brand-related certificate issuances for compliance auditing

02Identifying unauthorized wildcard certificates on corporate subdomains

03Automated phishing infrastructure detection for SOC teams

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills analyzing-tls-certificate-transparency-logs

For use in Claude.ai and ChatGPT

Key Features

01Automated querying of crt.sh Certificate Transparency logs

02Proactive monitoring for brand impersonation and phishing domains

03Typosquatting detection using Levenshtein distance algorithms

040 GitHub stars

05Discovery of hidden subdomains and shadow IT infrastructure

06Identification of unauthorized or unexpected Certificate Authorities

Use Cases

01Monitoring brand-related certificate issuances for compliance auditing

02Identifying unauthorized wildcard certificates on corporate subdomains

03Automated phishing infrastructure detection for SOC teams

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills analyzing-tls-certificate-transparency-logs

For use in Claude.ai and ChatGPT