Skip to content
Get packs

Collecting Indicators of Compromise

Gathers, scores, enriches and shares attack indicators like malicious IPs and file hashes during incidents.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, this skill teaches an AI agent a structured method for incident responders: pulling technical clues such as malicious IP addresses, domains, URLs, file hashes, registry keys and email sender details out of logs, memory dumps, sandbox reports and reports. The agent can then enrich those clues with threat intelligence context, score how confident it is in each one, and package them in the STIX 2.1 format so they can be pushed to blocking tools or shared with partners. A bundled Python script can also extract indicators from text or files and call external enrichment services.

Great for

  • Security analysts handling an active incident who need to turn evidence into blocklists and detection rules
  • Threat intelligence teams preparing indicator feeds for sharing via MISP, TAXII servers or ISAC portals
  • Students learning how indicators of compromise are categorized and represented in STIX

Skip it if

  • Behavioral-only analysis with no technical artifacts; the skill itself says to use MITRE ATT&CK mapping for that
  • Non-security users: the output assumes familiarity with SIEM, EDR, STIX and threat intelligence platforms
  • Sharing sensitive indicators without checking sharing agreements and TLP markings, since distributing them carelessly can expose an investigation

Try asking

  • “Extract all IP addresses, domains and file hashes from this sandbox report and list them by category”
  • “Enrich these three IPs with threat intelligence context and give each a confidence score”
  • “Package these indicators as a STIX 2.1 bundle ready to share with our ISAC”
  • “Write SIEM searches that will alert on the domains and hashes from this incident”
Step-by-step guide: how to use Collecting Indicators of CompromiseInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    collecting-indicators-of-compromise.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip collecting-indicators-of-compromise.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip collecting-indicators-of-compromise.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the extracted indicators before enrichment or sharing, because the regex extractor can capture benign domains and IPs as well as malicious ones.
  • Set TLP markings and confirm sharing agreements before pushing any indicators to external partners.
  • Keep API keys in environment variables rather than pasting them into prompts or committing them to code.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.