Guide · Agent skill
How to use the CTI Attack Pattern Library Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the building-attack-pattern-library-from-cti-reports agent skill, which teaches an AI agent to read cyber threat intelligence reports, pull out the attacker behaviors they describe, and match those behaviors to MITRE ATT&CK technique IDs. It is written for detection engineers and threat intelligence analysts who may not have used agent skills before. By the end you will know how to install the skill, how to ask for the work in plain language, what the skill needs to run, and where its output needs your review.
CTI Attack Pattern Library Buildermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page and unzip it.
- 2Place the skill folder. Unzip into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the Python libraries. Make sure Python 3.9 or newer is available, with stix2, mitreattack-python, spacy and requests installed.
- 4Gather your inputs. Collect the CTI reports as PDF, HTML or text, and have a copy of MITRE ATT&CK STIX data ready, either local or reachable over TAXII.
- 5Ask for the task in plain language. Describe the reports and the output you want, such as a STIX 2.1 library with ATT&CK IDs or Sigma templates.
- 6Review the output. Check each extracted behavior and technique ID against the source sentence before using it.
What the skill makes the agent do
The skill covers parsing CTI reports from vendors such as Mandiant, CrowdStrike, Talos and Microsoft, extracting adversary behaviors, mapping them to MITRE ATT&CK technique IDs, creating STIX 2.1 Attack Pattern objects, and building a library that can be searched by tactic, technique and threat actor. It can also generate detection rule templates from the documented patterns.
Extraction in the bundled approach is keyword and regular-expression based. The skill looks for action verbs such as used, executed, dropped or exfiltrated, and for named tools such as Mimikatz or PowerShell, then checks sentences against a keyword-to-technique table. Each STIX Attack Pattern links to ATT&CK through an external reference and carries kill chain phases.
- Parse PDF, HTML or text CTI reports into candidate behavior sentences
- Map behaviors to ATT&CK technique IDs such as T1566.001 or T1003.001
- Create STIX 2.1 attack-pattern records with ATT&CK external references
- Organize the results into a searchable library
- Suggest Sigma or YARA starting templates from documented behaviors
Install the skill (ZIP download or Claude apps upload)
Download the skill ZIP from this page and unzip it. To make the skill available to Claude Code for all of your projects, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder. Either way, the skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal use across projects: ~/.claude/skills/
- Single project: the .claude/skills/ folder inside that project
- Claude apps: Settings → Capabilities → Skills
Install the requirements the skill needs
The skill lists Python 3.9 or newer and these libraries: stix2, mitreattack-python, spacy and requests. You also need a collection of CTI reports in PDF, HTML or text form, and a copy of MITRE ATT&CK STIX data, either stored locally or fetched over TAXII.
The bundled example code in SKILL.md imports attackcti, which is not in the listed requirements. If you see an import error, check the imports before assuming the skill is broken.
- Python 3.9+
- stix2, mitreattack-python, spacy, requests
- CTI reports as PDF, HTML or text
- MITRE ATT&CK STIX data (local copy or via TAXII)
Trigger the skill with a natural request
You do not need special syntax. Describe the job in plain language and name the report or folder. The skill's description says it applies when you are cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma or YARA templates from documented behaviors, so requests phrased that way are the most likely to trigger it.
Be specific about the output you want. Asking for a STIX 2.1 library, a list of ATT&CK IDs with the sentences that support them, or Sigma starting points gives the agent a clear target.
- Catalog the attack patterns in this Mandiant report into a STIX 2.1 library with ATT&CK IDs.
- Read these three CrowdStrike and Talos PDFs and list every technique with the sentence that supports it.
- Turn the behaviors in this report into Sigma rule templates for detection engineering.
- Build a searchable attack-pattern library from this folder of CTI reports, indexed by tactic and technique.
Understand what the output looks like
The bundled parser splits report text into sentences and keeps those that contain a behavior indicator and at least one technique keyword. Each kept behavior records the sentence, the action word, any tools found and the technique hints. The reference file lists regex patterns for techniques and IOCs such as IPv4 addresses, MD5 and SHA-256 hashes, and defanged URLs.
Because matching is simple, expect false positives and misses. The reference file also shows an explicit technique pattern, so IDs written directly in a report are picked up.
- Sentence, action word, tools and technique hints for each extracted behavior
- Explicit ATT&CK IDs written in the report are matched directly
- IOC patterns for IPv4, domains, MD5, SHA-256 and defanged URLs
"pass the hash": "T1550.002"Safety notes: scripts and network access
This skill runs scripts and uses the network. The agent executes Python code on local inputs, so review the report files and scripts before running them, especially if the reports came from an untrusted source. The skill also uses the network, for example when ATT&CK data is fetched via TAXII.
Treat every output as a draft. Analysts should check each extracted behavior against the source sentence before it enters a shared library or becomes a detection rule.
- Review untrusted report files before the agent processes them
- Check the scripts you are about to run
- Expect network calls when ATT&CK data is loaded over TAXII
- Review every mapped technique and generated template before use
Tips for better results
Give the agent a fixed set of reports and ask it to report the source sentence for each technique. This makes errors easy to spot. The keyword table in the skill covers common techniques such as spearphishing, PowerShell, LSASS credential dumping and Kerberoasting, but it does not cover everything, so ask the agent to list behaviors it could not map as well as the ones it did.
Use the output as a starting point for detection engineering rather than a finished detection. Sigma and YARA templates generated from keywords will need tuning against your own telemetry.
- Ask for the source sentence behind each technique ID
- Ask for unmapped behaviors too, not only matches
- Tune generated Sigma or YARA templates against your own data
- Start with a small set of reports and expand after reviewing results
What people use it for
- Building a searchable internal library of ATT&CK-mapped behaviors from several vendor reports
- Creating STIX 2.1 attack-pattern records to share with a threat intelligence platform
- Drafting Sigma or YARA starting templates for detection engineering backlogs
- Checking which documented behaviors in recent reports have no matching technique in your catalog
Frequently asked questions
How do I install the building-attack-pattern-library-from-cti-reports skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What Python libraries does the skill need?
The skill lists Python 3.9 or newer with stix2, mitreattack-python, spacy and requests. You also need CTI reports in PDF, HTML or text form and MITRE ATT&CK STIX data, either local or via TAXII.
Is the skill free to use?
The skill is released under the Apache-2.0 licence, as stated on this page. Check the licence file in the download for the full terms.
Is it accurate enough for production detection work?
Not on its own. The bundled matching is keyword and regex based, so it will miss or misclassify many behaviors. Use its output as a draft that an analyst reviews against the source report.
Are there alternatives or ways it compares to other tools?
This page does not compare the skill with other tools, so no comparison is claimed here. The skill's own approach is keyword and regex matching combined with stix2 and mitreattack-python, which is simpler than production NLP.
Why does the example code fail with an import error?
The example in SKILL.md imports attackcti, which is not in the listed requirements. Check that the imports match the libraries you installed and confirm the ATT&CK data source is reachable.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a detection engineer or threat intelligence analyst who wants to turn vendor reports into a structured, ATT&CK-mapped catalog and starting detection templates. Pick something else if you need production-grade NLP or fully automated detections, since the bundled matching is simple and every output needs analyst review.
Download the skill