Skip to content
Get packs

Analyzing Indicators of Compromise

Triage and score suspicious IPs, domains, hashes and URLs using multiple threat intel sources

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent can take suspicious items a security analyst finds, such as IP addresses, web domains, file hashes, URLs and email addresses, and check them against threat intelligence services like VirusTotal, AbuseIPDB and MalwareBazaar. It then follows a set scoring framework to suggest whether each item should be blocked, monitored, whitelisted, or treated as a false positive, and it reminds the user to record the decision. The skill also includes a Python helper that classifies indicators, defangs them for safe documentation, and refangs them for querying.

Great for

  • SOC analysts triaging indicators from phishing emails or security alerts
  • Security engineers building IOC enrichment pipelines
  • Threat intelligence teams deciding which indicators to block or monitor

Skip it if

  • Making high-stakes blocking decisions without human review, since the skill itself warns to combine automated enrichment with analyst judgment, especially for shared CDN or cloud infrastructure
  • Non-security users with no access to the listed threat intelligence accounts, since most lookups need API keys
  • Anyone expecting the skill to detect threats on its own; it only enriches and scores indicators supplied to it

Try asking

  • “Triage these IOCs from a phishing email and tell me which ones to block: 1.2.3.4, evil-domain.com, and the attached file hash”
  • “Check this SHA-256 hash against VirusTotal and MalwareBazaar and summarize the detections”
  • “Defang these URLs so I can paste them safely into an incident report”
  • “Score this IP address using AbuseIPDB and tell me whether it looks like shared cloud infrastructure”
Step-by-step guide: how to use Analyzing Indicators of CompromiseInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-indicators-of-compromise.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-indicators-of-compromise.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-indicators-of-compromise.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Store API keys in environment variables rather than pasting them into chats or code, since the examples use placeholder key strings
  • Always defang indicators before sharing them in reports or tickets to avoid accidental clicks
  • Treat the built-in score thresholds as a starting point and tune them for your environment, especially for shared hosting and CDN addresses

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.