Skip to content
Get packs

Adversary Infrastructure Tracker

Build a Python system that maps threat-actor C2 networks by pivoting across DNS, certificate and WHOIS data.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent to help build a Python tool that starts from a known malicious domain or IP and searches passive DNS history, certificate transparency logs, WHOIS registration records and IP data to find related infrastructure. The tool links these findings into a graph so analysts can see how an attacker's servers connect and flag newly registered domains that match known patterns. It is a blueprint for threat-intelligence work rather than a ready-made product.

Great for

  • Threat intelligence analysts who want to automate pivoting from known indicators
  • Security engineers building internal infrastructure-monitoring pipelines
  • Students learning how C2 infrastructure is mapped using open data sources

Skip it if

  • Users without API subscriptions, since most lookups need paid keys (SecurityTrails, Shodan, VirusTotal) and the results depend on them
  • Anyone aiming to attack or take down infrastructure they do not own, since the same techniques support reconnaissance and should be used within legal and policy limits
  • Production use without review, since the code samples are partial and the bundled script has not been verified against current API behaviour

Try asking

  • “Build a Python tool that pivots from a suspicious IP to find other domains hosted on it”
  • “Write code that pulls certificate transparency records for a domain and groups related hosts”
  • “Create a NetworkX graph linking domains, IPs and registrants from a seed indicator”
  • “Set up a check that flags newly registered domains resembling a known actor's naming pattern”
Step-by-step guide: how to use Adversary Infrastructure TrackerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    building-adversary-infrastructure-tracking-system.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-adversary-infrastructure-tracking-system.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-adversary-infrastructure-tracking-system.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Store API keys in environment variables rather than hard-coding them in scripts
  • Review scripts/agent.py before running it, since it sends queries to external services such as crt.sh and abuse.ch
  • Respect rate limits and provider terms of service, and only track infrastructure relevant to authorised investigations

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.