CTI Attack Pattern Library Builder
Extracts attack behaviors from threat reports and catalogs them as ATT&CK-mapped STIX patterns
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent to read cyber threat intelligence reports from security vendors, pull out the attacker behaviors they describe, and match those behaviors to MITRE ATT&CK technique IDs. It then organizes them into a searchable library of STIX 2.1 attack-pattern records and can suggest starting detection rules (Sigma or YARA templates). It is aimed at security teams that want to turn written reports into structured, reusable detection work.
Great for
- Detection engineers who want to turn vendor reports into a catalog of ATT&CK-mapped behaviors
- Threat intelligence analysts building an internal, searchable attack-pattern library
- Security teams planning threat-informed detection coverage
Skip it if
- Teams expecting production-grade NLP: the bundled keyword and regex matching is simple and will miss or misclassify many behaviors, so outputs need analyst review
- Users who run the scripts on untrusted report files without reviewing them first, since the agent executes Python code on local inputs
Try asking
- “Parse this Mandiant report PDF text and list the ATT&CK techniques the adversary used”
- “Build a STIX 2.1 attack-pattern bundle from these three CrowdStrike reports”
- “Generate Sigma detection template stubs for the behaviors extracted from this report”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-attack-pattern-library-from-cti-reports.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-attack-pattern-library-from-cti-reports.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-attack-pattern-library-from-cti-reports.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review extracted technique mappings manually; keyword matching can produce false positives such as a tool name appearing in an unrelated sentence
- Use a local copy of ATT&CK STIX data where possible to limit network calls and keep results reproducible
- Run the scripts in an isolated environment first, and read scripts/agent.py before executing it on sensitive report material
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.